lkml.org 
[lkml]   [2022]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for init_fpstate
From
On 10/12/2022 8:35 PM, Yao, Yuan wrote:
>
> The reason is __copy_xstate_to_uabi_buf() copies data from &init_fpstate when the component
> is not existed in the source kernel fpstate (here is the AMX tile component), but the
> AMX TILE bit is removed from init_fpstate due to this patch, so the WARN is triggered and return
> NULL which causes kernel NULL pointer dereference later.

We have this in __copy_xstate_to_uabi_buf() [1]:

mask = fpstate->user_xfeatures;

for_each_extended_xfeature(i, mask) {
...
}

And the KVM code seems to set dynamic features regardless of the buffer
reallocation [2]:

vcpu->arch.guest_fpu.fpstate->user_xfeatures =
vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;

The kernel code seems to be aware of this as fpstate_realloc() does [3]:

if (!guest_fpu)
newfps->user_xfeatures = curfps->user_xfeatures | xfeatures;

But it updates the 'xfeature' bitmask for all:

newfps->xfeatures = curfps->xfeatures | xfeatures;

So, I think we can do something like this here:

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index c8340156bfd2..8ea7d0e95f1a 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1127,8 +1127,12 @@ void __copy_xstate_to_uabi_buf(struct membuf to,
struct fpstate *fpstate,
* non-compacted format disabled features still occupy state space,
* but there is no state to copy from in the compacted
* init_fpstate. The gap tracking will zero these states.
+ *
+ * In the case of guest fpstate, this user_xfeatures does not
+ * dynamically reflect the capacity of the XSAVE buffer but
+ * xfeatures does. So AND them together.
*/
- mask = fpstate->user_xfeatures;
+ mask = fpstate->user_xfeatures & fpstate->xfeatures;

Let me also test this by running KVM.

Thanks,
Chang

[1]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/fpu/xstate.c#n1131
[2]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kvm/cpuid.c#n346
[3]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/fpu/xstate.c#n1448
\
 
 \ /
  Last update: 2022-10-13 18:27    [W:0.120 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site