Messages in this thread Patch in this message | | | Date | Thu, 13 Oct 2022 09:23:20 -0700 | Subject | Re: [PATCH] x86/fpu: Remove dynamic features from xcomp_bv for init_fpstate | From | "Chang S. Bae" <> |
| |
On 10/12/2022 8:35 PM, Yao, Yuan wrote: > > The reason is __copy_xstate_to_uabi_buf() copies data from &init_fpstate when the component > is not existed in the source kernel fpstate (here is the AMX tile component), but the > AMX TILE bit is removed from init_fpstate due to this patch, so the WARN is triggered and return > NULL which causes kernel NULL pointer dereference later.
We have this in __copy_xstate_to_uabi_buf() [1]:
mask = fpstate->user_xfeatures;
for_each_extended_xfeature(i, mask) { ... }
And the KVM code seems to set dynamic features regardless of the buffer reallocation [2]:
vcpu->arch.guest_fpu.fpstate->user_xfeatures = vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
The kernel code seems to be aware of this as fpstate_realloc() does [3]:
if (!guest_fpu) newfps->user_xfeatures = curfps->user_xfeatures | xfeatures;
But it updates the 'xfeature' bitmask for all:
newfps->xfeatures = curfps->xfeatures | xfeatures;
So, I think we can do something like this here:
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index c8340156bfd2..8ea7d0e95f1a 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -1127,8 +1127,12 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate, * non-compacted format disabled features still occupy state space, * but there is no state to copy from in the compacted * init_fpstate. The gap tracking will zero these states. + * + * In the case of guest fpstate, this user_xfeatures does not + * dynamically reflect the capacity of the XSAVE buffer but + * xfeatures does. So AND them together. */ - mask = fpstate->user_xfeatures; + mask = fpstate->user_xfeatures & fpstate->xfeatures;
Let me also test this by running KVM.
Thanks, Chang
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/fpu/xstate.c#n1131 [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kvm/cpuid.c#n346 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/fpu/xstate.c#n1448
| |