renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-12 23:54:19 +08:00
Code

x86/mpx: Use the new get_xsave_field_ptr()API

Browse Source 
The MPX registers (bndcsr/bndcfgu/bndstatus) are not directly
accessible via normal instructions.  They essentially act as
if they were floating point registers and are saved/restored
along with those registers.

There are two main paths in the MPX code where we care about
the contents of these registers:

	1. #BR (bounds) faults
	2. the prctl() code where we are setting MPX up

Both of those paths _might_ be called without the FPU having
been used.  That means that 'tsk->thread.fpu.state' might
never be allocated.

Also, fpu_save_init() is not preempt-safe.  It was a bug to
call it without disabling preemption.  The new
get_xsave_addr() calls unlazy_fpu() instead and properly
disables preemption.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dave Hansen <dave@sr71.net>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Suresh Siddha <sbsiddha@gmail.com>
Cc: bp@alien8.de
Link: http://lkml.kernel.org/r/20150607183701.BC0D37CF@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Dave Hansen 2015-06-07 11:37:01 -07:00 committed by Ingo Molnar
parent 04cd027bcb
commit a84eeaa96b
3 changed files with 27 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
arch/x86/include/asm/mpx.h
View File

@ -60,8 +60,8 @@
#ifdef CONFIG_X86_INTEL_MPX #ifdef CONFIG_X86_INTEL_MPX
siginfo_t *mpx_generate_siginfo(struct pt_regs *regs, siginfo_t *mpx_generate_siginfo(struct pt_regs *regs,
struct xregs_state *xsave_buf); struct task_struct *tsk);
int mpx_handle_bd_fault(struct xregs_state *xsave_buf); int mpx_handle_bd_fault(struct task_struct *tsk);
static inline int kernel_managing_mpx_tables(struct mm_struct *mm) static inline int kernel_managing_mpx_tables(struct mm_struct *mm)
{ {
return (mm->bd_addr != MPX_INVALID_BOUNDS_DIR); return (mm->bd_addr != MPX_INVALID_BOUNDS_DIR);
@ -78,11 +78,11 @@ void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long start, unsigned long end); unsigned long start, unsigned long end);
#else #else
static inline siginfo_t *mpx_generate_siginfo(struct pt_regs *regs, static inline siginfo_t *mpx_generate_siginfo(struct pt_regs *regs,
struct xregs_state *xsave_buf) struct task_struct *tsk)
{ {
return NULL; return NULL;
} }
static inline int mpx_handle_bd_fault(struct xregs_state *xsave_buf) static inline int mpx_handle_bd_fault(struct task_struct *tsk)
{ {
return -EINVAL; return -EINVAL;
} }

17
arch/x86/kernel/traps.c
View File

@ -59,6 +59,7 @@
#include <asm/fixmap.h> #include <asm/fixmap.h>
#include <asm/mach_traps.h> #include <asm/mach_traps.h>
#include <asm/alternative.h> #include <asm/alternative.h>
#include <asm/fpu/xstate.h>
#include <asm/mpx.h> #include <asm/mpx.h>
#ifdef CONFIG_X86_64 #ifdef CONFIG_X86_64
@ -371,9 +372,8 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
dotraplinkage void do_bounds(struct pt_regs *regs, long error_code) dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
{ {
struct task_struct *tsk = current; struct task_struct *tsk = current;
struct xregs_state *xsave_buf;
enum ctx_state prev_state; enum ctx_state prev_state;
struct bndcsr *bndcsr; const struct bndcsr *bndcsr;
siginfo_t *info; siginfo_t *info;
prev_state = exception_enter(); prev_state = exception_enter();
@ -392,12 +392,11 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
/* /*
* We need to look at BNDSTATUS to resolve this exception. * We need to look at BNDSTATUS to resolve this exception.
* It is not directly accessible, though, so we need to * A NULL here might mean that it is in its 'init state',
* do an xsave and then pull it out of the xsave buffer. * which is all zeros which indicates MPX was not
* responsible for the exception.
*/ */
copy_fpregs_to_fpstate(&tsk->thread.fpu); bndcsr = get_xsave_field_ptr(XSTATE_BNDCSR);
xsave_buf = &(tsk->thread.fpu.state.xsave);
bndcsr = get_xsave_addr(xsave_buf, XSTATE_BNDCSR);
if (!bndcsr) if (!bndcsr)
goto exit_trap; goto exit_trap;
@ -408,11 +407,11 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
*/ */
switch (bndcsr->bndstatus & MPX_BNDSTA_ERROR_CODE) { switch (bndcsr->bndstatus & MPX_BNDSTA_ERROR_CODE) {
case 2: /* Bound directory has invalid entry. */ case 2: /* Bound directory has invalid entry. */
if (mpx_handle_bd_fault(xsave_buf)) if (mpx_handle_bd_fault(tsk))
goto exit_trap; goto exit_trap;
break; /* Success, it was handled */ break; /* Success, it was handled */
case 1: /* Bound violation. */ case 1: /* Bound violation. */
info = mpx_generate_siginfo(regs, xsave_buf); info = mpx_generate_siginfo(regs, tsk);
if (IS_ERR(info)) { if (IS_ERR(info)) {
/* /*
* We failed to decode the MPX instruction. Act as if * We failed to decode the MPX instruction. Act as if

30
arch/x86/mm/mpx.c
View File

@ -272,9 +272,9 @@ bad_opcode:
* The caller is expected to kfree() the returned siginfo_t. * The caller is expected to kfree() the returned siginfo_t.
*/ */
siginfo_t *mpx_generate_siginfo(struct pt_regs *regs, siginfo_t *mpx_generate_siginfo(struct pt_regs *regs,
struct xregs_state *xsave_buf) struct task_struct *tsk)
{ {
struct bndreg *bndregs, *bndreg; const struct bndreg *bndregs, *bndreg;
siginfo_t *info = NULL; siginfo_t *info = NULL;
struct insn insn; struct insn insn;
uint8_t bndregno; uint8_t bndregno;
@ -294,8 +294,8 @@ siginfo_t *mpx_generate_siginfo(struct pt_regs *regs,
err = -EINVAL; err = -EINVAL;
goto err_out; goto err_out;
} }
/* get the bndregs _area_ of the xsave structure */ /* get bndregs field from current task's xsave area */
bndregs = get_xsave_addr(xsave_buf, XSTATE_BNDREGS); bndregs = get_xsave_field_ptr(XSTATE_BNDREGS);
if (!bndregs) { if (!bndregs) {
err = -EINVAL; err = -EINVAL;
goto err_out; goto err_out;
@ -342,7 +342,7 @@ err_out:
static __user void *task_get_bounds_dir(struct task_struct *tsk) static __user void *task_get_bounds_dir(struct task_struct *tsk)
{ {
struct bndcsr *bndcsr; const struct bndcsr *bndcsr;
if (!cpu_feature_enabled(X86_FEATURE_MPX)) if (!cpu_feature_enabled(X86_FEATURE_MPX))
return MPX_INVALID_BOUNDS_DIR; return MPX_INVALID_BOUNDS_DIR;
@ -357,8 +357,7 @@ static __user void *task_get_bounds_dir(struct task_struct *tsk)
* The bounds directory pointer is stored in a register * The bounds directory pointer is stored in a register
* only accessible if we first do an xsave. * only accessible if we first do an xsave.
*/ */
copy_fpregs_to_fpstate(&tsk->thread.fpu); bndcsr = get_xsave_field_ptr(XSTATE_BNDCSR);
bndcsr = get_xsave_addr(&tsk->thread.fpu.state.xsave, XSTATE_BNDCSR);
if (!bndcsr) if (!bndcsr)
return MPX_INVALID_BOUNDS_DIR; return MPX_INVALID_BOUNDS_DIR;
@ -389,9 +388,10 @@ int mpx_enable_management(struct task_struct *tsk)
* directory into XSAVE/XRSTOR Save Area and enable MPX through * directory into XSAVE/XRSTOR Save Area and enable MPX through
* XRSTOR instruction. * XRSTOR instruction.
* *
* copy_xregs_to_kernel() is expected to be very expensive. Storing the bounds * The copy_xregs_to_kernel() beneath get_xsave_field_ptr() is
* directory here means that we do not have to do xsave in the unmap * expected to be relatively expensive. Storing the bounds
* path; we can just use mm->bd_addr instead. * directory here means that we do not have to do xsave in the
* unmap path; we can just use mm->bd_addr instead.
*/ */
bd_base = task_get_bounds_dir(tsk); bd_base = task_get_bounds_dir(tsk);
down_write(&mm->mmap_sem); down_write(&mm->mmap_sem);
@ -497,12 +497,12 @@ out_unmap:
* bound table is 16KB. With 64-bit mode, the size of BD is 2GB, * bound table is 16KB. With 64-bit mode, the size of BD is 2GB,
* and the size of each bound table is 4MB. * and the size of each bound table is 4MB.
*/ */
static int do_mpx_bt_fault(struct xregs_state *xsave_buf) static int do_mpx_bt_fault(struct task_struct *tsk)
{ {
unsigned long bd_entry, bd_base; unsigned long bd_entry, bd_base;
struct bndcsr *bndcsr; const struct bndcsr *bndcsr;
bndcsr = get_xsave_addr(xsave_buf, XSTATE_BNDCSR); bndcsr = get_xsave_field_ptr(XSTATE_BNDCSR);
if (!bndcsr) if (!bndcsr)
return -EINVAL; return -EINVAL;
/* /*
@ -525,7 +525,7 @@ static int do_mpx_bt_fault(struct xregs_state *xsave_buf)
return allocate_bt((long __user *)bd_entry); return allocate_bt((long __user *)bd_entry);
} }
int mpx_handle_bd_fault(struct xregs_state *xsave_buf) int mpx_handle_bd_fault(struct task_struct *tsk)
{ {
/* /*
* Userspace never asked us to manage the bounds tables, * Userspace never asked us to manage the bounds tables,
@ -534,7 +534,7 @@ int mpx_handle_bd_fault(struct xregs_state *xsave_buf)
if (!kernel_managing_mpx_tables(current->mm)) if (!kernel_managing_mpx_tables(current->mm))
return -EINVAL; return -EINVAL;
if (do_mpx_bt_fault(xsave_buf)) { if (do_mpx_bt_fault(tsk)) {
force_sig(SIGSEGV, current); force_sig(SIGSEGV, current);
/* /*
* The force_sig() is essentially "handling" this * The force_sig() is essentially "handling" this