x86/fpu: Sanitize xstateregs_set()
[linux-2.6-microblaze.git] / arch / x86 / kernel / fpu / regset.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * FPU register's regset abstraction, for ptrace, core dumps, etc.
4  */
5 #include <linux/sched/task_stack.h>
6 #include <linux/vmalloc.h>
7
8 #include <asm/fpu/internal.h>
9 #include <asm/fpu/signal.h>
10 #include <asm/fpu/regset.h>
11 #include <asm/fpu/xstate.h>
12
13 /*
14  * The xstateregs_active() routine is the same as the regset_fpregs_active() routine,
15  * as the "regset->n" for the xstate regset will be updated based on the feature
16  * capabilities supported by the xsave.
17  */
18 int regset_fpregs_active(struct task_struct *target, const struct user_regset *regset)
19 {
20         return regset->n;
21 }
22
23 int regset_xregset_fpregs_active(struct task_struct *target, const struct user_regset *regset)
24 {
25         if (boot_cpu_has(X86_FEATURE_FXSR))
26                 return regset->n;
27         else
28                 return 0;
29 }
30
31 int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
32                 struct membuf to)
33 {
34         struct fpu *fpu = &target->thread.fpu;
35
36         if (!boot_cpu_has(X86_FEATURE_FXSR))
37                 return -ENODEV;
38
39         fpu__prepare_read(fpu);
40         fpstate_sanitize_xstate(fpu);
41
42         return membuf_write(&to, &fpu->state.fxsave, sizeof(struct fxregs_state));
43 }
44
45 int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
46                 unsigned int pos, unsigned int count,
47                 const void *kbuf, const void __user *ubuf)
48 {
49         struct fpu *fpu = &target->thread.fpu;
50         int ret;
51
52         if (!boot_cpu_has(X86_FEATURE_FXSR))
53                 return -ENODEV;
54
55         fpu__prepare_write(fpu);
56         fpstate_sanitize_xstate(fpu);
57
58         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
59                                  &fpu->state.fxsave, 0, -1);
60
61         /*
62          * mxcsr reserved bits must be masked to zero for security reasons.
63          */
64         fpu->state.fxsave.mxcsr &= mxcsr_feature_mask;
65
66         /*
67          * update the header bits in the xsave header, indicating the
68          * presence of FP and SSE state.
69          */
70         if (boot_cpu_has(X86_FEATURE_XSAVE))
71                 fpu->state.xsave.header.xfeatures |= XFEATURE_MASK_FPSSE;
72
73         return ret;
74 }
75
76 int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
77                 struct membuf to)
78 {
79         struct fpu *fpu = &target->thread.fpu;
80         struct xregs_state *xsave;
81
82         if (!boot_cpu_has(X86_FEATURE_XSAVE))
83                 return -ENODEV;
84
85         xsave = &fpu->state.xsave;
86
87         fpu__prepare_read(fpu);
88
89         if (using_compacted_format()) {
90                 copy_xstate_to_kernel(to, xsave);
91                 return 0;
92         } else {
93                 fpstate_sanitize_xstate(fpu);
94                 /*
95                  * Copy the 48 bytes defined by the software into the xsave
96                  * area in the thread struct, so that we can copy the whole
97                  * area to user using one user_regset_copyout().
98                  */
99                 memcpy(&xsave->i387.sw_reserved, xstate_fx_sw_bytes, sizeof(xstate_fx_sw_bytes));
100
101                 /*
102                  * Copy the xstate memory layout.
103                  */
104                 return membuf_write(&to, xsave, fpu_user_xstate_size);
105         }
106 }
107
108 int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
109                   unsigned int pos, unsigned int count,
110                   const void *kbuf, const void __user *ubuf)
111 {
112         struct fpu *fpu = &target->thread.fpu;
113         struct xregs_state *tmpbuf = NULL;
114         int ret;
115
116         if (!cpu_feature_enabled(X86_FEATURE_XSAVE))
117                 return -ENODEV;
118
119         /*
120          * A whole standard-format XSAVE buffer is needed:
121          */
122         if (pos != 0 || count != fpu_user_xstate_size)
123                 return -EFAULT;
124
125         if (!kbuf) {
126                 tmpbuf = vmalloc(count);
127                 if (!tmpbuf)
128                         return -ENOMEM;
129
130                 if (copy_from_user(tmpbuf, ubuf, count)) {
131                         ret = -EFAULT;
132                         goto out;
133                 }
134         }
135
136         fpu__prepare_write(fpu);
137         ret = copy_kernel_to_xstate(&fpu->state.xsave, kbuf ?: tmpbuf);
138
139 out:
140         vfree(tmpbuf);
141         return ret;
142 }
143
144 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
145
146 /*
147  * FPU tag word conversions.
148  */
149
150 static inline unsigned short twd_i387_to_fxsr(unsigned short twd)
151 {
152         unsigned int tmp; /* to avoid 16 bit prefixes in the code */
153
154         /* Transform each pair of bits into 01 (valid) or 00 (empty) */
155         tmp = ~twd;
156         tmp = (tmp | (tmp>>1)) & 0x5555; /* 0V0V0V0V0V0V0V0V */
157         /* and move the valid bits to the lower byte. */
158         tmp = (tmp | (tmp >> 1)) & 0x3333; /* 00VV00VV00VV00VV */
159         tmp = (tmp | (tmp >> 2)) & 0x0f0f; /* 0000VVVV0000VVVV */
160         tmp = (tmp | (tmp >> 4)) & 0x00ff; /* 00000000VVVVVVVV */
161
162         return tmp;
163 }
164
165 #define FPREG_ADDR(f, n)        ((void *)&(f)->st_space + (n) * 16)
166 #define FP_EXP_TAG_VALID        0
167 #define FP_EXP_TAG_ZERO         1
168 #define FP_EXP_TAG_SPECIAL      2
169 #define FP_EXP_TAG_EMPTY        3
170
171 static inline u32 twd_fxsr_to_i387(struct fxregs_state *fxsave)
172 {
173         struct _fpxreg *st;
174         u32 tos = (fxsave->swd >> 11) & 7;
175         u32 twd = (unsigned long) fxsave->twd;
176         u32 tag;
177         u32 ret = 0xffff0000u;
178         int i;
179
180         for (i = 0; i < 8; i++, twd >>= 1) {
181                 if (twd & 0x1) {
182                         st = FPREG_ADDR(fxsave, (i - tos) & 7);
183
184                         switch (st->exponent & 0x7fff) {
185                         case 0x7fff:
186                                 tag = FP_EXP_TAG_SPECIAL;
187                                 break;
188                         case 0x0000:
189                                 if (!st->significand[0] &&
190                                     !st->significand[1] &&
191                                     !st->significand[2] &&
192                                     !st->significand[3])
193                                         tag = FP_EXP_TAG_ZERO;
194                                 else
195                                         tag = FP_EXP_TAG_SPECIAL;
196                                 break;
197                         default:
198                                 if (st->significand[3] & 0x8000)
199                                         tag = FP_EXP_TAG_VALID;
200                                 else
201                                         tag = FP_EXP_TAG_SPECIAL;
202                                 break;
203                         }
204                 } else {
205                         tag = FP_EXP_TAG_EMPTY;
206                 }
207                 ret |= tag << (2 * i);
208         }
209         return ret;
210 }
211
212 /*
213  * FXSR floating point environment conversions.
214  */
215
216 void
217 convert_from_fxsr(struct user_i387_ia32_struct *env, struct task_struct *tsk)
218 {
219         struct fxregs_state *fxsave = &tsk->thread.fpu.state.fxsave;
220         struct _fpreg *to = (struct _fpreg *) &env->st_space[0];
221         struct _fpxreg *from = (struct _fpxreg *) &fxsave->st_space[0];
222         int i;
223
224         env->cwd = fxsave->cwd | 0xffff0000u;
225         env->swd = fxsave->swd | 0xffff0000u;
226         env->twd = twd_fxsr_to_i387(fxsave);
227
228 #ifdef CONFIG_X86_64
229         env->fip = fxsave->rip;
230         env->foo = fxsave->rdp;
231         /*
232          * should be actually ds/cs at fpu exception time, but
233          * that information is not available in 64bit mode.
234          */
235         env->fcs = task_pt_regs(tsk)->cs;
236         if (tsk == current) {
237                 savesegment(ds, env->fos);
238         } else {
239                 env->fos = tsk->thread.ds;
240         }
241         env->fos |= 0xffff0000;
242 #else
243         env->fip = fxsave->fip;
244         env->fcs = (u16) fxsave->fcs | ((u32) fxsave->fop << 16);
245         env->foo = fxsave->foo;
246         env->fos = fxsave->fos;
247 #endif
248
249         for (i = 0; i < 8; ++i)
250                 memcpy(&to[i], &from[i], sizeof(to[0]));
251 }
252
253 void convert_to_fxsr(struct fxregs_state *fxsave,
254                      const struct user_i387_ia32_struct *env)
255
256 {
257         struct _fpreg *from = (struct _fpreg *) &env->st_space[0];
258         struct _fpxreg *to = (struct _fpxreg *) &fxsave->st_space[0];
259         int i;
260
261         fxsave->cwd = env->cwd;
262         fxsave->swd = env->swd;
263         fxsave->twd = twd_i387_to_fxsr(env->twd);
264         fxsave->fop = (u16) ((u32) env->fcs >> 16);
265 #ifdef CONFIG_X86_64
266         fxsave->rip = env->fip;
267         fxsave->rdp = env->foo;
268         /* cs and ds ignored */
269 #else
270         fxsave->fip = env->fip;
271         fxsave->fcs = (env->fcs & 0xffff);
272         fxsave->foo = env->foo;
273         fxsave->fos = env->fos;
274 #endif
275
276         for (i = 0; i < 8; ++i)
277                 memcpy(&to[i], &from[i], sizeof(from[0]));
278 }
279
280 int fpregs_get(struct task_struct *target, const struct user_regset *regset,
281                struct membuf to)
282 {
283         struct fpu *fpu = &target->thread.fpu;
284         struct user_i387_ia32_struct env;
285
286         fpu__prepare_read(fpu);
287
288         if (!boot_cpu_has(X86_FEATURE_FPU))
289                 return fpregs_soft_get(target, regset, to);
290
291         if (!boot_cpu_has(X86_FEATURE_FXSR)) {
292                 return membuf_write(&to, &fpu->state.fsave,
293                                     sizeof(struct fregs_state));
294         }
295
296         fpstate_sanitize_xstate(fpu);
297
298         if (to.left == sizeof(env)) {
299                 convert_from_fxsr(to.p, target);
300                 return 0;
301         }
302
303         convert_from_fxsr(&env, target);
304         return membuf_write(&to, &env, sizeof(env));
305 }
306
307 int fpregs_set(struct task_struct *target, const struct user_regset *regset,
308                unsigned int pos, unsigned int count,
309                const void *kbuf, const void __user *ubuf)
310 {
311         struct fpu *fpu = &target->thread.fpu;
312         struct user_i387_ia32_struct env;
313         int ret;
314
315         fpu__prepare_write(fpu);
316         fpstate_sanitize_xstate(fpu);
317
318         if (!boot_cpu_has(X86_FEATURE_FPU))
319                 return fpregs_soft_set(target, regset, pos, count, kbuf, ubuf);
320
321         if (!boot_cpu_has(X86_FEATURE_FXSR))
322                 return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
323                                           &fpu->state.fsave, 0,
324                                           -1);
325
326         if (pos > 0 || count < sizeof(env))
327                 convert_from_fxsr(&env, target);
328
329         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &env, 0, -1);
330         if (!ret)
331                 convert_to_fxsr(&target->thread.fpu.state.fxsave, &env);
332
333         /*
334          * update the header bit in the xsave header, indicating the
335          * presence of FP.
336          */
337         if (boot_cpu_has(X86_FEATURE_XSAVE))
338                 fpu->state.xsave.header.xfeatures |= XFEATURE_MASK_FP;
339         return ret;
340 }
341
342 #endif  /* CONFIG_X86_32 || CONFIG_IA32_EMULATION */