![Hans Rosenfeld](/assets/img/avatar_default.png)
On 32bit systems without SSE (that is, they use FSAVE/FRSTOR for FPU
context switches), FPU exceptions in user mode cause Oopses, BUGs,
recursive faults and other nasty things:
fpu exception: 0000 [#1]
last sysfs file: /sys/power/state
Modules linked in: psmouse evdev pcspkr serio_raw [last unloaded: scsi_wait_scan]
Pid: 1638, comm: fxsave-32-excep Not tainted 2.6.35-07798-g58a992b-dirty #633 VP3-596B-DD/VT82C597
EIP: 0060:[<c1003527>] EFLAGS: 00010202 CPU: 0
EIP is at math_error+0x1b4/0x1c8
EAX: 00000003 EBX: cf9be7e0 ECX: 00000000 EDX: cf9c5c00
ESI: cf9d9fb4 EDI: c1372db3 EBP: 00000010 ESP: cf9d9f1c
DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
Process fxsave-32-excep (pid: 1638, ti=cf9d8000 task=cf9be7e0 task.ti=cf9d8000)
Stack:
00000000 00000301 00000004 00000000 00000000 cf9d3000 cf9da8f0 00000001
<0> 00000004 cf9b6b60 c1019a6b c1019a79 00000020 00000242 000001b6 cf9c5380
<0> cf806b40 cf791880 00000000 00000282 00000282 c108a213 00000020 cf9c5380
Call Trace:
[<c1019a6b>] ? need_resched+0x11/0x1a
[<c1019a79>] ? should_resched+0x5/0x1f
[<c108a213>] ? do_sys_open+0xbd/0xc7
[<c108a213>] ? do_sys_open+0xbd/0xc7
[<c100353b>] ? do_coprocessor_error+0x0/0x11
[<c12d5965>] ? error_code+0x65/0x70
Code: a8 20 74 30 c7 44 24 0c 06 00 03 00 8d 54 24 04 89 d9 b8 08 00 00 00 e8 9b 6d 02 00 eb 16 8b 93 5c 02 00 00 eb 05 e9 04 ff ff ff <9b> dd 32 9b e9 16 ff ff ff 81 c4 84 00 00 00 5b 5e 5f 5d c3 c6
EIP: [<c1003527>] math_error+0x1b4/0x1c8 SS:ESP 0068:cf9d9f1c
This usually continues in slight variations until the system is reset.
This bug was introduced by commit 58a992b9cb
:
x86-32, fpu: Rewrite fpu_save_init()
Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
Link: http://lkml.kernel.org/r/1302106003-366952-1-git-send-email-hans.rosenfeld@amd.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
454 lines
11 KiB
C
454 lines
11 KiB
C
/*
|
|
* Copyright (C) 1994 Linus Torvalds
|
|
*
|
|
* Pentium III FXSR, SSE support
|
|
* General FPU state handling cleanups
|
|
* Gareth Hughes <gareth@valinux.com>, May 2000
|
|
* x86-64 work by Andi Kleen 2002
|
|
*/
|
|
|
|
#ifndef _ASM_X86_I387_H
|
|
#define _ASM_X86_I387_H
|
|
|
|
#ifndef __ASSEMBLY__
|
|
|
|
#include <linux/sched.h>
|
|
#include <linux/kernel_stat.h>
|
|
#include <linux/regset.h>
|
|
#include <linux/hardirq.h>
|
|
#include <linux/slab.h>
|
|
#include <asm/asm.h>
|
|
#include <asm/cpufeature.h>
|
|
#include <asm/processor.h>
|
|
#include <asm/sigcontext.h>
|
|
#include <asm/user.h>
|
|
#include <asm/uaccess.h>
|
|
#include <asm/xsave.h>
|
|
|
|
extern unsigned int sig_xstate_size;
|
|
extern void fpu_init(void);
|
|
extern void mxcsr_feature_mask_init(void);
|
|
extern int init_fpu(struct task_struct *child);
|
|
extern asmlinkage void math_state_restore(void);
|
|
extern void __math_state_restore(void);
|
|
extern int dump_fpu(struct pt_regs *, struct user_i387_struct *);
|
|
|
|
extern user_regset_active_fn fpregs_active, xfpregs_active;
|
|
extern user_regset_get_fn fpregs_get, xfpregs_get, fpregs_soft_get,
|
|
xstateregs_get;
|
|
extern user_regset_set_fn fpregs_set, xfpregs_set, fpregs_soft_set,
|
|
xstateregs_set;
|
|
|
|
/*
|
|
* xstateregs_active == fpregs_active. Please refer to the comment
|
|
* at the definition of fpregs_active.
|
|
*/
|
|
#define xstateregs_active fpregs_active
|
|
|
|
extern struct _fpx_sw_bytes fx_sw_reserved;
|
|
#ifdef CONFIG_IA32_EMULATION
|
|
extern unsigned int sig_xstate_ia32_size;
|
|
extern struct _fpx_sw_bytes fx_sw_reserved_ia32;
|
|
struct _fpstate_ia32;
|
|
struct _xstate_ia32;
|
|
extern int save_i387_xstate_ia32(void __user *buf);
|
|
extern int restore_i387_xstate_ia32(void __user *buf);
|
|
#endif
|
|
|
|
#ifdef CONFIG_MATH_EMULATION
|
|
extern void finit_soft_fpu(struct i387_soft_struct *soft);
|
|
#else
|
|
static inline void finit_soft_fpu(struct i387_soft_struct *soft) {}
|
|
#endif
|
|
|
|
#define X87_FSW_ES (1 << 7) /* Exception Summary */
|
|
|
|
static __always_inline __pure bool use_xsaveopt(void)
|
|
{
|
|
return static_cpu_has(X86_FEATURE_XSAVEOPT);
|
|
}
|
|
|
|
static __always_inline __pure bool use_xsave(void)
|
|
{
|
|
return static_cpu_has(X86_FEATURE_XSAVE);
|
|
}
|
|
|
|
static __always_inline __pure bool use_fxsr(void)
|
|
{
|
|
return static_cpu_has(X86_FEATURE_FXSR);
|
|
}
|
|
|
|
extern void __sanitize_i387_state(struct task_struct *);
|
|
|
|
static inline void sanitize_i387_state(struct task_struct *tsk)
|
|
{
|
|
if (!use_xsaveopt())
|
|
return;
|
|
__sanitize_i387_state(tsk);
|
|
}
|
|
|
|
#ifdef CONFIG_X86_64
|
|
static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
|
|
{
|
|
int err;
|
|
|
|
/* See comment in fxsave() below. */
|
|
#ifdef CONFIG_AS_FXSAVEQ
|
|
asm volatile("1: fxrstorq %[fx]\n\t"
|
|
"2:\n"
|
|
".section .fixup,\"ax\"\n"
|
|
"3: movl $-1,%[err]\n"
|
|
" jmp 2b\n"
|
|
".previous\n"
|
|
_ASM_EXTABLE(1b, 3b)
|
|
: [err] "=r" (err)
|
|
: [fx] "m" (*fx), "0" (0));
|
|
#else
|
|
asm volatile("1: rex64/fxrstor (%[fx])\n\t"
|
|
"2:\n"
|
|
".section .fixup,\"ax\"\n"
|
|
"3: movl $-1,%[err]\n"
|
|
" jmp 2b\n"
|
|
".previous\n"
|
|
_ASM_EXTABLE(1b, 3b)
|
|
: [err] "=r" (err)
|
|
: [fx] "R" (fx), "m" (*fx), "0" (0));
|
|
#endif
|
|
return err;
|
|
}
|
|
|
|
static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
|
|
{
|
|
int err;
|
|
|
|
/*
|
|
* Clear the bytes not touched by the fxsave and reserved
|
|
* for the SW usage.
|
|
*/
|
|
err = __clear_user(&fx->sw_reserved,
|
|
sizeof(struct _fpx_sw_bytes));
|
|
if (unlikely(err))
|
|
return -EFAULT;
|
|
|
|
/* See comment in fxsave() below. */
|
|
#ifdef CONFIG_AS_FXSAVEQ
|
|
asm volatile("1: fxsaveq %[fx]\n\t"
|
|
"2:\n"
|
|
".section .fixup,\"ax\"\n"
|
|
"3: movl $-1,%[err]\n"
|
|
" jmp 2b\n"
|
|
".previous\n"
|
|
_ASM_EXTABLE(1b, 3b)
|
|
: [err] "=r" (err), [fx] "=m" (*fx)
|
|
: "0" (0));
|
|
#else
|
|
asm volatile("1: rex64/fxsave (%[fx])\n\t"
|
|
"2:\n"
|
|
".section .fixup,\"ax\"\n"
|
|
"3: movl $-1,%[err]\n"
|
|
" jmp 2b\n"
|
|
".previous\n"
|
|
_ASM_EXTABLE(1b, 3b)
|
|
: [err] "=r" (err), "=m" (*fx)
|
|
: [fx] "R" (fx), "0" (0));
|
|
#endif
|
|
if (unlikely(err) &&
|
|
__clear_user(fx, sizeof(struct i387_fxsave_struct)))
|
|
err = -EFAULT;
|
|
/* No need to clear here because the caller clears USED_MATH */
|
|
return err;
|
|
}
|
|
|
|
static inline void fpu_fxsave(struct fpu *fpu)
|
|
{
|
|
/* Using "rex64; fxsave %0" is broken because, if the memory operand
|
|
uses any extended registers for addressing, a second REX prefix
|
|
will be generated (to the assembler, rex64 followed by semicolon
|
|
is a separate instruction), and hence the 64-bitness is lost. */
|
|
|
|
#ifdef CONFIG_AS_FXSAVEQ
|
|
/* Using "fxsaveq %0" would be the ideal choice, but is only supported
|
|
starting with gas 2.16. */
|
|
__asm__ __volatile__("fxsaveq %0"
|
|
: "=m" (fpu->state->fxsave));
|
|
#else
|
|
/* Using, as a workaround, the properly prefixed form below isn't
|
|
accepted by any binutils version so far released, complaining that
|
|
the same type of prefix is used twice if an extended register is
|
|
needed for addressing (fix submitted to mainline 2005-11-21).
|
|
asm volatile("rex64/fxsave %0"
|
|
: "=m" (fpu->state->fxsave));
|
|
This, however, we can work around by forcing the compiler to select
|
|
an addressing mode that doesn't require extended registers. */
|
|
asm volatile("rex64/fxsave (%[fx])"
|
|
: "=m" (fpu->state->fxsave)
|
|
: [fx] "R" (&fpu->state->fxsave));
|
|
#endif
|
|
}
|
|
|
|
#else /* CONFIG_X86_32 */
|
|
|
|
/* perform fxrstor iff the processor has extended states, otherwise frstor */
|
|
static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
|
|
{
|
|
/*
|
|
* The "nop" is needed to make the instructions the same
|
|
* length.
|
|
*/
|
|
alternative_input(
|
|
"nop ; frstor %1",
|
|
"fxrstor %1",
|
|
X86_FEATURE_FXSR,
|
|
"m" (*fx));
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline void fpu_fxsave(struct fpu *fpu)
|
|
{
|
|
asm volatile("fxsave %[fx]"
|
|
: [fx] "=m" (fpu->state->fxsave));
|
|
}
|
|
|
|
#endif /* CONFIG_X86_64 */
|
|
|
|
/* We need a safe address that is cheap to find and that is already
|
|
in L1 during context switch. The best choices are unfortunately
|
|
different for UP and SMP */
|
|
#ifdef CONFIG_SMP
|
|
#define safe_address (__per_cpu_offset[0])
|
|
#else
|
|
#define safe_address (kstat_cpu(0).cpustat.user)
|
|
#endif
|
|
|
|
/*
|
|
* These must be called with preempt disabled
|
|
*/
|
|
static inline void fpu_save_init(struct fpu *fpu)
|
|
{
|
|
if (use_xsave()) {
|
|
fpu_xsave(fpu);
|
|
|
|
/*
|
|
* xsave header may indicate the init state of the FP.
|
|
*/
|
|
if (!(fpu->state->xsave.xsave_hdr.xstate_bv & XSTATE_FP))
|
|
return;
|
|
} else if (use_fxsr()) {
|
|
fpu_fxsave(fpu);
|
|
} else {
|
|
asm volatile("fnsave %[fx]; fwait"
|
|
: [fx] "=m" (fpu->state->fsave));
|
|
return;
|
|
}
|
|
|
|
if (unlikely(fpu->state->fxsave.swd & X87_FSW_ES))
|
|
asm volatile("fnclex");
|
|
|
|
/* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
|
|
is pending. Clear the x87 state here by setting it to fixed
|
|
values. safe_address is a random variable that should be in L1 */
|
|
alternative_input(
|
|
ASM_NOP8 ASM_NOP2,
|
|
"emms\n\t" /* clear stack tags */
|
|
"fildl %P[addr]", /* set F?P to defined value */
|
|
X86_FEATURE_FXSAVE_LEAK,
|
|
[addr] "m" (safe_address));
|
|
}
|
|
|
|
static inline void __save_init_fpu(struct task_struct *tsk)
|
|
{
|
|
fpu_save_init(&tsk->thread.fpu);
|
|
task_thread_info(tsk)->status &= ~TS_USEDFPU;
|
|
}
|
|
|
|
static inline int fpu_fxrstor_checking(struct fpu *fpu)
|
|
{
|
|
return fxrstor_checking(&fpu->state->fxsave);
|
|
}
|
|
|
|
static inline int fpu_restore_checking(struct fpu *fpu)
|
|
{
|
|
if (use_xsave())
|
|
return fpu_xrstor_checking(fpu);
|
|
else
|
|
return fpu_fxrstor_checking(fpu);
|
|
}
|
|
|
|
static inline int restore_fpu_checking(struct task_struct *tsk)
|
|
{
|
|
return fpu_restore_checking(&tsk->thread.fpu);
|
|
}
|
|
|
|
/*
|
|
* Signal frame handlers...
|
|
*/
|
|
extern int save_i387_xstate(void __user *buf);
|
|
extern int restore_i387_xstate(void __user *buf);
|
|
|
|
static inline void __unlazy_fpu(struct task_struct *tsk)
|
|
{
|
|
if (task_thread_info(tsk)->status & TS_USEDFPU) {
|
|
__save_init_fpu(tsk);
|
|
stts();
|
|
} else
|
|
tsk->fpu_counter = 0;
|
|
}
|
|
|
|
static inline void __clear_fpu(struct task_struct *tsk)
|
|
{
|
|
if (task_thread_info(tsk)->status & TS_USEDFPU) {
|
|
/* Ignore delayed exceptions from user space */
|
|
asm volatile("1: fwait\n"
|
|
"2:\n"
|
|
_ASM_EXTABLE(1b, 2b));
|
|
task_thread_info(tsk)->status &= ~TS_USEDFPU;
|
|
stts();
|
|
}
|
|
}
|
|
|
|
static inline void kernel_fpu_begin(void)
|
|
{
|
|
struct thread_info *me = current_thread_info();
|
|
preempt_disable();
|
|
if (me->status & TS_USEDFPU)
|
|
__save_init_fpu(me->task);
|
|
else
|
|
clts();
|
|
}
|
|
|
|
static inline void kernel_fpu_end(void)
|
|
{
|
|
stts();
|
|
preempt_enable();
|
|
}
|
|
|
|
static inline bool irq_fpu_usable(void)
|
|
{
|
|
struct pt_regs *regs;
|
|
|
|
return !in_interrupt() || !(regs = get_irq_regs()) || \
|
|
user_mode(regs) || (read_cr0() & X86_CR0_TS);
|
|
}
|
|
|
|
/*
|
|
* Some instructions like VIA's padlock instructions generate a spurious
|
|
* DNA fault but don't modify SSE registers. And these instructions
|
|
* get used from interrupt context as well. To prevent these kernel instructions
|
|
* in interrupt context interacting wrongly with other user/kernel fpu usage, we
|
|
* should use them only in the context of irq_ts_save/restore()
|
|
*/
|
|
static inline int irq_ts_save(void)
|
|
{
|
|
/*
|
|
* If in process context and not atomic, we can take a spurious DNA fault.
|
|
* Otherwise, doing clts() in process context requires disabling preemption
|
|
* or some heavy lifting like kernel_fpu_begin()
|
|
*/
|
|
if (!in_atomic())
|
|
return 0;
|
|
|
|
if (read_cr0() & X86_CR0_TS) {
|
|
clts();
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline void irq_ts_restore(int TS_state)
|
|
{
|
|
if (TS_state)
|
|
stts();
|
|
}
|
|
|
|
/*
|
|
* These disable preemption on their own and are safe
|
|
*/
|
|
static inline void save_init_fpu(struct task_struct *tsk)
|
|
{
|
|
preempt_disable();
|
|
__save_init_fpu(tsk);
|
|
stts();
|
|
preempt_enable();
|
|
}
|
|
|
|
static inline void unlazy_fpu(struct task_struct *tsk)
|
|
{
|
|
preempt_disable();
|
|
__unlazy_fpu(tsk);
|
|
preempt_enable();
|
|
}
|
|
|
|
static inline void clear_fpu(struct task_struct *tsk)
|
|
{
|
|
preempt_disable();
|
|
__clear_fpu(tsk);
|
|
preempt_enable();
|
|
}
|
|
|
|
/*
|
|
* i387 state interaction
|
|
*/
|
|
static inline unsigned short get_fpu_cwd(struct task_struct *tsk)
|
|
{
|
|
if (cpu_has_fxsr) {
|
|
return tsk->thread.fpu.state->fxsave.cwd;
|
|
} else {
|
|
return (unsigned short)tsk->thread.fpu.state->fsave.cwd;
|
|
}
|
|
}
|
|
|
|
static inline unsigned short get_fpu_swd(struct task_struct *tsk)
|
|
{
|
|
if (cpu_has_fxsr) {
|
|
return tsk->thread.fpu.state->fxsave.swd;
|
|
} else {
|
|
return (unsigned short)tsk->thread.fpu.state->fsave.swd;
|
|
}
|
|
}
|
|
|
|
static inline unsigned short get_fpu_mxcsr(struct task_struct *tsk)
|
|
{
|
|
if (cpu_has_xmm) {
|
|
return tsk->thread.fpu.state->fxsave.mxcsr;
|
|
} else {
|
|
return MXCSR_DEFAULT;
|
|
}
|
|
}
|
|
|
|
static bool fpu_allocated(struct fpu *fpu)
|
|
{
|
|
return fpu->state != NULL;
|
|
}
|
|
|
|
static inline int fpu_alloc(struct fpu *fpu)
|
|
{
|
|
if (fpu_allocated(fpu))
|
|
return 0;
|
|
fpu->state = kmem_cache_alloc(task_xstate_cachep, GFP_KERNEL);
|
|
if (!fpu->state)
|
|
return -ENOMEM;
|
|
WARN_ON((unsigned long)fpu->state & 15);
|
|
return 0;
|
|
}
|
|
|
|
static inline void fpu_free(struct fpu *fpu)
|
|
{
|
|
if (fpu->state) {
|
|
kmem_cache_free(task_xstate_cachep, fpu->state);
|
|
fpu->state = NULL;
|
|
}
|
|
}
|
|
|
|
static inline void fpu_copy(struct fpu *dst, struct fpu *src)
|
|
{
|
|
memcpy(dst->state, src->state, xstate_size);
|
|
}
|
|
|
|
extern void fpu_finit(struct fpu *fpu);
|
|
|
|
#endif /* __ASSEMBLY__ */
|
|
|
|
#endif /* _ASM_X86_I387_H */
|