From nobody Sat Apr 11 22:47:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA25AC19F29 for ; Thu, 4 Aug 2022 03:16:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238837AbiHDDQt (ORCPT ); Wed, 3 Aug 2022 23:16:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238573AbiHDDQj (ORCPT ); Wed, 3 Aug 2022 23:16:39 -0400 Received: from mail-pl1-x630.google.com (mail-pl1-x630.google.com [IPv6:2607:f8b0:4864:20::630]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1874F5F98D for ; Wed, 3 Aug 2022 20:16:36 -0700 (PDT) Received: by mail-pl1-x630.google.com with SMTP id x23so9519978pll.7 for ; Wed, 03 Aug 2022 20:16:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kylehuey.com; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc; bh=0Eidlkaci04rHoeZFe7JPn0wdB0zBqovVdfDYpCgudw=; b=ROdIXNMccLVEnJtpOwGav/0wNNCzgREpIq+MQUlTjRT0tCJoPfGpubTVJ1LHnaruTr OZgYaRXIvMlhGs9skVZFDZSRfFYzEmoebwyR/gMMEFyXwbePhNKufjN8A4OeUu84uCTb Rq2vUq5JtHLNTDNdXnrQB2OCoBOtSNAQO5x19A2bdHN2mXnFvq2hDNFNsld68uWMWABH cOHPcV2qz/8PDhGBcCS3lLI+AfKgqdEqVktdUVNMtwoIx4DnPv5JD5MnPSrLsGaVZ8vB iIVQwUEHnmvhA7LzASwb0dPEwg5Fu5BWMXKk5kfGoz/9CG0Xi9mKPYXZsskrLun9Y//k j3Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc; bh=0Eidlkaci04rHoeZFe7JPn0wdB0zBqovVdfDYpCgudw=; b=nZBEd5WEhapMqbYzChuxVg0ScsbACO/ZfzU0a/t5iVid6sk4YtBCCmdbqnF5fRDhkr 2+T3LOXYpvkX46QuMZ6BZbcnJXlvOyPYIo2I8nxxStvO5BTrMLP0ljfu+UX9k+nKyyTk 19l4WPQ6JqNARV7IEoJEdhAZTnOYGonDfh+xpD5YprueSW9s/kKpl1NprCb1GswGJVu9 I+x1TMUANPXk5MLyX7yEyL+wyiDiXaMdmXp8zNrowyg5B7PIta8ydQtcfpZTNpAtHtnV xlT5LldMOzqy5l+IwacHQnZ17uB8Uyp9ckZth7mJiykjMrNe0AQ9CJy93+GgfdVSTwTB f1NA== X-Gm-Message-State: ACgBeo1aFwgXTh/IhTVagevOIM05z9xTf7nDlYn4FciixGpSq9Ma21Fl Yj9lf2DZSP9NGh7294NfpHPYcA== X-Google-Smtp-Source: AA6agR7Ks9ZG70ZGVbxOdEryKUq3Xnv+8QfCWcNgh9DQpzlr4m1G4zvNLtyqeMU7Pdi4Gcva1NGZrg== X-Received: by 2002:a17:90a:e7c7:b0:1f2:bea3:37df with SMTP id kb7-20020a17090ae7c700b001f2bea337dfmr8330056pjb.133.1659582995107; Wed, 03 Aug 2022 20:16:35 -0700 (PDT) Received: from minbar.home.kylehuey.com (c-71-198-251-229.hsd1.ca.comcast.net. [71.198.251.229]) by smtp.gmail.com with ESMTPSA id q6-20020a17090a68c600b001f2e20edd14sm2334699pjj.45.2022.08.03.20.16.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 Aug 2022 20:16:34 -0700 (PDT) From: Kyle Huey X-Google-Original-From: Kyle Huey To: Dave Hansen , Thomas Gleixner , Borislav Petkov Cc: Ingo Molnar , x86@kernel.org, "H. Peter Anvin" , Paolo Bonzini , Andy Lutomirski , Peter Zijlstra , linux-kernel@vger.kernel.org, Robert O'Callahan , David Manouchehri , Kyle Huey , Borislav Petkov , kvm@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2] x86/fpu: Allow PKRU to be (once again) written by ptrace. Date: Wed, 3 Aug 2022 20:16:32 -0700 Message-Id: <20220804031632.52921-1-khuey@kylehuey.com> X-Mailer: git-send-email 2.37.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kyle Huey When management of the PKRU register was moved away from XSTATE, emulation of PKRU's existence in XSTATE was added for APIs that read XSTATE, but not for APIs that write XSTATE. This can be seen by running gdb and executing `p $pkru`, `set $pkru =3D 42`, and `p $pkru`. On affected kernels (5.14+) t= he write to the PKRU register (which gdb performs through ptrace) is ignored. There are three relevant APIs: PTRACE_SETREGSET with NT_X86_XSTATE, sigreturn, and KVM_SET_XSAVE. KVM_SET_XSAVE has its own special handling to make PKRU writes take effect (in fpu_copy_uabi_to_guest_fpstate). Push that down into copy_uabi_to_xstate and have PTRACE_SETREGSET with NT_X86_XSTATE and sigreturn pass in pointers to the appropriate PKRU value. This also adds code to initialize the PKRU value to the hardware init value (namely 0) if the PKRU bit is not set in the XSTATE header to match XRSTOR. This is a change to the current KVM_SET_XSAVE behavior. Changelog since v1: - Handles the error case of copy_to_buffer(). Signed-off-by: Kyle Huey Cc: Dave Hansen Cc: Thomas Gleixner Cc: Borislav Petkov Cc: kvm@vger.kernel.org # For edge case behavior of KVM_SET_XSAVE Cc: stable@vger.kernel.org # 5.14+ Fixes: e84ba47e313d ("x86/fpu: Hook up PKRU into ptrace()") --- arch/x86/kernel/fpu/core.c | 11 +---------- arch/x86/kernel/fpu/regset.c | 2 +- arch/x86/kernel/fpu/signal.c | 2 +- arch/x86/kernel/fpu/xstate.c | 28 +++++++++++++++++++++++----- arch/x86/kernel/fpu/xstate.h | 4 ++-- 5 files changed, 28 insertions(+), 19 deletions(-) diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c index 0531d6a06df5..dfb79e2ee81f 100644 --- a/arch/x86/kernel/fpu/core.c +++ b/arch/x86/kernel/fpu/core.c @@ -406,16 +406,7 @@ int fpu_copy_uabi_to_guest_fpstate(struct fpu_guest *g= fpu, const void *buf, if (ustate->xsave.header.xfeatures & ~xcr0) return -EINVAL; =20 - ret =3D copy_uabi_from_kernel_to_xstate(kstate, ustate); - if (ret) - return ret; - - /* Retrieve PKRU if not in init state */ - if (kstate->regs.xsave.header.xfeatures & XFEATURE_MASK_PKRU) { - xpkru =3D get_xsave_addr(&kstate->regs.xsave, XFEATURE_PKRU); - *vpkru =3D xpkru->pkru; - } - return 0; + return copy_uabi_from_kernel_to_xstate(kstate, ustate, vpkru); } EXPORT_SYMBOL_GPL(fpu_copy_uabi_to_guest_fpstate); #endif /* CONFIG_KVM */ diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c index 75ffaef8c299..6d056b68f4ed 100644 --- a/arch/x86/kernel/fpu/regset.c +++ b/arch/x86/kernel/fpu/regset.c @@ -167,7 +167,7 @@ int xstateregs_set(struct task_struct *target, const st= ruct user_regset *regset, } =20 fpu_force_restore(fpu); - ret =3D copy_uabi_from_kernel_to_xstate(fpu->fpstate, kbuf ?: tmpbuf); + ret =3D copy_uabi_from_kernel_to_xstate(fpu->fpstate, kbuf ?: tmpbuf, &ta= rget->thread.pkru); =20 out: vfree(tmpbuf); diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index 91d4b6de58ab..558076dbde5b 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -396,7 +396,7 @@ static bool __fpu_restore_sig(void __user *buf, void __= user *buf_fx, =20 fpregs =3D &fpu->fpstate->regs; if (use_xsave() && !fx_only) { - if (copy_sigframe_from_user_to_xstate(fpu->fpstate, buf_fx)) + if (copy_sigframe_from_user_to_xstate(tsk, buf_fx)) return false; } else { if (__copy_from_user(&fpregs->fxsave, buf_fx, diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index c8340156bfd2..e01d3514ae68 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -1197,7 +1197,7 @@ static int copy_from_buffer(void *dst, unsigned int o= ffset, unsigned int size, =20 =20 static int copy_uabi_to_xstate(struct fpstate *fpstate, const void *kbuf, - const void __user *ubuf) + const void __user *ubuf, u32 *pkru) { struct xregs_state *xsave =3D &fpstate->regs.xsave; unsigned int offset, size; @@ -1235,6 +1235,24 @@ static int copy_uabi_to_xstate(struct fpstate *fpsta= te, const void *kbuf, for (i =3D 0; i < XFEATURE_MAX; i++) { mask =3D BIT_ULL(i); =20 + if (i =3D=3D XFEATURE_PKRU) { + /* + * Retrieve PKRU if not in init state, otherwise + * initialize it. + */ + if (hdr.xfeatures & mask) { + struct pkru_state xpkru =3D {0}; + + if (copy_from_buffer(&xpkru, xstate_offsets[i], + sizeof(xpkru), kbuf, ubuf)) + return -EFAULT; + + *pkru =3D xpkru.pkru; + } else { + *pkru =3D 0; + } + } + if (hdr.xfeatures & mask) { void *dst =3D __raw_xsave_addr(xsave, i); =20 @@ -1264,9 +1282,9 @@ static int copy_uabi_to_xstate(struct fpstate *fpstat= e, const void *kbuf, * Convert from a ptrace standard-format kernel buffer to kernel XSAVE[S] * format and copy to the target thread. Used by ptrace and KVM. */ -int copy_uabi_from_kernel_to_xstate(struct fpstate *fpstate, const void *k= buf) +int copy_uabi_from_kernel_to_xstate(struct fpstate *fpstate, const void *k= buf, u32 *pkru) { - return copy_uabi_to_xstate(fpstate, kbuf, NULL); + return copy_uabi_to_xstate(fpstate, kbuf, NULL, pkru); } =20 /* @@ -1274,10 +1292,10 @@ int copy_uabi_from_kernel_to_xstate(struct fpstate = *fpstate, const void *kbuf) * XSAVE[S] format and copy to the target thread. This is called from the * sigreturn() and rt_sigreturn() system calls. */ -int copy_sigframe_from_user_to_xstate(struct fpstate *fpstate, +int copy_sigframe_from_user_to_xstate(struct task_struct *tsk, const void __user *ubuf) { - return copy_uabi_to_xstate(fpstate, NULL, ubuf); + return copy_uabi_to_xstate(tsk->thread.fpu.fpstate, NULL, ubuf, &tsk->thr= ead.pkru); } =20 static bool validate_independent_components(u64 mask) diff --git a/arch/x86/kernel/fpu/xstate.h b/arch/x86/kernel/fpu/xstate.h index 5ad47031383b..a4ecb04d8d64 100644 --- a/arch/x86/kernel/fpu/xstate.h +++ b/arch/x86/kernel/fpu/xstate.h @@ -46,8 +46,8 @@ extern void __copy_xstate_to_uabi_buf(struct membuf to, s= truct fpstate *fpstate, u32 pkru_val, enum xstate_copy_mode copy_mode); extern void copy_xstate_to_uabi_buf(struct membuf to, struct task_struct *= tsk, enum xstate_copy_mode mode); -extern int copy_uabi_from_kernel_to_xstate(struct fpstate *fpstate, const = void *kbuf); -extern int copy_sigframe_from_user_to_xstate(struct fpstate *fpstate, cons= t void __user *ubuf); +extern int copy_uabi_from_kernel_to_xstate(struct fpstate *fpstate, const = void *kbuf, u32 *pkru); +extern int copy_sigframe_from_user_to_xstate(struct task_struct *tsk, cons= t void __user *ubuf); =20 =20 extern void fpu__init_cpu_xstate(void); --=20 2.37.0