arch/x86/kernel/fpu/xstate.c

   1 /*
   2  * xsave/xrstor support.
   3  *
   4  * Author: Suresh Siddha <suresh.b.siddha@intel.com>
   5  */
   6 #include <linux/compat.h>
   7 #include <linux/cpu.h>
   8 #include <linux/mman.h>
   9 #include <linux/pkeys.h>
  10
  11 #include <asm/fpu/api.h>
  12 #include <asm/fpu/internal.h>
  13 #include <asm/fpu/signal.h>
  14 #include <asm/fpu/regset.h>
  15 #include <asm/fpu/xstate.h>
  16
  17 #include <asm/tlbflush.h>
  18 #include <asm/cpufeature.h>
  19
  20 /*
  21  * Although we spell it out in here, the Processor Trace
  22  * xfeature is completely unused.  We use other mechanisms
  23  * to save/restore PT state in Linux.
  24  */
  25 static const char *xfeature_names[] =
  26 {
  27         "x87 floating point registers"  ,
  28         "SSE registers"                 ,
  29         "AVX registers"                 ,
  30         "MPX bounds registers"          ,
  31         "MPX CSR"                       ,
  32         "AVX-512 opmask"                ,
  33         "AVX-512 Hi256"                 ,
  34         "AVX-512 ZMM_Hi256"             ,
  35         "Processor Trace (unused)"      ,
  36         "Protection Keys User registers",
  37         "unknown xstate feature"        ,
  38 };
  39
  40 static short xsave_cpuid_features[] __initdata = {
  41         X86_FEATURE_FPU,
  42         X86_FEATURE_XMM,
  43         X86_FEATURE_AVX,
  44         X86_FEATURE_MPX,
  45         X86_FEATURE_MPX,
  46         X86_FEATURE_AVX512F,
  47         X86_FEATURE_AVX512F,
  48         X86_FEATURE_AVX512F,
  49         X86_FEATURE_INTEL_PT,
  50         X86_FEATURE_PKU,
  51 };
  52
  53 /*
  54  * Mask of xstate features supported by the CPU and the kernel:
  55  */
  56 u64 xfeatures_mask __read_mostly;
  57
  58 static unsigned int xstate_offsets[XFEATURE_MAX] = { [ 0 ... XFEATURE_MAX - 1] = -1};
  59 static unsigned int xstate_sizes[XFEATURE_MAX]   = { [ 0 ... XFEATURE_MAX - 1] = -1};
  60 static unsigned int xstate_comp_offsets[sizeof(xfeatures_mask)*8];
  61
  62 /*
  63  * The XSAVE area of kernel can be in standard or compacted format;
  64  * it is always in standard format for user mode. This is the user
  65  * mode standard format size used for signal and ptrace frames.
  66  */
  67 unsigned int fpu_user_xstate_size;
  68
  69 /*
  70  * Clear all of the X86_FEATURE_* bits that are unavailable
  71  * when the CPU has no XSAVE support.
  72  */
  73 void fpu__xstate_clear_all_cpu_caps(void)
  74 {
  75         setup_clear_cpu_cap(X86_FEATURE_XSAVE);
  76 }
  77
  78 /*
  79  * Return whether the system supports a given xfeature.
  80  *
  81  * Also return the name of the (most advanced) feature that the caller requested:
  82  */
  83 int cpu_has_xfeatures(u64 xfeatures_needed, const char **feature_name)
  84 {
  85         u64 xfeatures_missing = xfeatures_needed & ~xfeatures_mask;
  86
  87         if (unlikely(feature_name)) {
  88                 long xfeature_idx, max_idx;
  89                 u64 xfeatures_print;
  90                 /*
  91                  * So we use FLS here to be able to print the most advanced
  92                  * feature that was requested but is missing. So if a driver
  93                  * asks about "XFEATURE_MASK_SSE | XFEATURE_MASK_YMM" we'll print the
  94                  * missing AVX feature - this is the most informative message
  95                  * to users:
  96                  */
  97                 if (xfeatures_missing)
  98                         xfeatures_print = xfeatures_missing;
  99                 else
 100                         xfeatures_print = xfeatures_needed;
 101
 102                 xfeature_idx = fls64(xfeatures_print)-1;
 103                 max_idx = ARRAY_SIZE(xfeature_names)-1;
 104                 xfeature_idx = min(xfeature_idx, max_idx);
 105
 106                 *feature_name = xfeature_names[xfeature_idx];
 107         }
 108
 109         if (xfeatures_missing)
 110                 return 0;
 111
 112         return 1;
 113 }
 114 EXPORT_SYMBOL_GPL(cpu_has_xfeatures);
 115
 116 static int xfeature_is_supervisor(int xfeature_nr)
 117 {
 118         /*
 119          * We currently do not support supervisor states, but if
 120          * we did, we could find out like this.
 121          *
 122          * SDM says: If state component 'i' is a user state component,
 123          * ECX[0] return 0; if state component i is a supervisor
 124          * state component, ECX[0] returns 1.
 125          */
 126         u32 eax, ebx, ecx, edx;
 127
 128         cpuid_count(XSTATE_CPUID, xfeature_nr, &eax, &ebx, &ecx, &edx);
 129         return !!(ecx & 1);
 130 }
 131
 132 static int xfeature_is_user(int xfeature_nr)
 133 {
 134         return !xfeature_is_supervisor(xfeature_nr);
 135 }
 136
 137 /*
 138  * When executing XSAVEOPT (or other optimized XSAVE instructions), if
 139  * a processor implementation detects that an FPU state component is still
 140  * (or is again) in its initialized state, it may clear the corresponding
 141  * bit in the header.xfeatures field, and can skip the writeout of registers
 142  * to the corresponding memory layout.
 143  *
 144  * This means that when the bit is zero, the state component might still contain
 145  * some previous - non-initialized register state.
 146  *
 147  * Before writing xstate information to user-space we sanitize those components,
 148  * to always ensure that the memory layout of a feature will be in the init state
 149  * if the corresponding header bit is zero. This is to ensure that user-space doesn't
 150  * see some stale state in the memory layout during signal handling, debugging etc.
 151  */
 152 void fpstate_sanitize_xstate(struct fpu *fpu)
 153 {
 154         struct fxregs_state *fx = &fpu->state.fxsave;
 155         int feature_bit;
 156         u64 xfeatures;
 157
 158         if (!use_xsaveopt())
 159                 return;
 160
 161         xfeatures = fpu->state.xsave.header.xfeatures;
 162
 163         /*
 164          * None of the feature bits are in init state. So nothing else
 165          * to do for us, as the memory layout is up to date.
 166          */
 167         if ((xfeatures & xfeatures_mask) == xfeatures_mask)
 168                 return;
 169
 170         /*
 171          * FP is in init state
 172          */
 173         if (!(xfeatures & XFEATURE_MASK_FP)) {
 174                 fx->cwd = 0x37f;
 175                 fx->swd = 0;
 176                 fx->twd = 0;
 177                 fx->fop = 0;
 178                 fx->rip = 0;
 179                 fx->rdp = 0;
 180                 memset(&fx->st_space[0], 0, 128);
 181         }
 182
 183         /*
 184          * SSE is in init state
 185          */
 186         if (!(xfeatures & XFEATURE_MASK_SSE))
 187                 memset(&fx->xmm_space[0], 0, 256);
 188
 189         /*
 190          * First two features are FPU and SSE, which above we handled
 191          * in a special way already:
 192          */
 193         feature_bit = 0x2;
 194         xfeatures = (xfeatures_mask & ~xfeatures) >> 2;
 195
 196         /*
 197          * Update all the remaining memory layouts according to their
 198          * standard xstate layout, if their header bit is in the init
 199          * state:
 200          */
 201         while (xfeatures) {
 202                 if (xfeatures & 0x1) {
 203                         int offset = xstate_comp_offsets[feature_bit];
 204                         int size = xstate_sizes[feature_bit];
 205
 206                         memcpy((void *)fx + offset,
 207                                (void *)&init_fpstate.xsave + offset,
 208                                size);
 209                 }
 210
 211                 xfeatures >>= 1;
 212                 feature_bit++;
 213         }
 214 }
 215
 216 /*
 217  * Enable the extended processor state save/restore feature.
 218  * Called once per CPU onlining.
 219  */
 220 void fpu__init_cpu_xstate(void)
 221 {
 222         if (!boot_cpu_has(X86_FEATURE_XSAVE) || !xfeatures_mask)
 223                 return;
 224         /*
 225          * Make it clear that XSAVES supervisor states are not yet
 226          * implemented should anyone expect it to work by changing
 227          * bits in XFEATURE_MASK_* macros and XCR0.
 228          */
 229         WARN_ONCE((xfeatures_mask & XFEATURE_MASK_SUPERVISOR),
 230                 "x86/fpu: XSAVES supervisor states are not yet implemented.\n");
 231
 232         xfeatures_mask &= ~XFEATURE_MASK_SUPERVISOR;
 233
 234         cr4_set_bits(X86_CR4_OSXSAVE);
 235         xsetbv(XCR_XFEATURE_ENABLED_MASK, xfeatures_mask);
 236 }
 237
 238 /*
 239  * Note that in the future we will likely need a pair of
 240  * functions here: one for user xstates and the other for
 241  * system xstates.  For now, they are the same.
 242  */
 243 static int xfeature_enabled(enum xfeature xfeature)
 244 {
 245         return !!(xfeatures_mask & (1UL << xfeature));
 246 }
 247
 248 /*
 249  * Record the offsets and sizes of various xstates contained
 250  * in the XSAVE state memory layout.
 251  */
 252 static void __init setup_xstate_features(void)
 253 {
 254         u32 eax, ebx, ecx, edx, i;
 255         /* start at the beginnning of the "extended state" */
 256         unsigned int last_good_offset = offsetof(struct xregs_state,
 257                                                  extended_state_area);
 258         /*
 259          * The FP xstates and SSE xstates are legacy states. They are always
 260          * in the fixed offsets in the xsave area in either compacted form
 261          * or standard form.
 262          */
 263         xstate_offsets[0] = 0;
 264         xstate_sizes[0] = offsetof(struct fxregs_state, xmm_space);
 265         xstate_offsets[1] = xstate_sizes[0];
 266         xstate_sizes[1] = FIELD_SIZEOF(struct fxregs_state, xmm_space);
 267
 268         for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
 269                 if (!xfeature_enabled(i))
 270                         continue;
 271
 272                 cpuid_count(XSTATE_CPUID, i, &eax, &ebx, &ecx, &edx);
 273
 274                 /*
 275                  * If an xfeature is supervisor state, the offset
 276                  * in EBX is invalid. We leave it to -1.
 277                  */
 278                 if (xfeature_is_user(i))
 279                         xstate_offsets[i] = ebx;
 280
 281                 xstate_sizes[i] = eax;
 282                 /*
 283                  * In our xstate size checks, we assume that the
 284                  * highest-numbered xstate feature has the
 285                  * highest offset in the buffer.  Ensure it does.
 286                  */
 287                 WARN_ONCE(last_good_offset > xstate_offsets[i],
 288                         "x86/fpu: misordered xstate at %d\n", last_good_offset);
 289                 last_good_offset = xstate_offsets[i];
 290         }
 291 }
 292
 293 static void __init print_xstate_feature(u64 xstate_mask)
 294 {
 295         const char *feature_name;
 296
 297         if (cpu_has_xfeatures(xstate_mask, &feature_name))
 298                 pr_info("x86/fpu: Supporting XSAVE feature 0x%03Lx: '%s'\n", xstate_mask, feature_name);
 299 }
 300
 301 /*
 302  * Print out all the supported xstate features:
 303  */
 304 static void __init print_xstate_features(void)
 305 {
 306         print_xstate_feature(XFEATURE_MASK_FP);
 307         print_xstate_feature(XFEATURE_MASK_SSE);
 308         print_xstate_feature(XFEATURE_MASK_YMM);
 309         print_xstate_feature(XFEATURE_MASK_BNDREGS);
 310         print_xstate_feature(XFEATURE_MASK_BNDCSR);
 311         print_xstate_feature(XFEATURE_MASK_OPMASK);
 312         print_xstate_feature(XFEATURE_MASK_ZMM_Hi256);
 313         print_xstate_feature(XFEATURE_MASK_Hi16_ZMM);
 314         print_xstate_feature(XFEATURE_MASK_PKRU);
 315 }
 316
 317 /*
 318  * This check is important because it is easy to get XSTATE_*
 319  * confused with XSTATE_BIT_*.
 320  */
 321 #define CHECK_XFEATURE(nr) do {         \
 322         WARN_ON(nr < FIRST_EXTENDED_XFEATURE);  \
 323         WARN_ON(nr >= XFEATURE_MAX);    \
 324 } while (0)
 325
 326 /*
 327  * We could cache this like xstate_size[], but we only use
 328  * it here, so it would be a waste of space.
 329  */
 330 static int xfeature_is_aligned(int xfeature_nr)
 331 {
 332         u32 eax, ebx, ecx, edx;
 333
 334         CHECK_XFEATURE(xfeature_nr);
 335         cpuid_count(XSTATE_CPUID, xfeature_nr, &eax, &ebx, &ecx, &edx);
 336         /*
 337          * The value returned by ECX[1] indicates the alignment
 338          * of state component 'i' when the compacted format
 339          * of the extended region of an XSAVE area is used:
 340          */
 341         return !!(ecx & 2);
 342 }
 343
 344 /*
 345  * This function sets up offsets and sizes of all extended states in
 346  * xsave area. This supports both standard format and compacted format
 347  * of the xsave aread.
 348  */
 349 static void __init setup_xstate_comp(void)
 350 {
 351         unsigned int xstate_comp_sizes[sizeof(xfeatures_mask)*8];
 352         int i;
 353
 354         /*
 355          * The FP xstates and SSE xstates are legacy states. They are always
 356          * in the fixed offsets in the xsave area in either compacted form
 357          * or standard form.
 358          */
 359         xstate_comp_offsets[0] = 0;
 360         xstate_comp_offsets[1] = offsetof(struct fxregs_state, xmm_space);
 361
 362         if (!boot_cpu_has(X86_FEATURE_XSAVES)) {
 363                 for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
 364                         if (xfeature_enabled(i)) {
 365                                 xstate_comp_offsets[i] = xstate_offsets[i];
 366                                 xstate_comp_sizes[i] = xstate_sizes[i];
 367                         }
 368                 }
 369                 return;
 370         }
 371
 372         xstate_comp_offsets[FIRST_EXTENDED_XFEATURE] =
 373                 FXSAVE_SIZE + XSAVE_HDR_SIZE;
 374
 375         for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
 376                 if (xfeature_enabled(i))
 377                         xstate_comp_sizes[i] = xstate_sizes[i];
 378                 else
 379                         xstate_comp_sizes[i] = 0;
 380
 381                 if (i > FIRST_EXTENDED_XFEATURE) {
 382                         xstate_comp_offsets[i] = xstate_comp_offsets[i-1]
 383                                         + xstate_comp_sizes[i-1];
 384
 385                         if (xfeature_is_aligned(i))
 386                                 xstate_comp_offsets[i] =
 387                                         ALIGN(xstate_comp_offsets[i], 64);
 388                 }
 389         }
 390 }
 391
 392 /*
 393  * Print out xstate component offsets and sizes
 394  */
 395 static void __init print_xstate_offset_size(void)
 396 {
 397         int i;
 398
 399         for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
 400                 if (!xfeature_enabled(i))
 401                         continue;
 402                 pr_info("x86/fpu: xstate_offset[%d]: %4d, xstate_sizes[%d]: %4d\n",
 403                          i, xstate_comp_offsets[i], i, xstate_sizes[i]);
 404         }
 405 }
 406
 407 /*
 408  * All supported features have either init state all zeros or are
 409  * handled in setup_init_fpu() individually. This is an explicit
 410  * feature list and does not use XFEATURE_MASK*SUPPORTED to catch
 411  * newly added supported features at build time and make people
 412  * actually look at the init state for the new feature.
 413  */
 414 #define XFEATURES_INIT_FPSTATE_HANDLED          \
 415         (XFEATURE_MASK_FP |                     \
 416          XFEATURE_MASK_SSE |                    \
 417          XFEATURE_MASK_YMM |                    \
 418          XFEATURE_MASK_OPMASK |                 \
 419          XFEATURE_MASK_ZMM_Hi256 |              \
 420          XFEATURE_MASK_Hi16_ZMM  |              \
 421          XFEATURE_MASK_PKRU |                   \
 422          XFEATURE_MASK_BNDREGS |                \
 423          XFEATURE_MASK_BNDCSR)
 424
 425 /*
 426  * setup the xstate image representing the init state
 427  */
 428 static void __init setup_init_fpu_buf(void)
 429 {
 430         static int on_boot_cpu __initdata = 1;
 431
 432         BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED);
 433
 434         WARN_ON_FPU(!on_boot_cpu);
 435         on_boot_cpu = 0;
 436
 437         if (!boot_cpu_has(X86_FEATURE_XSAVE))
 438                 return;
 439
 440         setup_xstate_features();
 441         print_xstate_features();
 442
 443         if (boot_cpu_has(X86_FEATURE_XSAVES))
 444                 init_fpstate.xsave.header.xcomp_bv = (u64)1 << 63 | xfeatures_mask;
 445
 446         /*
 447          * Init all the features state with header.xfeatures being 0x0
 448          */
 449         copy_kernel_to_xregs_booting(&init_fpstate.xsave);
 450
 451         /*
 452          * All components are now in init state. Read the state back so
 453          * that init_fpstate contains all non-zero init state. This only
 454          * works with XSAVE, but not with XSAVEOPT and XSAVES because
 455          * those use the init optimization which skips writing data for
 456          * components in init state.
 457          *
 458          * XSAVE could be used, but that would require to reshuffle the
 459          * data when XSAVES is available because XSAVES uses xstate
 460          * compaction. But doing so is a pointless exercise because most
 461          * components have an all zeros init state except for the legacy
 462          * ones (FP and SSE). Those can be saved with FXSAVE into the
 463          * legacy area. Adding new features requires to ensure that init
 464          * state is all zeroes or if not to add the necessary handling
 465          * here.
 466          */
 467         fxsave(&init_fpstate.fxsave);
 468 }
 469
 470 static int xfeature_uncompacted_offset(int xfeature_nr)
 471 {
 472         u32 eax, ebx, ecx, edx;
 473
 474         /*
 475          * Only XSAVES supports supervisor states and it uses compacted
 476          * format. Checking a supervisor state's uncompacted offset is
 477          * an error.
 478          */
 479         if (XFEATURE_MASK_SUPERVISOR & (1 << xfeature_nr)) {
 480                 WARN_ONCE(1, "No fixed offset for xstate %d\n", xfeature_nr);
 481                 return -1;
 482         }
 483
 484         CHECK_XFEATURE(xfeature_nr);
 485         cpuid_count(XSTATE_CPUID, xfeature_nr, &eax, &ebx, &ecx, &edx);
 486         return ebx;
 487 }
 488
 489 static int xfeature_size(int xfeature_nr)
 490 {
 491         u32 eax, ebx, ecx, edx;
 492
 493         CHECK_XFEATURE(xfeature_nr);
 494         cpuid_count(XSTATE_CPUID, xfeature_nr, &eax, &ebx, &ecx, &edx);
 495         return eax;
 496 }
 497
 498 /*
 499  * 'XSAVES' implies two different things:
 500  * 1. saving of supervisor/system state
 501  * 2. using the compacted format
 502  *
 503  * Use this function when dealing with the compacted format so
 504  * that it is obvious which aspect of 'XSAVES' is being handled
 505  * by the calling code.
 506  */
 507 int using_compacted_format(void)
 508 {
 509         return boot_cpu_has(X86_FEATURE_XSAVES);
 510 }
 511
 512 /* Validate an xstate header supplied by userspace (ptrace or sigreturn) */
 513 int validate_xstate_header(const struct xstate_header *hdr)
 514 {
 515         /* No unknown or supervisor features may be set */
 516         if (hdr->xfeatures & (~xfeatures_mask | XFEATURE_MASK_SUPERVISOR))
 517                 return -EINVAL;
 518
 519         /* Userspace must use the uncompacted format */
 520         if (hdr->xcomp_bv)
 521                 return -EINVAL;
 522
 523         /*
 524          * If 'reserved' is shrunken to add a new field, make sure to validate
 525          * that new field here!
 526          */
 527         BUILD_BUG_ON(sizeof(hdr->reserved) != 48);
 528
 529         /* No reserved bits may be set */
 530         if (memchr_inv(hdr->reserved, 0, sizeof(hdr->reserved)))
 531                 return -EINVAL;
 532
 533         return 0;
 534 }
 535
 536 static void __xstate_dump_leaves(void)
 537 {
 538         int i;
 539         u32 eax, ebx, ecx, edx;
 540         static int should_dump = 1;
 541
 542         if (!should_dump)
 543                 return;
 544         should_dump = 0;
 545         /*
 546          * Dump out a few leaves past the ones that we support
 547          * just in case there are some goodies up there
 548          */
 549         for (i = 0; i < XFEATURE_MAX + 10; i++) {
 550                 cpuid_count(XSTATE_CPUID, i, &eax, &ebx, &ecx, &edx);
 551                 pr_warn("CPUID[%02x, %02x]: eax=%08x ebx=%08x ecx=%08x edx=%08x\n",
 552                         XSTATE_CPUID, i, eax, ebx, ecx, edx);
 553         }
 554 }
 555
 556 #define XSTATE_WARN_ON(x) do {                                                  \
 557         if (WARN_ONCE(x, "XSAVE consistency problem, dumping leaves")) {        \
 558                 __xstate_dump_leaves();                                         \
 559         }                                                                       \
 560 } while (0)
 561
 562 #define XCHECK_SZ(sz, nr, nr_macro, __struct) do {                      \
 563         if ((nr == nr_macro) &&                                         \
 564             WARN_ONCE(sz != sizeof(__struct),                           \
 565                 "%s: struct is %zu bytes, cpu state %d bytes\n",        \
 566                 __stringify(nr_macro), sizeof(__struct), sz)) {         \
 567                 __xstate_dump_leaves();                                 \
 568         }                                                               \
 569 } while (0)
 570
 571 /*
 572  * We have a C struct for each 'xstate'.  We need to ensure
 573  * that our software representation matches what the CPU
 574  * tells us about the state's size.
 575  */
 576 static void check_xstate_against_struct(int nr)
 577 {
 578         /*
 579          * Ask the CPU for the size of the state.
 580          */
 581         int sz = xfeature_size(nr);
 582         /*
 583          * Match each CPU state with the corresponding software
 584          * structure.
 585          */
 586         XCHECK_SZ(sz, nr, XFEATURE_YMM,       struct ymmh_struct);
 587         XCHECK_SZ(sz, nr, XFEATURE_BNDREGS,   struct mpx_bndreg_state);
 588         XCHECK_SZ(sz, nr, XFEATURE_BNDCSR,    struct mpx_bndcsr_state);
 589         XCHECK_SZ(sz, nr, XFEATURE_OPMASK,    struct avx_512_opmask_state);
 590         XCHECK_SZ(sz, nr, XFEATURE_ZMM_Hi256, struct avx_512_zmm_uppers_state);
 591         XCHECK_SZ(sz, nr, XFEATURE_Hi16_ZMM,  struct avx_512_hi16_state);
 592         XCHECK_SZ(sz, nr, XFEATURE_PKRU,      struct pkru_state);
 593
 594         /*
 595          * Make *SURE* to add any feature numbers in below if
 596          * there are "holes" in the xsave state component
 597          * numbers.
 598          */
 599         if ((nr < XFEATURE_YMM) ||
 600             (nr >= XFEATURE_MAX) ||
 601             (nr == XFEATURE_PT_UNIMPLEMENTED_SO_FAR)) {
 602                 WARN_ONCE(1, "no structure for xstate: %d\n", nr);
 603                 XSTATE_WARN_ON(1);
 604         }
 605 }
 606
 607 /*
 608  * This essentially double-checks what the cpu told us about
 609  * how large the XSAVE buffer needs to be.  We are recalculating
 610  * it to be safe.
 611  */
 612 static void do_extra_xstate_size_checks(void)
 613 {
 614         int paranoid_xstate_size = FXSAVE_SIZE + XSAVE_HDR_SIZE;
 615         int i;
 616
 617         for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
 618                 if (!xfeature_enabled(i))
 619                         continue;
 620
 621                 check_xstate_against_struct(i);
 622                 /*
 623                  * Supervisor state components can be managed only by
 624                  * XSAVES, which is compacted-format only.
 625                  */
 626                 if (!using_compacted_format())
 627                         XSTATE_WARN_ON(xfeature_is_supervisor(i));
 628
 629                 /* Align from the end of the previous feature */
 630                 if (xfeature_is_aligned(i))
 631                         paranoid_xstate_size = ALIGN(paranoid_xstate_size, 64);
 632                 /*
 633                  * The offset of a given state in the non-compacted
 634                  * format is given to us in a CPUID leaf.  We check
 635                  * them for being ordered (increasing offsets) in
 636                  * setup_xstate_features().
 637                  */
 638                 if (!using_compacted_format())
 639                         paranoid_xstate_size = xfeature_uncompacted_offset(i);
 640                 /*
 641                  * The compacted-format offset always depends on where
 642                  * the previous state ended.
 643                  */
 644                 paranoid_xstate_size += xfeature_size(i);
 645         }
 646         XSTATE_WARN_ON(paranoid_xstate_size != fpu_kernel_xstate_size);
 647 }
 648
 649
 650 /*
 651  * Get total size of enabled xstates in XCR0/xfeatures_mask.
 652  *
 653  * Note the SDM's wording here.  "sub-function 0" only enumerates
 654  * the size of the *user* states.  If we use it to size a buffer
 655  * that we use 'XSAVES' on, we could potentially overflow the
 656  * buffer because 'XSAVES' saves system states too.
 657  *
 658  * Note that we do not currently set any bits on IA32_XSS so
 659  * 'XCR0 | IA32_XSS == XCR0' for now.
 660  */
 661 static unsigned int __init get_xsaves_size(void)
 662 {
 663         unsigned int eax, ebx, ecx, edx;
 664         /*
 665          * - CPUID function 0DH, sub-function 1:
 666          *    EBX enumerates the size (in bytes) required by
 667          *    the XSAVES instruction for an XSAVE area
 668          *    containing all the state components
 669          *    corresponding to bits currently set in
 670          *    XCR0 | IA32_XSS.
 671          */
 672         cpuid_count(XSTATE_CPUID, 1, &eax, &ebx, &ecx, &edx);
 673         return ebx;
 674 }
 675
 676 static unsigned int __init get_xsave_size(void)
 677 {
 678         unsigned int eax, ebx, ecx, edx;
 679         /*
 680          * - CPUID function 0DH, sub-function 0:
 681          *    EBX enumerates the size (in bytes) required by
 682          *    the XSAVE instruction for an XSAVE area
 683          *    containing all the *user* state components
 684          *    corresponding to bits currently set in XCR0.
 685          */
 686         cpuid_count(XSTATE_CPUID, 0, &eax, &ebx, &ecx, &edx);
 687         return ebx;
 688 }
 689
 690 /*
 691  * Will the runtime-enumerated 'xstate_size' fit in the init
 692  * task's statically-allocated buffer?
 693  */
 694 static bool is_supported_xstate_size(unsigned int test_xstate_size)
 695 {
 696         if (test_xstate_size <= sizeof(union fpregs_state))
 697                 return true;
 698
 699         pr_warn("x86/fpu: xstate buffer too small (%zu < %d), disabling xsave\n",
 700                         sizeof(union fpregs_state), test_xstate_size);
 701         return false;
 702 }
 703
 704 static int init_xstate_size(void)
 705 {
 706         /* Recompute the context size for enabled features: */
 707         unsigned int possible_xstate_size;
 708         unsigned int xsave_size;
 709
 710         xsave_size = get_xsave_size();
 711
 712         if (boot_cpu_has(X86_FEATURE_XSAVES))
 713                 possible_xstate_size = get_xsaves_size();
 714         else
 715                 possible_xstate_size = xsave_size;
 716
 717         /* Ensure we have the space to store all enabled: */
 718         if (!is_supported_xstate_size(possible_xstate_size))
 719                 return -EINVAL;
 720
 721         /*
 722          * The size is OK, we are definitely going to use xsave,
 723          * make it known to the world that we need more space.
 724          */
 725         fpu_kernel_xstate_size = possible_xstate_size;
 726         do_extra_xstate_size_checks();
 727
 728         /*
 729          * User space is always in standard format.
 730          */
 731         fpu_user_xstate_size = xsave_size;
 732         return 0;
 733 }
 734
 735 /*
 736  * We enabled the XSAVE hardware, but something went wrong and
 737  * we can not use it.  Disable it.
 738  */
 739 static void fpu__init_disable_system_xstate(void)
 740 {
 741         xfeatures_mask = 0;
 742         cr4_clear_bits(X86_CR4_OSXSAVE);
 743         fpu__xstate_clear_all_cpu_caps();
 744 }
 745
 746 /*
 747  * Enable and initialize the xsave feature.
 748  * Called once per system bootup.
 749  */
 750 void __init fpu__init_system_xstate(void)
 751 {
 752         unsigned int eax, ebx, ecx, edx;
 753         static int on_boot_cpu __initdata = 1;
 754         int err;
 755         int i;
 756
 757         WARN_ON_FPU(!on_boot_cpu);
 758         on_boot_cpu = 0;
 759
 760         if (!boot_cpu_has(X86_FEATURE_FPU)) {
 761                 pr_info("x86/fpu: No FPU detected\n");
 762                 return;
 763         }
 764
 765         if (!boot_cpu_has(X86_FEATURE_XSAVE)) {
 766                 pr_info("x86/fpu: x87 FPU will use %s\n",
 767                         boot_cpu_has(X86_FEATURE_FXSR) ? "FXSAVE" : "FSAVE");
 768                 return;
 769         }
 770
 771         if (boot_cpu_data.cpuid_level < XSTATE_CPUID) {
 772                 WARN_ON_FPU(1);
 773                 return;
 774         }
 775
 776         cpuid_count(XSTATE_CPUID, 0, &eax, &ebx, &ecx, &edx);
 777         xfeatures_mask = eax + ((u64)edx << 32);
 778
 779         if ((xfeatures_mask & XFEATURE_MASK_FPSSE) != XFEATURE_MASK_FPSSE) {
 780                 /*
 781                  * This indicates that something really unexpected happened
 782                  * with the enumeration.  Disable XSAVE and try to continue
 783                  * booting without it.  This is too early to BUG().
 784                  */
 785                 pr_err("x86/fpu: FP/SSE not present amongst the CPU's xstate features: 0x%llx.\n", xfeatures_mask);
 786                 goto out_disable;
 787         }
 788
 789         /*
 790          * Clear XSAVE features that are disabled in the normal CPUID.
 791          */
 792         for (i = 0; i < ARRAY_SIZE(xsave_cpuid_features); i++) {
 793                 if (!boot_cpu_has(xsave_cpuid_features[i]))
 794                         xfeatures_mask &= ~BIT(i);
 795         }
 796
 797         xfeatures_mask &= fpu__get_supported_xfeatures_mask();
 798
 799         /* Enable xstate instructions to be able to continue with initialization: */
 800         fpu__init_cpu_xstate();
 801         err = init_xstate_size();
 802         if (err)
 803                 goto out_disable;
 804
 805         /*
 806          * Update info used for ptrace frames; use standard-format size and no
 807          * supervisor xstates:
 808          */
 809         update_regset_xstate_info(fpu_user_xstate_size, xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR);
 810
 811         fpu__init_prepare_fx_sw_frame();
 812         setup_init_fpu_buf();
 813         setup_xstate_comp();
 814         print_xstate_offset_size();
 815
 816         pr_info("x86/fpu: Enabled xstate features 0x%llx, context size is %d bytes, using '%s' format.\n",
 817                 xfeatures_mask,
 818                 fpu_kernel_xstate_size,
 819                 boot_cpu_has(X86_FEATURE_XSAVES) ? "compacted" : "standard");
 820         return;
 821
 822 out_disable:
 823         /* something went wrong, try to boot without any XSAVE support */
 824         fpu__init_disable_system_xstate();
 825 }
 826
 827 /*
 828  * Restore minimal FPU state after suspend:
 829  */
 830 void fpu__resume_cpu(void)
 831 {
 832         /*
 833          * Restore XCR0 on xsave capable CPUs:
 834          */
 835         if (boot_cpu_has(X86_FEATURE_XSAVE))
 836                 xsetbv(XCR_XFEATURE_ENABLED_MASK, xfeatures_mask);
 837 }
 838
 839 /*
 840  * Given an xstate feature mask, calculate where in the xsave
 841  * buffer the state is.  Callers should ensure that the buffer
 842  * is valid.
 843  *
 844  * Note: does not work for compacted buffers.
 845  */
 846 void *__raw_xsave_addr(struct xregs_state *xsave, int xstate_feature_mask)
 847 {
 848         int feature_nr = fls64(xstate_feature_mask) - 1;
 849
 850         if (!xfeature_enabled(feature_nr)) {
 851                 WARN_ON_FPU(1);
 852                 return NULL;
 853         }
 854
 855         return (void *)xsave + xstate_comp_offsets[feature_nr];
 856 }
 857 /*
 858  * Given the xsave area and a state inside, this function returns the
 859  * address of the state.
 860  *
 861  * This is the API that is called to get xstate address in either
 862  * standard format or compacted format of xsave area.
 863  *
 864  * Note that if there is no data for the field in the xsave buffer
 865  * this will return NULL.
 866  *
 867  * Inputs:
 868  *      xstate: the thread's storage area for all FPU data
 869  *      xstate_feature: state which is defined in xsave.h (e.g.
 870  *      XFEATURE_MASK_FP, XFEATURE_MASK_SSE, etc...)
 871  * Output:
 872  *      address of the state in the xsave area, or NULL if the
 873  *      field is not present in the xsave buffer.
 874  */
 875 void *get_xsave_addr(struct xregs_state *xsave, int xstate_feature)
 876 {
 877         /*
 878          * Do we even *have* xsave state?
 879          */
 880         if (!boot_cpu_has(X86_FEATURE_XSAVE))
 881                 return NULL;
 882
 883         /*
 884          * We should not ever be requesting features that we
 885          * have not enabled.  Remember that pcntxt_mask is
 886          * what we write to the XCR0 register.
 887          */
 888         WARN_ONCE(!(xfeatures_mask & xstate_feature),
 889                   "get of unsupported state");
 890         /*
 891          * This assumes the last 'xsave*' instruction to
 892          * have requested that 'xstate_feature' be saved.
 893          * If it did not, we might be seeing and old value
 894          * of the field in the buffer.
 895          *
 896          * This can happen because the last 'xsave' did not
 897          * request that this feature be saved (unlikely)
 898          * or because the "init optimization" caused it
 899          * to not be saved.
 900          */
 901         if (!(xsave->header.xfeatures & xstate_feature))
 902                 return NULL;
 903
 904         return __raw_xsave_addr(xsave, xstate_feature);
 905 }
 906 EXPORT_SYMBOL_GPL(get_xsave_addr);
 907
 908 /*
 909  * This wraps up the common operations that need to occur when retrieving
 910  * data from xsave state.  It first ensures that the current task was
 911  * using the FPU and retrieves the data in to a buffer.  It then calculates
 912  * the offset of the requested field in the buffer.
 913  *
 914  * This function is safe to call whether the FPU is in use or not.
 915  *
 916  * Note that this only works on the current task.
 917  *
 918  * Inputs:
 919  *      @xsave_state: state which is defined in xsave.h (e.g. XFEATURE_MASK_FP,
 920  *      XFEATURE_MASK_SSE, etc...)
 921  * Output:
 922  *      address of the state in the xsave area or NULL if the state
 923  *      is not present or is in its 'init state'.
 924  */
 925 const void *get_xsave_field_ptr(int xsave_state)
 926 {
 927         struct fpu *fpu = &current->thread.fpu;
 928
 929         if (!fpu->initialized)
 930                 return NULL;
 931         /*
 932          * fpu__save() takes the CPU's xstate registers
 933          * and saves them off to the 'fpu memory buffer.
 934          */
 935         fpu__save(fpu);
 936
 937         return get_xsave_addr(&fpu->state.xsave, xsave_state);
 938 }
 939
 940 #ifdef CONFIG_ARCH_HAS_PKEYS
 941
 942 /*
 943  * This will go out and modify PKRU register to set the access
 944  * rights for @pkey to @init_val.
 945  */
 946 int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
 947                 unsigned long init_val)
 948 {
 949         u32 old_pkru;
 950         int pkey_shift = (pkey * PKRU_BITS_PER_PKEY);
 951         u32 new_pkru_bits = 0;
 952
 953         /*
 954          * This check implies XSAVE support.  OSPKE only gets
 955          * set if we enable XSAVE and we enable PKU in XCR0.
 956          */
 957         if (!boot_cpu_has(X86_FEATURE_OSPKE))
 958                 return -EINVAL;
 959
 960         /*
 961          * This code should only be called with valid 'pkey'
 962          * values originating from in-kernel users.  Complain
 963          * if a bad value is observed.
 964          */
 965         WARN_ON_ONCE(pkey >= arch_max_pkey());
 966
 967         /* Set the bits we need in PKRU:  */
 968         if (init_val & PKEY_DISABLE_ACCESS)
 969                 new_pkru_bits |= PKRU_AD_BIT;
 970         if (init_val & PKEY_DISABLE_WRITE)
 971                 new_pkru_bits |= PKRU_WD_BIT;
 972
 973         /* Shift the bits in to the correct place in PKRU for pkey: */
 974         new_pkru_bits <<= pkey_shift;
 975
 976         /* Get old PKRU and mask off any old bits in place: */
 977         old_pkru = read_pkru();
 978         old_pkru &= ~((PKRU_AD_BIT|PKRU_WD_BIT) << pkey_shift);
 979
 980         /* Write old part along with new part: */
 981         write_pkru(old_pkru | new_pkru_bits);
 982
 983         return 0;
 984 }
 985 #endif /* ! CONFIG_ARCH_HAS_PKEYS */
 986
 987 /*
 988  * Weird legacy quirk: SSE and YMM states store information in the
 989  * MXCSR and MXCSR_FLAGS fields of the FP area. That means if the FP
 990  * area is marked as unused in the xfeatures header, we need to copy
 991  * MXCSR and MXCSR_FLAGS if either SSE or YMM are in use.
 992  */
 993 static inline bool xfeatures_mxcsr_quirk(u64 xfeatures)
 994 {
 995         if (!(xfeatures & (XFEATURE_MASK_SSE|XFEATURE_MASK_YMM)))
 996                 return false;
 997
 998         if (xfeatures & XFEATURE_MASK_FP)
 999                 return false;
1000
1001         return true;
1002 }
1003
1004 static void fill_gap(unsigned to, void **kbuf, unsigned *pos, unsigned *count)
1005 {
1006         if (*pos < to) {
1007                 unsigned size = to - *pos;
1008
1009                 if (size > *count)
1010                         size = *count;
1011                 memcpy(*kbuf, (void *)&init_fpstate.xsave + *pos, size);
1012                 *kbuf += size;
1013                 *pos += size;
1014                 *count -= size;
1015         }
1016 }
1017
1018 static void copy_part(unsigned offset, unsigned size, void *from,
1019                         void **kbuf, unsigned *pos, unsigned *count)
1020 {
1021         fill_gap(offset, kbuf, pos, count);
1022         if (size > *count)
1023                 size = *count;
1024         if (size) {
1025                 memcpy(*kbuf, from, size);
1026                 *kbuf += size;
1027                 *pos += size;
1028                 *count -= size;
1029         }
1030 }
1031
1032 /*
1033  * Convert from kernel XSAVES compacted format to standard format and copy
1034  * to a kernel-space ptrace buffer.
1035  *
1036  * It supports partial copy but pos always starts from zero. This is called
1037  * from xstateregs_get() and there we check the CPU has XSAVES.
1038  */
1039 int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
1040 {
1041         struct xstate_header header;
1042         const unsigned off_mxcsr = offsetof(struct fxregs_state, mxcsr);
1043         unsigned count = size_total;
1044         int i;
1045
1046         /*
1047          * Currently copy_regset_to_user() starts from pos 0:
1048          */
1049         if (unlikely(offset_start != 0))
1050                 return -EFAULT;
1051
1052         /*
1053          * The destination is a ptrace buffer; we put in only user xstates:
1054          */
1055         memset(&header, 0, sizeof(header));
1056         header.xfeatures = xsave->header.xfeatures;
1057         header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR;
1058
1059         if (header.xfeatures & XFEATURE_MASK_FP)
1060                 copy_part(0, off_mxcsr,
1061                           &xsave->i387, &kbuf, &offset_start, &count);
1062         if (header.xfeatures & (XFEATURE_MASK_SSE | XFEATURE_MASK_YMM))
1063                 copy_part(off_mxcsr, MXCSR_AND_FLAGS_SIZE,
1064                           &xsave->i387.mxcsr, &kbuf, &offset_start, &count);
1065         if (header.xfeatures & XFEATURE_MASK_FP)
1066                 copy_part(offsetof(struct fxregs_state, st_space), 128,
1067                           &xsave->i387.st_space, &kbuf, &offset_start, &count);
1068         if (header.xfeatures & XFEATURE_MASK_SSE)
1069                 copy_part(xstate_offsets[XFEATURE_SSE], 256,
1070                           &xsave->i387.xmm_space, &kbuf, &offset_start, &count);
1071         /*
1072          * Fill xsave->i387.sw_reserved value for ptrace frame:
1073          */
1074         copy_part(offsetof(struct fxregs_state, sw_reserved), 48,
1075                   xstate_fx_sw_bytes, &kbuf, &offset_start, &count);
1076         /*
1077          * Copy xregs_state->header:
1078          */
1079         copy_part(offsetof(struct xregs_state, header), sizeof(header),
1080                   &header, &kbuf, &offset_start, &count);
1081
1082         for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
1083                 /*
1084                  * Copy only in-use xstates:
1085                  */
1086                 if ((header.xfeatures >> i) & 1) {
1087                         void *src = __raw_xsave_addr(xsave, 1 << i);
1088
1089                         copy_part(xstate_offsets[i], xstate_sizes[i],
1090                                   src, &kbuf, &offset_start, &count);
1091                 }
1092
1093         }
1094         fill_gap(size_total, &kbuf, &offset_start, &count);
1095
1096         return 0;
1097 }
1098
1099 static inline int
1100 __copy_xstate_to_user(void __user *ubuf, const void *data, unsigned int offset, unsigned int size, unsigned int size_total)
1101 {
1102         if (!size)
1103                 return 0;
1104
1105         if (offset < size_total) {
1106                 unsigned int copy = min(size, size_total - offset);
1107
1108                 if (__copy_to_user(ubuf + offset, data, copy))
1109                         return -EFAULT;
1110         }
1111         return 0;
1112 }
1113
1114 /*
1115  * Convert from kernel XSAVES compacted format to standard format and copy
1116  * to a user-space buffer. It supports partial copy but pos always starts from
1117  * zero. This is called from xstateregs_get() and there we check the CPU
1118  * has XSAVES.
1119  */
1120 int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
1121 {
1122         unsigned int offset, size;
1123         int ret, i;
1124         struct xstate_header header;
1125
1126         /*
1127          * Currently copy_regset_to_user() starts from pos 0:
1128          */
1129         if (unlikely(offset_start != 0))
1130                 return -EFAULT;
1131
1132         /*
1133          * The destination is a ptrace buffer; we put in only user xstates:
1134          */
1135         memset(&header, 0, sizeof(header));
1136         header.xfeatures = xsave->header.xfeatures;
1137         header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR;
1138
1139         /*
1140          * Copy xregs_state->header:
1141          */
1142         offset = offsetof(struct xregs_state, header);
1143         size = sizeof(header);
1144
1145         ret = __copy_xstate_to_user(ubuf, &header, offset, size, size_total);
1146         if (ret)
1147                 return ret;
1148
1149         for (i = 0; i < XFEATURE_MAX; i++) {
1150                 /*
1151                  * Copy only in-use xstates:
1152                  */
1153                 if ((header.xfeatures >> i) & 1) {
1154                         void *src = __raw_xsave_addr(xsave, 1 << i);
1155
1156                         offset = xstate_offsets[i];
1157                         size = xstate_sizes[i];
1158
1159                         /* The next component has to fit fully into the output buffer: */
1160                         if (offset + size > size_total)
1161                                 break;
1162
1163                         ret = __copy_xstate_to_user(ubuf, src, offset, size, size_total);
1164                         if (ret)
1165                                 return ret;
1166                 }
1167
1168         }
1169
1170         if (xfeatures_mxcsr_quirk(header.xfeatures)) {
1171                 offset = offsetof(struct fxregs_state, mxcsr);
1172                 size = MXCSR_AND_FLAGS_SIZE;
1173                 __copy_xstate_to_user(ubuf, &xsave->i387.mxcsr, offset, size, size_total);
1174         }
1175
1176         /*
1177          * Fill xsave->i387.sw_reserved value for ptrace frame:
1178          */
1179         offset = offsetof(struct fxregs_state, sw_reserved);
1180         size = sizeof(xstate_fx_sw_bytes);
1181
1182         ret = __copy_xstate_to_user(ubuf, xstate_fx_sw_bytes, offset, size, size_total);
1183         if (ret)
1184                 return ret;
1185
1186         return 0;
1187 }
1188
1189 /*
1190  * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format
1191  * and copy to the target thread. This is called from xstateregs_set().
1192  */
1193 int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
1194 {
1195         unsigned int offset, size;
1196         int i;
1197         struct xstate_header hdr;
1198
1199         offset = offsetof(struct xregs_state, header);
1200         size = sizeof(hdr);
1201
1202         memcpy(&hdr, kbuf + offset, size);
1203
1204         if (validate_xstate_header(&hdr))
1205                 return -EINVAL;
1206
1207         for (i = 0; i < XFEATURE_MAX; i++) {
1208                 u64 mask = ((u64)1 << i);
1209
1210                 if (hdr.xfeatures & mask) {
1211                         void *dst = __raw_xsave_addr(xsave, 1 << i);
1212
1213                         offset = xstate_offsets[i];
1214                         size = xstate_sizes[i];
1215
1216                         memcpy(dst, kbuf + offset, size);
1217                 }
1218         }
1219
1220         if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
1221                 offset = offsetof(struct fxregs_state, mxcsr);
1222                 size = MXCSR_AND_FLAGS_SIZE;
1223                 memcpy(&xsave->i387.mxcsr, kbuf + offset, size);
1224         }
1225
1226         /*
1227          * The state that came in from userspace was user-state only.
1228          * Mask all the user states out of 'xfeatures':
1229          */
1230         xsave->header.xfeatures &= XFEATURE_MASK_SUPERVISOR;
1231
1232         /*
1233          * Add back in the features that came in from userspace:
1234          */
1235         xsave->header.xfeatures |= hdr.xfeatures;
1236
1237         return 0;
1238 }
1239
1240 /*
1241  * Convert from a ptrace or sigreturn standard-format user-space buffer to
1242  * kernel XSAVES format and copy to the target thread. This is called from
1243  * xstateregs_set(), as well as potentially from the sigreturn() and
1244  * rt_sigreturn() system calls.
1245  */
1246 int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
1247 {
1248         unsigned int offset, size;
1249         int i;
1250         struct xstate_header hdr;
1251
1252         offset = offsetof(struct xregs_state, header);
1253         size = sizeof(hdr);
1254
1255         if (__copy_from_user(&hdr, ubuf + offset, size))
1256                 return -EFAULT;
1257
1258         if (validate_xstate_header(&hdr))
1259                 return -EINVAL;
1260
1261         for (i = 0; i < XFEATURE_MAX; i++) {
1262                 u64 mask = ((u64)1 << i);
1263
1264                 if (hdr.xfeatures & mask) {
1265                         void *dst = __raw_xsave_addr(xsave, 1 << i);
1266
1267                         offset = xstate_offsets[i];
1268                         size = xstate_sizes[i];
1269
1270                         if (__copy_from_user(dst, ubuf + offset, size))
1271                                 return -EFAULT;
1272                 }
1273         }
1274
1275         if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
1276                 offset = offsetof(struct fxregs_state, mxcsr);
1277                 size = MXCSR_AND_FLAGS_SIZE;
1278                 if (__copy_from_user(&xsave->i387.mxcsr, ubuf + offset, size))
1279                         return -EFAULT;
1280         }
1281
1282         /*
1283          * The state that came in from userspace was user-state only.
1284          * Mask all the user states out of 'xfeatures':
1285          */
1286         xsave->header.xfeatures &= XFEATURE_MASK_SUPERVISOR;
1287
1288         /*
1289          * Add back in the features that came in from userspace:
1290          */
1291         xsave->header.xfeatures |= hdr.xfeatures;
1292
1293         return 0;
1294 }