RE: [PATCH Bugfix v2 2/4] x86/xsaves: Define and use user_xstate_size for xstate size in signal context

[Yu, Fenghua]

> From: Hansen, Dave
> Sent: Wednesday, April 22, 2015 5:35 PM
> On 04/22/2015 05:06 PM, Yu, Fenghua wrote:
> > We need to copy ALL of supported xstates to user. Using xstate_bv only
> > copies partial xstates that are in non-init status.
> >
> > Xstate_bv only has xstates that are in non-init status. The xstates
> > that are in init status will not be copied to user if using xstate_bv.
> > In this case, the xstates that are in init status will be all zeros in
> > the user buffer (remember we clear the user buffer before). That's
> incorrect.
> I'm not convinced.  Let's step through this.
> 
> 1. kernel does an xsaves
> 2. Due to the 'init optimization' xstate_bv != pcntxt_mask, and some
>    fields of kernel xsave buffer are untouched 3. Kernel looks at pcntxt_mask,
> which means it copies untouched xsave
>    buffer fields out to userspace
> 
> If those untouched fields of the xsave buffer are in the "init state", then
> we've got no problem.  But, are those "untouched since (1)" fields in the
> kernel xsave buf *GUARANTEED* to be in the init state?

In fact, those untouched fields in kernel xsave buf "IS GUARANTEED" to be in
the init state.

Please check __sanitize_i387_state() called just before copy_to_user_xstate().
That functions GUARANTEES the untouched fields in kernel xsave buf to be in
init state.

Thanks.

-Fenghua