> From: Hansen, Dave > Sent: Wednesday, April 22, 2015 5:35 PM > On 04/22/2015 05:06 PM, Yu, Fenghua wrote: > > We need to copy ALL of supported xstates to user. Using xstate_bv only > > copies partial xstates that are in non-init status. > > > > Xstate_bv only has xstates that are in non-init status. The xstates > > that are in init status will not be copied to user if using xstate_bv. > > In this case, the xstates that are in init status will be all zeros in > > the user buffer (remember we clear the user buffer before). That's > incorrect. > I'm not convinced. Let's step through this. > > 1. kernel does an xsaves > 2. Due to the 'init optimization' xstate_bv != pcntxt_mask, and some > fields of kernel xsave buffer are untouched 3. Kernel looks at pcntxt_mask, > which means it copies untouched xsave > buffer fields out to userspace > > If those untouched fields of the xsave buffer are in the "init state", then > we've got no problem. But, are those "untouched since (1)" fields in the > kernel xsave buf *GUARANTEED* to be in the init state?
In fact, those untouched fields in kernel xsave buf "IS GUARANTEED" to be in the init state. Please check __sanitize_i387_state() called just before copy_to_user_xstate(). That functions GUARANTEES the untouched fields in kernel xsave buf to be in init state. Thanks. -Fenghua
