Message ID | 20201119190237.626-2-chang.seok.bae@intel.com |
---|---|
State | New |
Headers | show |
Series | x86: Improve Minimum Alternate Stack Size | expand |
On Thu, Nov 19, 2020 at 11:02:34AM -0800, Chang S. Bae wrote: > Signal frames do not have a fixed format and can vary in size when a number > of things change: support XSAVE features, 32 vs. 64-bit apps. Add the code > to support a runtime method for userspace to dynamically discover how large > a signal stack needs to be. > > Introduce a new variable, max_frame_size, and helper functions for the > calculation to be used in a new user interface. Set max_frame_size to a > system-wide worst-case value, instead of storing multiple app-specific > values. > > Locate the body of the helper function -- fpu__get_fpstate_sigframe_size() > in fpu/signal.c for its relevance. This sentence is strange and not needed. > diff --git a/arch/x86/include/asm/sigframe.h b/arch/x86/include/asm/sigframe.h > index 84eab2724875..ac77f3f90bc9 100644 > --- a/arch/x86/include/asm/sigframe.h > +++ b/arch/x86/include/asm/sigframe.h > @@ -52,6 +52,15 @@ struct rt_sigframe_ia32 { > char retcode[8]; > /* fp state follows here */ > }; > + > +#define SIZEOF_sigframe_ia32 sizeof(struct sigframe_ia32) > +#define SIZEOF_rt_sigframe_ia32 sizeof(struct rt_sigframe_ia32) > + > +#else > + > +#define SIZEOF_sigframe_ia32 0 > +#define SIZEOF_rt_sigframe_ia32 0 > + > #endif /* defined(CONFIG_X86_32) || defined(CONFIG_IA32_EMULATION) */ > > #ifdef CONFIG_X86_64 > @@ -81,8 +90,22 @@ struct rt_sigframe_x32 { > /* fp state follows here */ > }; > > +#define SIZEOF_rt_sigframe_x32 sizeof(struct rt_sigframe_x32) > + > #endif /* CONFIG_X86_X32_ABI */ > > +#define SIZEOF_rt_sigframe sizeof(struct rt_sigframe) > + > +#else > + > +#define SIZEOF_rt_sigframe 0 > + > #endif /* CONFIG_X86_64 */ > > +#ifndef SIZEOF_rt_sigframe_x32 > +#define SIZEOF_rt_sigframe_x32 0 > +#endif Those are defined here to be used in only one place - init_sigframe_size() - where there already is ifdeffery. Just use the normal sizeof() operator there instead of adding more gunk here. > diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c > index a4ec65317a7f..9f009525f551 100644 > --- a/arch/x86/kernel/fpu/signal.c > +++ b/arch/x86/kernel/fpu/signal.c > @@ -507,6 +507,26 @@ fpu__alloc_mathframe(unsigned long sp, int ia32_frame, > > return sp; > } > + > +unsigned long fpu__get_fpstate_sigframe_size(void) > +{ > + unsigned long xstate_size = xstate_sigframe_size(); > + unsigned long fsave_header_size = 0; > + > + /* > + * This space is needed on (most) 32-bit kernels, or when a 32-bit > + * app is running on a 64-bit kernel. To keep things simple, just > + * assume the worst case and always include space for 'freg_state', > + * even for 64-bit apps on 64-bit kernels. This wastes a bit of > + * space, but keeps the code simple. > + */ > + if ((IS_ENABLED(CONFIG_IA32_EMULATION) || > + IS_ENABLED(CONFIG_X86_32)) && use_fxsr()) > + fsave_header_size = sizeof(struct fregs_state); > + > + return fsave_header_size + xstate_size; > +} I guess this can be simplified to: unsigned long fpu__get_fpstate_sigframe_size(void) { unsigned long ret = xstate_sigframe_size(); /* * This space is needed on (most) 32-bit kernels, or when a 32-bit * app is running on a 64-bit kernel. To keep things simple, just * assume the worst case and always include space for 'freg_state', * even for 64-bit apps on 64-bit kernels. This wastes a bit of * space, but keeps the code simple. */ if ((IS_ENABLED(CONFIG_IA32_EMULATION) || IS_ENABLED(CONFIG_X86_32)) && use_fxsr()) ret += sizeof(struct fregs_state); return ret; } Also, this function simply gives you the xstate size, there's no need for "sigframe" in the name.
> On Nov 25, 2020, at 20:17, Borislav Petkov <bp@alien8.de> wrote: > > On Thu, Nov 19, 2020 at 11:02:34AM -0800, Chang S. Bae wrote: >> diff --git a/arch/x86/include/asm/sigframe.h b/arch/x86/include/asm/sigframe.h >> index 84eab2724875..ac77f3f90bc9 100644 >> --- a/arch/x86/include/asm/sigframe.h >> +++ b/arch/x86/include/asm/sigframe.h >> @@ -52,6 +52,15 @@ struct rt_sigframe_ia32 { >> char retcode[8]; >> /* fp state follows here */ >> }; >> + >> +#define SIZEOF_sigframe_ia32 sizeof(struct sigframe_ia32) >> +#define SIZEOF_rt_sigframe_ia32 sizeof(struct rt_sigframe_ia32) >> + >> +#else >> + >> +#define SIZEOF_sigframe_ia32 0 >> +#define SIZEOF_rt_sigframe_ia32 0 >> + >> #endif /* defined(CONFIG_X86_32) || defined(CONFIG_IA32_EMULATION) */ >> >> #ifdef CONFIG_X86_64 >> @@ -81,8 +90,22 @@ struct rt_sigframe_x32 { >> /* fp state follows here */ >> }; >> >> +#define SIZEOF_rt_sigframe_x32 sizeof(struct rt_sigframe_x32) >> + >> #endif /* CONFIG_X86_X32_ABI */ >> >> +#define SIZEOF_rt_sigframe sizeof(struct rt_sigframe) >> + >> +#else >> + >> +#define SIZEOF_rt_sigframe 0 >> + >> #endif /* CONFIG_X86_64 */ >> >> +#ifndef SIZEOF_rt_sigframe_x32 >> +#define SIZEOF_rt_sigframe_x32 0 >> +#endif > > Those are defined here to be used in only one place - > init_sigframe_size() - where there already is ifdeffery. Just use the > normal sizeof() operator there instead of adding more gunk here. [ Just want to clarify your comment. ] Admittedly, this is an (ugly) workaround to avoid compile errors. E.g. when code is written like this in the function: if (IS_ENABLED(CONFIG_X86_X32_ABI)) size = max(size, sizeof(struct rt_sigframe_x32)); and compile with CONFIG_X86_X32_ABI=n, got such a message: "invalid application of 'sizeof' to incomplete type 'struct sigframe_ia32’" While the coding-style doc [1] seems to mention this: "However, this approach still allows the C compiler to see the code inside the block, and check it for correctness (syntax, types, symbol references, etc). Thus, you still have to use an #ifdef if the code inside the block references symbols that will not exist if the condition is not met.” In general, putting #ifdef in a C file is advised to avoid. I wonder whether it is okay to include #ifdef in the C file in this case. Thanks, Chang [1] https://www.kernel.org/doc/html/v5.9/process/coding-style.html
On Mon, Nov 30, 2020 at 08:40:32PM +0000, Bae, Chang Seok wrote: > In general, putting #ifdef in a C file is advised to avoid. Well, in this case it is arguably better to have the ifdeffery there, where it is being used. > I wonder whether it is okay to include #ifdef in the C file in this > case. Yes, it's not like this will be the only place where you have #ifdef in a .c file: [ ~/kernel/linux> git grep "#ifdef" *.c | wc -l 29401
diff --git a/arch/x86/include/asm/fpu/signal.h b/arch/x86/include/asm/fpu/signal.h index 7fb516b6893a..5bfbf8f2e5a3 100644 --- a/arch/x86/include/asm/fpu/signal.h +++ b/arch/x86/include/asm/fpu/signal.h @@ -29,6 +29,8 @@ unsigned long fpu__alloc_mathframe(unsigned long sp, int ia32_frame, unsigned long *buf_fx, unsigned long *size); +unsigned long fpu__get_fpstate_sigframe_size(void); + extern void fpu__init_prepare_fx_sw_frame(void); #endif /* _ASM_X86_FPU_SIGNAL_H */ diff --git a/arch/x86/include/asm/sigframe.h b/arch/x86/include/asm/sigframe.h index 84eab2724875..ac77f3f90bc9 100644 --- a/arch/x86/include/asm/sigframe.h +++ b/arch/x86/include/asm/sigframe.h @@ -52,6 +52,15 @@ struct rt_sigframe_ia32 { char retcode[8]; /* fp state follows here */ }; + +#define SIZEOF_sigframe_ia32 sizeof(struct sigframe_ia32) +#define SIZEOF_rt_sigframe_ia32 sizeof(struct rt_sigframe_ia32) + +#else + +#define SIZEOF_sigframe_ia32 0 +#define SIZEOF_rt_sigframe_ia32 0 + #endif /* defined(CONFIG_X86_32) || defined(CONFIG_IA32_EMULATION) */ #ifdef CONFIG_X86_64 @@ -81,8 +90,22 @@ struct rt_sigframe_x32 { /* fp state follows here */ }; +#define SIZEOF_rt_sigframe_x32 sizeof(struct rt_sigframe_x32) + #endif /* CONFIG_X86_X32_ABI */ +#define SIZEOF_rt_sigframe sizeof(struct rt_sigframe) + +#else + +#define SIZEOF_rt_sigframe 0 + #endif /* CONFIG_X86_64 */ +#ifndef SIZEOF_rt_sigframe_x32 +#define SIZEOF_rt_sigframe_x32 0 +#endif + +void __init init_sigframe_size(void); + #endif /* _ASM_X86_SIGFRAME_H */ diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 35ad8480c464..6954932272d5 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -58,6 +58,7 @@ #include <asm/intel-family.h> #include <asm/cpu_device_id.h> #include <asm/uv/uv.h> +#include <asm/sigframe.h> #include "cpu.h" @@ -1331,6 +1332,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) fpu__init_system(c); + init_sigframe_size(); + #ifdef CONFIG_X86_32 /* * Regardless of whether PCID is enumerated, the SDM says diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c index a4ec65317a7f..9f009525f551 100644 --- a/arch/x86/kernel/fpu/signal.c +++ b/arch/x86/kernel/fpu/signal.c @@ -507,6 +507,26 @@ fpu__alloc_mathframe(unsigned long sp, int ia32_frame, return sp; } + +unsigned long fpu__get_fpstate_sigframe_size(void) +{ + unsigned long xstate_size = xstate_sigframe_size(); + unsigned long fsave_header_size = 0; + + /* + * This space is needed on (most) 32-bit kernels, or when a 32-bit + * app is running on a 64-bit kernel. To keep things simple, just + * assume the worst case and always include space for 'freg_state', + * even for 64-bit apps on 64-bit kernels. This wastes a bit of + * space, but keeps the code simple. + */ + if ((IS_ENABLED(CONFIG_IA32_EMULATION) || + IS_ENABLED(CONFIG_X86_32)) && use_fxsr()) + fsave_header_size = sizeof(struct fregs_state); + + return fsave_header_size + xstate_size; +} + /* * Prepare the SW reserved portion of the fxsave memory layout, indicating * the presence of the extended state information in the memory layout diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index be0d7d4152ec..bae35ff6e744 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -212,6 +212,11 @@ do { \ * Set up a signal frame. */ +/* x86 ABI requires 16-byte alignment */ +#define FRAME_ALIGNMENT 16UL + +#define MAX_FRAME_PADDING (FRAME_ALIGNMENT - 1) + /* * Determine which stack to use.. */ @@ -222,9 +227,9 @@ static unsigned long align_sigframe(unsigned long sp) * Align the stack pointer according to the i386 ABI, * i.e. so that on function entry ((sp + 4) & 15) == 0. */ - sp = ((sp + 4) & -16ul) - 4; + sp = ((sp + 4) & -FRAME_ALIGNMENT) - 4; #else /* !CONFIG_X86_32 */ - sp = round_down(sp, 16) - 8; + sp = round_down(sp, FRAME_ALIGNMENT) - 8; #endif return sp; } @@ -663,6 +668,58 @@ SYSCALL_DEFINE0(rt_sigreturn) return 0; } +/* + * The FP state frame contains an XSAVE buffer which must be 64-byte aligned. + * If a signal frame starts at an unaligned address, extra space is required. + * This is the max alignment padding, conservatively. + */ +#define MAX_XSAVE_PADDING 63UL + +/* + * The frame data is composed of the following areas and laid out as: + * + * ------------------------- + * | alignment padding | + * ------------------------- + * | (f)xsave frame | + * ------------------------- + * | fsave header | + * ------------------------- + * | alignment padding | + * ------------------------- + * | siginfo + ucontext | + * ------------------------- + */ + +/* max_frame_size tells userspace the worst case signal stack size. */ +static unsigned long __ro_after_init max_frame_size; + +void __init init_sigframe_size(void) +{ + /* + * Use the largest of possible structure formats. This might + * slightly oversize the frame for 64-bit apps. + */ + + if (IS_ENABLED(CONFIG_X86_32) || + IS_ENABLED(CONFIG_IA32_EMULATION)) + max_frame_size = max((unsigned long)SIZEOF_sigframe_ia32, + (unsigned long)SIZEOF_rt_sigframe_ia32); + + if (IS_ENABLED(CONFIG_X86_X32_ABI)) + max_frame_size = max(max_frame_size, (unsigned long)SIZEOF_rt_sigframe_x32); + + if (IS_ENABLED(CONFIG_X86_64)) + max_frame_size = max(max_frame_size, (unsigned long)SIZEOF_rt_sigframe); + + max_frame_size += MAX_FRAME_PADDING; + + max_frame_size += fpu__get_fpstate_sigframe_size() + MAX_XSAVE_PADDING; + + /* Userspace expects an aligned size. */ + max_frame_size = round_up(max_frame_size, FRAME_ALIGNMENT); +} + static inline int is_ia32_compat_frame(struct ksignal *ksig) { return IS_ENABLED(CONFIG_IA32_EMULATION) &&