x86/fpu/xstate: Adjust xstate copying logic for user ABI

== Background ==

As feature positions in the userspace XSAVE buffer do not always align
with their feature numbers, the XSAVE format conversion needs to be
reconsidered to align with the revised xstate size calculation logic.

* For signal handling, XSAVE and XRSTOR are used directly to save and
  restore extended registers.

* For ptrace, KVM, and signal returns (for 32-bit frame), the kernel
  copies data between its internal buffer and the userspace XSAVE buffer.
  If memcpy() were used for these cases, existing offset helpers — such
  as __raw_xsave_addr() or xstate_offsets[] — would be sufficient to
  handle the format conversion.

== Problem ==

When copying data from the compacted in-kernel buffer to the
non-compacted userspace buffer, the function follows the
user_regset_get2_fn() prototype. This means it utilizes struct membuf
helpers for the destination buffer. As defined in regset.h, these helpers
update the memory pointer during the copy process, enforcing sequential
writes within the loop.

Since xstate components are processed sequentially, any component whose
buffer position does not align with its feature number has an issue.

== Solution ==

Replace for_each_extended_xfeature() with the newly introduced
for_each_extended_xfeature_in_order(). This macro ensures xstate
components are handled in the correct order based on their actual
positions in the destination buffer, rather than their feature numbers.

Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/20250320234301.8342-5-chang.seok.bae@intel.com

diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 93f94013b094bf37e956b6c87f813a8a86c66a35..46c45e2f2a5aaac15edc6868d2824ced212f0d62 100644 (file)
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -1107,10 +1107,9 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
        const unsigned int off_mxcsr = offsetof(struct fxregs_state, mxcsr);
        struct xregs_state *xinit = &init_fpstate.regs.xsave;
        struct xregs_state *xsave = &fpstate->regs.xsave;
+       unsigned int zerofrom, i, xfeature;
        struct xstate_header header;
-       unsigned int zerofrom;
        u64 mask;
-       int i;
 
        memset(&header, 0, sizeof(header));
        header.xfeatures = xsave->header.xfeatures;
@@ -1179,15 +1178,16 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
         */
        mask = header.xfeatures;
 
-       for_each_extended_xfeature(i, mask) {
+       for_each_extended_xfeature_in_order(i, mask) {
+               xfeature = xfeature_uncompact_order[i];
                /*
                 * If there was a feature or alignment gap, zero the space
                 * in the destination buffer.
                 */
-               if (zerofrom < xstate_offsets[i])
-                       membuf_zero(&to, xstate_offsets[i] - zerofrom);
+               if (zerofrom < xstate_offsets[xfeature])
+                       membuf_zero(&to, xstate_offsets[xfeature] - zerofrom);
 
-               if (i == XFEATURE_PKRU) {
+               if (xfeature == XFEATURE_PKRU) {
                        struct pkru_state pkru = {0};
                        /*
                         * PKRU is not necessarily up to date in the
@@ -1197,14 +1197,14 @@ void __copy_xstate_to_uabi_buf(struct membuf to, struct fpstate *fpstate,
                        membuf_write(&to, &pkru, sizeof(pkru));
                } else {
                        membuf_write(&to,
-                                    __raw_xsave_addr(xsave, i),
-                                    xstate_sizes[i]);
+                                    __raw_xsave_addr(xsave, xfeature),
+                                    xstate_sizes[xfeature]);
                }
                /*
                 * Keep track of the last copied state in the non-compacted
                 * target buffer for gap zeroing.
                 */
-               zerofrom = xstate_offsets[i] + xstate_sizes[i];
+               zerofrom = xstate_offsets[xfeature] + xstate_sizes[xfeature];
        }
 
 out: