Bug 22641 - Merge error in x86 XSAVE dynamic linker trampoline commit in 2.23
Summary: Merge error in x86 XSAVE dynamic linker trampoline commit in 2.23
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: 2.23
: P2 normal
Target Milestone: 2.23
Assignee: Florian Weimer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-12-21 20:08 UTC by Florian Weimer
Modified: 2018-03-31 12:40 UTC (History)
1 user (show)

See Also:
Host:
Target: x86
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Weimer 2017-12-21 20:08:17 UTC
The check for the availability of XSAVE is incorrectly nested under that for AVX YMM registers:

    185   /* Can we call xgetbv?  */
    186   if (HAS_CPU_FEATURE (OSXSAVE))
    187     {
    188       unsigned int xcrlow;
    189       unsigned int xcrhigh;
    190       asm ("xgetbv" : "=a" (xcrlow), "=d" (xcrhigh) : "c" (0));
    191       /* Is YMM and XMM state usable?  */
    192       if ((xcrlow & (bit_YMM_state | bit_XMM_state)) ==
    193           (bit_YMM_state | bit_XMM_state))
    194         {
    195           /* Determine if AVX is usable.  */
    196           if (HAS_CPU_FEATURE (AVX))
…
    230           /* For _dl_runtime_resolve, set xsave_state_size to xsave area
    231              size + integer register save size and align it to 64 bytes.  */
    232           if (cpu_features->max_cpuid >= 0xd)
    233             {
    234               unsigned int eax, ebx, ecx, edx;
    235 
    236               __cpuid_count (0xd, 0, eax, ebx, ecx, edx);
    237               if (ebx != 0)
    238                 {
    239                   cpu_features->xsave_state_size
    240                 = ALIGN_UP (ebx + STATE_SAVE_OFFSET, 64);

As far as I can see, this only affects the 2.23 release branch.

We are still investigating the practical impact of this change (without AVX, FXSAVE should be good enough, unless the configuration is very special and MPX or pkeys support is present).
Comment 1 Sourceware Commits 2018-01-11 15:56:22 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.23/master has been updated
       via  fbd72f14904b8a81816528e0cc5bb3315fc70a47 (commit)
      from  26d289bb92b6d1125536644f607c73617463477d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=fbd72f14904b8a81816528e0cc5bb3315fc70a47

commit fbd72f14904b8a81816528e0cc5bb3315fc70a47
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Jan 11 16:54:40 2018 +0100

    x86: Fix mis-merge of XSAVE ld.so trampoline selection [BZ #22641]
    
    The change is best viewed with “diff -w”:
    
    @@ -226,6 +226,7 @@ init_cpu_features (struct cpu_features *cpu_features)
     	  /* Determine if FMA4 is usable.  */
     	  if (HAS_CPU_FEATURE (FMA4))
     	    cpu_features->feature[index_FMA4_Usable] |= bit_FMA4_Usable;
    +	}
    
           /* For _dl_runtime_resolve, set xsave_state_size to xsave area
     	 size + integer register save size and align it to 64 bytes.  */
    @@ -292,7 +293,6 @@ init_cpu_features (struct cpu_features *cpu_features)
     	    }
     	}
         }
    -    }
    
     #if !HAS_CPUID
     no_cpuid:
    
    Without this change, XSAVE support will never be selected unless the CPU
    also supports AVX, which is not what we want.  For example, if AVX is
    disabled, but MPX is supported, the BND registers are not preserved if
    we use FXSAVE instead of XSAVE.
    
    This fixes commit 26d289bb92b6d1125536644f607c73617463477d (x86-64:
    Use fxsave/xsave/xsavec in _dl_runtime_resolve).

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                  |    5 ++
 NEWS                       |    1 +
 sysdeps/x86/cpu-features.c |  100 ++++++++++++++++++++++----------------------
 3 files changed, 56 insertions(+), 50 deletions(-)
Comment 2 Florian Weimer 2018-01-11 15:58:05 UTC
Fixed on the 2.23 release branch, which is the only one affected by this issue.