1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _ASM_X86_MMU_CONTEXT_H
3#define _ASM_X86_MMU_CONTEXT_H
4
5#include <asm/desc.h>
6#include <linux/atomic.h>
7#include <linux/mm_types.h>
8#include <linux/pkeys.h>
9
10#include <trace/events/tlb.h>
11
12#include <asm/pgalloc.h>
13#include <asm/tlbflush.h>
14#include <asm/paravirt.h>
15#include <asm/mpx.h>
16
17extern atomic64_t last_mm_ctx_id;
18
19#ifndef CONFIG_PARAVIRT_XXL
20static inline void paravirt_activate_mm(struct mm_struct *prev,
21 struct mm_struct *next)
22{
23}
24#endif /* !CONFIG_PARAVIRT_XXL */
25
26#ifdef CONFIG_PERF_EVENTS
27
28DECLARE_STATIC_KEY_FALSE(rdpmc_always_available_key);
29
30static inline void load_mm_cr4(struct mm_struct *mm)
31{
32 if (static_branch_unlikely(&rdpmc_always_available_key) ||
33 atomic_read(&mm->context.perf_rdpmc_allowed))
34 cr4_set_bits(X86_CR4_PCE);
35 else
36 cr4_clear_bits(X86_CR4_PCE);
37}
38#else
39static inline void load_mm_cr4(struct mm_struct *mm) {}
40#endif
41
42#ifdef CONFIG_MODIFY_LDT_SYSCALL
43/*
44 * ldt_structs can be allocated, used, and freed, but they are never
45 * modified while live.
46 */
47struct ldt_struct {
48 /*
49 * Xen requires page-aligned LDTs with special permissions. This is
50 * needed to prevent us from installing evil descriptors such as
51 * call gates. On native, we could merge the ldt_struct and LDT
52 * allocations, but it's not worth trying to optimize.
53 */
54 struct desc_struct *entries;
55 unsigned int nr_entries;
56
57 /*
58 * If PTI is in use, then the entries array is not mapped while we're
59 * in user mode. The whole array will be aliased at the addressed
60 * given by ldt_slot_va(slot). We use two slots so that we can allocate
61 * and map, and enable a new LDT without invalidating the mapping
62 * of an older, still-in-use LDT.
63 *
64 * slot will be -1 if this LDT doesn't have an alias mapping.
65 */
66 int slot;
67};
68
69/* This is a multiple of PAGE_SIZE. */
70#define LDT_SLOT_STRIDE (LDT_ENTRIES * LDT_ENTRY_SIZE)
71
72static inline void *ldt_slot_va(int slot)
73{
74 return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
75}
76
77/*
78 * Used for LDT copy/destruction.
79 */
80static inline void init_new_context_ldt(struct mm_struct *mm)
81{
82 mm->context.ldt = NULL;
83 init_rwsem(&mm->context.ldt_usr_sem);
84}
85int ldt_dup_context(struct mm_struct *oldmm, struct mm_struct *mm);
86void destroy_context_ldt(struct mm_struct *mm);
87void ldt_arch_exit_mmap(struct mm_struct *mm);
88#else /* CONFIG_MODIFY_LDT_SYSCALL */
89static inline void init_new_context_ldt(struct mm_struct *mm) { }
90static inline int ldt_dup_context(struct mm_struct *oldmm,
91 struct mm_struct *mm)
92{
93 return 0;
94}
95static inline void destroy_context_ldt(struct mm_struct *mm) { }
96static inline void ldt_arch_exit_mmap(struct mm_struct *mm) { }
97#endif
98
99static inline void load_mm_ldt(struct mm_struct *mm)
100{
101#ifdef CONFIG_MODIFY_LDT_SYSCALL
102 struct ldt_struct *ldt;
103
104 /* READ_ONCE synchronizes with smp_store_release */
105 ldt = READ_ONCE(mm->context.ldt);
106
107 /*
108 * Any change to mm->context.ldt is followed by an IPI to all
109 * CPUs with the mm active. The LDT will not be freed until
110 * after the IPI is handled by all such CPUs. This means that,
111 * if the ldt_struct changes before we return, the values we see
112 * will be safe, and the new values will be loaded before we run
113 * any user code.
114 *
115 * NB: don't try to convert this to use RCU without extreme care.
116 * We would still need IRQs off, because we don't want to change
117 * the local LDT after an IPI loaded a newer value than the one
118 * that we can see.
119 */
120
121 if (unlikely(ldt)) {
122 if (static_cpu_has(X86_FEATURE_PTI)) {
123 if (WARN_ON_ONCE((unsigned long)ldt->slot > 1)) {
124 /*
125 * Whoops -- either the new LDT isn't mapped
126 * (if slot == -1) or is mapped into a bogus
127 * slot (if slot > 1).
128 */
129 clear_LDT();
130 return;
131 }
132
133 /*
134 * If page table isolation is enabled, ldt->entries
135 * will not be mapped in the userspace pagetables.
136 * Tell the CPU to access the LDT through the alias
137 * at ldt_slot_va(ldt->slot).
138 */
139 set_ldt(ldt_slot_va(ldt->slot), ldt->nr_entries);
140 } else {
141 set_ldt(ldt->entries, ldt->nr_entries);
142 }
143 } else {
144 clear_LDT();
145 }
146#else
147 clear_LDT();
148#endif
149}
150
151static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next)
152{
153#ifdef CONFIG_MODIFY_LDT_SYSCALL
154 /*
155 * Load the LDT if either the old or new mm had an LDT.
156 *
157 * An mm will never go from having an LDT to not having an LDT. Two
158 * mms never share an LDT, so we don't gain anything by checking to
159 * see whether the LDT changed. There's also no guarantee that
160 * prev->context.ldt actually matches LDTR, but, if LDTR is non-NULL,
161 * then prev->context.ldt will also be non-NULL.
162 *
163 * If we really cared, we could optimize the case where prev == next
164 * and we're exiting lazy mode. Most of the time, if this happens,
165 * we don't actually need to reload LDTR, but modify_ldt() is mostly
166 * used by legacy code and emulators where we don't need this level of
167 * performance.
168 *
169 * This uses | instead of || because it generates better code.
170 */
171 if (unlikely((unsigned long)prev->context.ldt |
172 (unsigned long)next->context.ldt))
173 load_mm_ldt(next);
174#endif
175
176 DEBUG_LOCKS_WARN_ON(preemptible());
177}
178
179void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);
180
181/*
182 * Init a new mm. Used on mm copies, like at fork()
183 * and on mm's that are brand-new, like at execve().
184 */
185static inline int init_new_context(struct task_struct *tsk,
186 struct mm_struct *mm)
187{
188 mutex_init(&mm->context.lock);
189
190 mm->context.ctx_id = atomic64_inc_return(&last_mm_ctx_id);
191 atomic64_set(&mm->context.tlb_gen, 0);
192
193#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
194 if (cpu_feature_enabled(X86_FEATURE_OSPKE)) {
195 /* pkey 0 is the default and allocated implicitly */
196 mm->context.pkey_allocation_map = 0x1;
197 /* -1 means unallocated or invalid */
198 mm->context.execute_only_pkey = -1;
199 }
200#endif
201 init_new_context_ldt(mm);
202 return 0;
203}
204static inline void destroy_context(struct mm_struct *mm)
205{
206 destroy_context_ldt(mm);
207}
208
209extern void switch_mm(struct mm_struct *prev, struct mm_struct *next,
210 struct task_struct *tsk);
211
212extern void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
213 struct task_struct *tsk);
214#define switch_mm_irqs_off switch_mm_irqs_off
215
216#define activate_mm(prev, next) \
217do { \
218 paravirt_activate_mm((prev), (next)); \
219 switch_mm((prev), (next), NULL); \
220} while (0);
221
222#ifdef CONFIG_X86_32
223#define deactivate_mm(tsk, mm) \
224do { \
225 lazy_load_gs(0); \
226} while (0)
227#else
228#define deactivate_mm(tsk, mm) \
229do { \
230 load_gs_index(0); \
231 loadsegment(fs, 0); \
232} while (0)
233#endif
234
235static inline void arch_dup_pkeys(struct mm_struct *oldmm,
236 struct mm_struct *mm)
237{
238#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
239 if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
240 return;
241
242 /* Duplicate the oldmm pkey state in mm: */
243 mm->context.pkey_allocation_map = oldmm->context.pkey_allocation_map;
244 mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
245#endif
246}
247
248static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
249{
250 arch_dup_pkeys(oldmm, mm);
251 paravirt_arch_dup_mmap(oldmm, mm);
252 return ldt_dup_context(oldmm, mm);
253}
254
255static inline void arch_exit_mmap(struct mm_struct *mm)
256{
257 paravirt_arch_exit_mmap(mm);
258 ldt_arch_exit_mmap(mm);
259}
260
261#ifdef CONFIG_X86_64
262static inline bool is_64bit_mm(struct mm_struct *mm)
263{
264 return !IS_ENABLED(CONFIG_IA32_EMULATION) ||
265 !(mm->context.ia32_compat == TIF_IA32);
266}
267#else
268static inline bool is_64bit_mm(struct mm_struct *mm)
269{
270 return false;
271}
272#endif
273
274static inline void arch_bprm_mm_init(struct mm_struct *mm,
275 struct vm_area_struct *vma)
276{
277 mpx_mm_init(mm);
278}
279
280static inline void arch_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
281 unsigned long start, unsigned long end)
282{
283 /*
284 * mpx_notify_unmap() goes and reads a rarely-hot
285 * cacheline in the mm_struct. That can be expensive
286 * enough to be seen in profiles.
287 *
288 * The mpx_notify_unmap() call and its contents have been
289 * observed to affect munmap() performance on hardware
290 * where MPX is not present.
291 *
292 * The unlikely() optimizes for the fast case: no MPX
293 * in the CPU, or no MPX use in the process. Even if
294 * we get this wrong (in the unlikely event that MPX
295 * is widely enabled on some system) the overhead of
296 * MPX itself (reading bounds tables) is expected to
297 * overwhelm the overhead of getting this unlikely()
298 * consistently wrong.
299 */
300 if (unlikely(cpu_feature_enabled(X86_FEATURE_MPX)))
301 mpx_notify_unmap(mm, vma, start, end);
302}
303
304/*
305 * We only want to enforce protection keys on the current process
306 * because we effectively have no access to PKRU for other
307 * processes or any way to tell *which * PKRU in a threaded
308 * process we could use.
309 *
310 * So do not enforce things if the VMA is not from the current
311 * mm, or if we are in a kernel thread.
312 */
313static inline bool vma_is_foreign(struct vm_area_struct *vma)
314{
315 if (!current->mm)
316 return true;
317 /*
318 * Should PKRU be enforced on the access to this VMA? If
319 * the VMA is from another process, then PKRU has no
320 * relevance and should not be enforced.
321 */
322 if (current->mm != vma->vm_mm)
323 return true;
324
325 return false;
326}
327
328static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
329 bool write, bool execute, bool foreign)
330{
331 /* pkeys never affect instruction fetches */
332 if (execute)
333 return true;
334 /* allow access if the VMA is not one from this process */
335 if (foreign || vma_is_foreign(vma))
336 return true;
337 return __pkru_allows_pkey(vma_pkey(vma), write);
338}
339
340/*
341 * This can be used from process context to figure out what the value of
342 * CR3 is without needing to do a (slow) __read_cr3().
343 *
344 * It's intended to be used for code like KVM that sneakily changes CR3
345 * and needs to restore it. It needs to be used very carefully.
346 */
347static inline unsigned long __get_current_cr3_fast(void)
348{
349 unsigned long cr3 = build_cr3(this_cpu_read(cpu_tlbstate.loaded_mm)->pgd,
350 this_cpu_read(cpu_tlbstate.loaded_mm_asid));
351
352 /* For now, be very restrictive about when this can be called. */
353 VM_WARN_ON(in_nmi() || preemptible());
354
355 VM_BUG_ON(cr3 != __read_cr3());
356 return cr3;
357}
358
359#endif /* _ASM_X86_MMU_CONTEXT_H */
360