1 | // SPDX-License-Identifier: GPL-2.0 |
2 | // Copyright(c) 2018 Linus Torvalds. All rights reserved. |
3 | // Copyright(c) 2018 Alexei Starovoitov. All rights reserved. |
4 | // Copyright(c) 2018 Intel Corporation. All rights reserved. |
5 | |
6 | #ifndef _LINUX_NOSPEC_H |
7 | #define _LINUX_NOSPEC_H |
8 | #include <asm/barrier.h> |
9 | |
10 | struct task_struct; |
11 | |
12 | /** |
13 | * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise |
14 | * @index: array element index |
15 | * @size: number of elements in array |
16 | * |
17 | * When @index is out of bounds (@index >= @size), the sign bit will be |
18 | * set. Extend the sign bit to all bits and invert, giving a result of |
19 | * zero for an out of bounds index, or ~0 if within bounds [0, @size). |
20 | */ |
21 | #ifndef array_index_mask_nospec |
22 | static inline unsigned long array_index_mask_nospec(unsigned long index, |
23 | unsigned long size) |
24 | { |
25 | /* |
26 | * Always calculate and emit the mask even if the compiler |
27 | * thinks the mask is not needed. The compiler does not take |
28 | * into account the value of @index under speculation. |
29 | */ |
30 | OPTIMIZER_HIDE_VAR(index); |
31 | return ~(long)(index | (size - 1UL - index)) >> (BITS_PER_LONG - 1); |
32 | } |
33 | #endif |
34 | |
35 | /* |
36 | * array_index_nospec - sanitize an array index after a bounds check |
37 | * |
38 | * For a code sequence like: |
39 | * |
40 | * if (index < size) { |
41 | * index = array_index_nospec(index, size); |
42 | * val = array[index]; |
43 | * } |
44 | * |
45 | * ...if the CPU speculates past the bounds check then |
46 | * array_index_nospec() will clamp the index within the range of [0, |
47 | * size). |
48 | */ |
49 | #define array_index_nospec(index, size) \ |
50 | ({ \ |
51 | typeof(index) _i = (index); \ |
52 | typeof(size) _s = (size); \ |
53 | unsigned long _mask = array_index_mask_nospec(_i, _s); \ |
54 | \ |
55 | BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ |
56 | BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ |
57 | \ |
58 | (typeof(_i)) (_i & _mask); \ |
59 | }) |
60 | |
61 | /* Speculation control prctl */ |
62 | int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which); |
63 | int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, |
64 | unsigned long ctrl); |
65 | /* Speculation control for seccomp enforced mitigation */ |
66 | void arch_seccomp_spec_mitigate(struct task_struct *task); |
67 | |
68 | #endif /* _LINUX_NOSPEC_H */ |
69 | |