mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-23 00:47:11 +07:00
2c4ea6e28d
Fengguang reported random corruptions from various locations on x86-32 after commitsd2852a2240
("arch: add ARCH_HAS_SET_MEMORY config") and9d876e79df
("bpf: fix unlocking of jited image when module ronx not set") that uses the former. While x86-32 doesn't have a JIT like x86_64, the bpf_prog_lock_ro() and bpf_prog_unlock_ro() got enabled due to ARCH_HAS_SET_MEMORY, whereas Fengguang's test kernel doesn't have module support built in and therefore never had the DEBUG_SET_MODULE_RONX setting enabled. After investigating the crashes further, it turned out that using set_memory_ro() and set_memory_rw() didn't have the desired effect, for example, setting the pages as read-only on x86-32 would still let probe_kernel_write() succeed without error. This behavior would manifest itself in situations where the vmalloc'ed buffer was accessed prior to set_memory_*() such as in case of bpf_prog_alloc(). In cases where it wasn't, the page attribute changes seemed to have taken effect, leading to the conclusion that a TLB invalidate didn't happen. Moreover, it turned out that this issue reproduced with qemu in "-cpu kvm64" mode, but not for "-cpu host". When the issue occurs, change_page_attr_set_clr() did trigger a TLB flush as expected via __flush_tlb_all() through cpa_flush_range(), though. There are 3 variants for issuing a TLB flush: invpcid_flush_all() (depends on CPU feature bits X86_FEATURE_INVPCID, X86_FEATURE_PGE), cr4 based flush (depends on X86_FEATURE_PGE), and cr3 based flush. For "-cpu host" case in my setup, the flush used invpcid_flush_all() variant, whereas for "-cpu kvm64", the flush was cr4 based. Switching the kvm64 case to cr3 manually worked fine, and further investigating the cr4 one turned out that X86_CR4_PGE bit was not set in cr4 register, meaning the __native_flush_tlb_global_irq_disabled() wrote cr4 twice with the same value instead of clearing X86_CR4_PGE in the first write to trigger the flush. It turned out that X86_CR4_PGE was cleared from cr4 during init from lguest_arch_host_init() via adjust_pge(). The X86_FEATURE_PGE bit is also cleared from there due to concerns of using PGE in guest kernel that can lead to hard to trace bugs (seebff672e630
("lguest: documentation V: Host") in init()). The CPU feature bits are cleared in dynamic boot_cpu_data, but they never propagated to __flush_tlb_all() as it uses static_cpu_has() instead of boot_cpu_has() for testing which variant of TLB flushing to use, meaning they still used the old setting of the host kernel. Clearing via setup_clear_cpu_cap(X86_FEATURE_PGE) so this would propagate to static_cpu_has() checks is too late at this point as sections have been patched already, so for now, it seems reasonable to switch back to boot_cpu_has(X86_FEATURE_PGE) as it was prior to commitc109bf9599
("x86/cpufeature: Remove cpu_has_pge"). This lets the TLB flush trigger via cr3 as originally intended, properly makes the new page attributes visible and thus fixes the crashes seen by Fengguang. Fixes:c109bf9599
("x86/cpufeature: Remove cpu_has_pge") Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Cc: bp@suse.de Cc: Kees Cook <keescook@chromium.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: netdev@vger.kernel.org Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: lkp@01.org Cc: Laura Abbott <labbott@redhat.com> Cc: stable@vger.kernel.org Link: http://lkml.kernrl.org/r/20170301125426.l4nf65rx4wahohyl@wfg-t540p.sh.intel.com Link: http://lkml.kernel.org/r/25c41ad9eca164be4db9ad84f768965b7eb19d9e.1489191673.git.daniel@iogearbox.net Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
335 lines
8.1 KiB
C
335 lines
8.1 KiB
C
#ifndef _ASM_X86_TLBFLUSH_H
|
|
#define _ASM_X86_TLBFLUSH_H
|
|
|
|
#include <linux/mm.h>
|
|
#include <linux/sched.h>
|
|
|
|
#include <asm/processor.h>
|
|
#include <asm/cpufeature.h>
|
|
#include <asm/special_insns.h>
|
|
|
|
static inline void __invpcid(unsigned long pcid, unsigned long addr,
|
|
unsigned long type)
|
|
{
|
|
struct { u64 d[2]; } desc = { { pcid, addr } };
|
|
|
|
/*
|
|
* The memory clobber is because the whole point is to invalidate
|
|
* stale TLB entries and, especially if we're flushing global
|
|
* mappings, we don't want the compiler to reorder any subsequent
|
|
* memory accesses before the TLB flush.
|
|
*
|
|
* The hex opcode is invpcid (%ecx), %eax in 32-bit mode and
|
|
* invpcid (%rcx), %rax in long mode.
|
|
*/
|
|
asm volatile (".byte 0x66, 0x0f, 0x38, 0x82, 0x01"
|
|
: : "m" (desc), "a" (type), "c" (&desc) : "memory");
|
|
}
|
|
|
|
#define INVPCID_TYPE_INDIV_ADDR 0
|
|
#define INVPCID_TYPE_SINGLE_CTXT 1
|
|
#define INVPCID_TYPE_ALL_INCL_GLOBAL 2
|
|
#define INVPCID_TYPE_ALL_NON_GLOBAL 3
|
|
|
|
/* Flush all mappings for a given pcid and addr, not including globals. */
|
|
static inline void invpcid_flush_one(unsigned long pcid,
|
|
unsigned long addr)
|
|
{
|
|
__invpcid(pcid, addr, INVPCID_TYPE_INDIV_ADDR);
|
|
}
|
|
|
|
/* Flush all mappings for a given PCID, not including globals. */
|
|
static inline void invpcid_flush_single_context(unsigned long pcid)
|
|
{
|
|
__invpcid(pcid, 0, INVPCID_TYPE_SINGLE_CTXT);
|
|
}
|
|
|
|
/* Flush all mappings, including globals, for all PCIDs. */
|
|
static inline void invpcid_flush_all(void)
|
|
{
|
|
__invpcid(0, 0, INVPCID_TYPE_ALL_INCL_GLOBAL);
|
|
}
|
|
|
|
/* Flush all mappings for all PCIDs except globals. */
|
|
static inline void invpcid_flush_all_nonglobals(void)
|
|
{
|
|
__invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL);
|
|
}
|
|
|
|
#ifdef CONFIG_PARAVIRT
|
|
#include <asm/paravirt.h>
|
|
#else
|
|
#define __flush_tlb() __native_flush_tlb()
|
|
#define __flush_tlb_global() __native_flush_tlb_global()
|
|
#define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
|
|
#endif
|
|
|
|
struct tlb_state {
|
|
#ifdef CONFIG_SMP
|
|
struct mm_struct *active_mm;
|
|
int state;
|
|
#endif
|
|
|
|
/*
|
|
* Access to this CR4 shadow and to H/W CR4 is protected by
|
|
* disabling interrupts when modifying either one.
|
|
*/
|
|
unsigned long cr4;
|
|
};
|
|
DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
|
|
|
|
/* Initialize cr4 shadow for this CPU. */
|
|
static inline void cr4_init_shadow(void)
|
|
{
|
|
this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
|
|
}
|
|
|
|
/* Set in this cpu's CR4. */
|
|
static inline void cr4_set_bits(unsigned long mask)
|
|
{
|
|
unsigned long cr4;
|
|
|
|
cr4 = this_cpu_read(cpu_tlbstate.cr4);
|
|
if ((cr4 | mask) != cr4) {
|
|
cr4 |= mask;
|
|
this_cpu_write(cpu_tlbstate.cr4, cr4);
|
|
__write_cr4(cr4);
|
|
}
|
|
}
|
|
|
|
/* Clear in this cpu's CR4. */
|
|
static inline void cr4_clear_bits(unsigned long mask)
|
|
{
|
|
unsigned long cr4;
|
|
|
|
cr4 = this_cpu_read(cpu_tlbstate.cr4);
|
|
if ((cr4 & ~mask) != cr4) {
|
|
cr4 &= ~mask;
|
|
this_cpu_write(cpu_tlbstate.cr4, cr4);
|
|
__write_cr4(cr4);
|
|
}
|
|
}
|
|
|
|
/* Read the CR4 shadow. */
|
|
static inline unsigned long cr4_read_shadow(void)
|
|
{
|
|
return this_cpu_read(cpu_tlbstate.cr4);
|
|
}
|
|
|
|
/*
|
|
* Save some of cr4 feature set we're using (e.g. Pentium 4MB
|
|
* enable and PPro Global page enable), so that any CPU's that boot
|
|
* up after us can get the correct flags. This should only be used
|
|
* during boot on the boot cpu.
|
|
*/
|
|
extern unsigned long mmu_cr4_features;
|
|
extern u32 *trampoline_cr4_features;
|
|
|
|
static inline void cr4_set_bits_and_update_boot(unsigned long mask)
|
|
{
|
|
mmu_cr4_features |= mask;
|
|
if (trampoline_cr4_features)
|
|
*trampoline_cr4_features = mmu_cr4_features;
|
|
cr4_set_bits(mask);
|
|
}
|
|
|
|
static inline void __native_flush_tlb(void)
|
|
{
|
|
/*
|
|
* If current->mm == NULL then we borrow a mm which may change during a
|
|
* task switch and therefore we must not be preempted while we write CR3
|
|
* back:
|
|
*/
|
|
preempt_disable();
|
|
native_write_cr3(native_read_cr3());
|
|
preempt_enable();
|
|
}
|
|
|
|
static inline void __native_flush_tlb_global_irq_disabled(void)
|
|
{
|
|
unsigned long cr4;
|
|
|
|
cr4 = this_cpu_read(cpu_tlbstate.cr4);
|
|
/* clear PGE */
|
|
native_write_cr4(cr4 & ~X86_CR4_PGE);
|
|
/* write old PGE again and flush TLBs */
|
|
native_write_cr4(cr4);
|
|
}
|
|
|
|
static inline void __native_flush_tlb_global(void)
|
|
{
|
|
unsigned long flags;
|
|
|
|
if (static_cpu_has(X86_FEATURE_INVPCID)) {
|
|
/*
|
|
* Using INVPCID is considerably faster than a pair of writes
|
|
* to CR4 sandwiched inside an IRQ flag save/restore.
|
|
*/
|
|
invpcid_flush_all();
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* Read-modify-write to CR4 - protect it from preemption and
|
|
* from interrupts. (Use the raw variant because this code can
|
|
* be called from deep inside debugging code.)
|
|
*/
|
|
raw_local_irq_save(flags);
|
|
|
|
__native_flush_tlb_global_irq_disabled();
|
|
|
|
raw_local_irq_restore(flags);
|
|
}
|
|
|
|
static inline void __native_flush_tlb_single(unsigned long addr)
|
|
{
|
|
asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
|
|
}
|
|
|
|
static inline void __flush_tlb_all(void)
|
|
{
|
|
if (boot_cpu_has(X86_FEATURE_PGE))
|
|
__flush_tlb_global();
|
|
else
|
|
__flush_tlb();
|
|
}
|
|
|
|
static inline void __flush_tlb_one(unsigned long addr)
|
|
{
|
|
count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
|
|
__flush_tlb_single(addr);
|
|
}
|
|
|
|
#define TLB_FLUSH_ALL -1UL
|
|
|
|
/*
|
|
* TLB flushing:
|
|
*
|
|
* - flush_tlb() flushes the current mm struct TLBs
|
|
* - flush_tlb_all() flushes all processes TLBs
|
|
* - flush_tlb_mm(mm) flushes the specified mm context TLB's
|
|
* - flush_tlb_page(vma, vmaddr) flushes one page
|
|
* - flush_tlb_range(vma, start, end) flushes a range of pages
|
|
* - flush_tlb_kernel_range(start, end) flushes a range of kernel pages
|
|
* - flush_tlb_others(cpumask, mm, start, end) flushes TLBs on other cpus
|
|
*
|
|
* ..but the i386 has somewhat limited tlb flushing capabilities,
|
|
* and page-granular flushes are available only on i486 and up.
|
|
*/
|
|
|
|
#ifndef CONFIG_SMP
|
|
|
|
/* "_up" is for UniProcessor.
|
|
*
|
|
* This is a helper for other header functions. *Not* intended to be called
|
|
* directly. All global TLB flushes need to either call this, or to bump the
|
|
* vm statistics themselves.
|
|
*/
|
|
static inline void __flush_tlb_up(void)
|
|
{
|
|
count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL);
|
|
__flush_tlb();
|
|
}
|
|
|
|
static inline void flush_tlb_all(void)
|
|
{
|
|
count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL);
|
|
__flush_tlb_all();
|
|
}
|
|
|
|
static inline void flush_tlb(void)
|
|
{
|
|
__flush_tlb_up();
|
|
}
|
|
|
|
static inline void local_flush_tlb(void)
|
|
{
|
|
__flush_tlb_up();
|
|
}
|
|
|
|
static inline void flush_tlb_mm(struct mm_struct *mm)
|
|
{
|
|
if (mm == current->active_mm)
|
|
__flush_tlb_up();
|
|
}
|
|
|
|
static inline void flush_tlb_page(struct vm_area_struct *vma,
|
|
unsigned long addr)
|
|
{
|
|
if (vma->vm_mm == current->active_mm)
|
|
__flush_tlb_one(addr);
|
|
}
|
|
|
|
static inline void flush_tlb_range(struct vm_area_struct *vma,
|
|
unsigned long start, unsigned long end)
|
|
{
|
|
if (vma->vm_mm == current->active_mm)
|
|
__flush_tlb_up();
|
|
}
|
|
|
|
static inline void flush_tlb_mm_range(struct mm_struct *mm,
|
|
unsigned long start, unsigned long end, unsigned long vmflag)
|
|
{
|
|
if (mm == current->active_mm)
|
|
__flush_tlb_up();
|
|
}
|
|
|
|
static inline void native_flush_tlb_others(const struct cpumask *cpumask,
|
|
struct mm_struct *mm,
|
|
unsigned long start,
|
|
unsigned long end)
|
|
{
|
|
}
|
|
|
|
static inline void reset_lazy_tlbstate(void)
|
|
{
|
|
}
|
|
|
|
static inline void flush_tlb_kernel_range(unsigned long start,
|
|
unsigned long end)
|
|
{
|
|
flush_tlb_all();
|
|
}
|
|
|
|
#else /* SMP */
|
|
|
|
#include <asm/smp.h>
|
|
|
|
#define local_flush_tlb() __flush_tlb()
|
|
|
|
#define flush_tlb_mm(mm) flush_tlb_mm_range(mm, 0UL, TLB_FLUSH_ALL, 0UL)
|
|
|
|
#define flush_tlb_range(vma, start, end) \
|
|
flush_tlb_mm_range(vma->vm_mm, start, end, vma->vm_flags)
|
|
|
|
extern void flush_tlb_all(void);
|
|
extern void flush_tlb_current_task(void);
|
|
extern void flush_tlb_page(struct vm_area_struct *, unsigned long);
|
|
extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
|
|
unsigned long end, unsigned long vmflag);
|
|
extern void flush_tlb_kernel_range(unsigned long start, unsigned long end);
|
|
|
|
#define flush_tlb() flush_tlb_current_task()
|
|
|
|
void native_flush_tlb_others(const struct cpumask *cpumask,
|
|
struct mm_struct *mm,
|
|
unsigned long start, unsigned long end);
|
|
|
|
#define TLBSTATE_OK 1
|
|
#define TLBSTATE_LAZY 2
|
|
|
|
static inline void reset_lazy_tlbstate(void)
|
|
{
|
|
this_cpu_write(cpu_tlbstate.state, 0);
|
|
this_cpu_write(cpu_tlbstate.active_mm, &init_mm);
|
|
}
|
|
|
|
#endif /* SMP */
|
|
|
|
#ifndef CONFIG_PARAVIRT
|
|
#define flush_tlb_others(mask, mm, start, end) \
|
|
native_flush_tlb_others(mask, mm, start, end)
|
|
#endif
|
|
|
|
#endif /* _ASM_X86_TLBFLUSH_H */
|