]>
Commit | Line | Data |
---|---|---|
c048fdfe GC |
1 | #include <linux/init.h> |
2 | ||
3 | #include <linux/mm.h> | |
c048fdfe GC |
4 | #include <linux/spinlock.h> |
5 | #include <linux/smp.h> | |
c048fdfe | 6 | #include <linux/interrupt.h> |
4b599fed | 7 | #include <linux/export.h> |
93296720 | 8 | #include <linux/cpu.h> |
18bf3c3e | 9 | #include <linux/debugfs.h> |
c048fdfe | 10 | |
c048fdfe | 11 | #include <asm/tlbflush.h> |
c048fdfe | 12 | #include <asm/mmu_context.h> |
18bf3c3e | 13 | #include <asm/nospec-branch.h> |
350f8f56 | 14 | #include <asm/cache.h> |
6dd01bed | 15 | #include <asm/apic.h> |
bdbcdd48 | 16 | #include <asm/uv/uv.h> |
5af5573e | 17 | |
935f5839 PZ |
18 | #include "mm_internal.h" |
19 | ||
c048fdfe | 20 | /* |
ce4a4e56 | 21 | * TLB flushing, formerly SMP-only |
c048fdfe GC |
22 | * c/o Linus Torvalds. |
23 | * | |
24 | * These mean you can really definitely utterly forget about | |
25 | * writing to user space from interrupts. (Its not allowed anyway). | |
26 | * | |
27 | * Optimizations Manfred Spraul <manfred@colorfullife.com> | |
28 | * | |
29 | * More scalable flush, from Andi Kleen | |
30 | * | |
52aec330 | 31 | * Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi |
c048fdfe GC |
32 | */ |
33 | ||
4c71a2b6 TG |
34 | /* |
35 | * Use bit 0 to mangle the TIF_SPEC_IB state into the mm pointer which is | |
36 | * stored in cpu_tlb_state.last_user_mm_ibpb. | |
37 | */ | |
38 | #define LAST_USER_MM_IBPB 0x1UL | |
39 | ||
2ea907c4 DH |
40 | /* |
41 | * We get here when we do something requiring a TLB invalidation | |
42 | * but could not go invalidate all of the contexts. We do the | |
43 | * necessary invalidation by clearing out the 'ctx_id' which | |
44 | * forces a TLB flush when the context is loaded. | |
45 | */ | |
387048f5 | 46 | static void clear_asid_other(void) |
2ea907c4 DH |
47 | { |
48 | u16 asid; | |
49 | ||
50 | /* | |
51 | * This is only expected to be set if we have disabled | |
52 | * kernel _PAGE_GLOBAL pages. | |
53 | */ | |
54 | if (!static_cpu_has(X86_FEATURE_PTI)) { | |
55 | WARN_ON_ONCE(1); | |
56 | return; | |
57 | } | |
58 | ||
59 | for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) { | |
60 | /* Do not need to flush the current asid */ | |
61 | if (asid == this_cpu_read(cpu_tlbstate.loaded_mm_asid)) | |
62 | continue; | |
63 | /* | |
64 | * Make sure the next time we go to switch to | |
65 | * this asid, we do a flush: | |
66 | */ | |
67 | this_cpu_write(cpu_tlbstate.ctxs[asid].ctx_id, 0); | |
68 | } | |
69 | this_cpu_write(cpu_tlbstate.invalidate_other, false); | |
70 | } | |
71 | ||
f39681ed AL |
72 | atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1); |
73 | ||
b956575b | 74 | |
10af6235 AL |
75 | static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen, |
76 | u16 *new_asid, bool *need_flush) | |
77 | { | |
78 | u16 asid; | |
79 | ||
80 | if (!static_cpu_has(X86_FEATURE_PCID)) { | |
81 | *new_asid = 0; | |
82 | *need_flush = true; | |
83 | return; | |
84 | } | |
85 | ||
2ea907c4 DH |
86 | if (this_cpu_read(cpu_tlbstate.invalidate_other)) |
87 | clear_asid_other(); | |
88 | ||
10af6235 AL |
89 | for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) { |
90 | if (this_cpu_read(cpu_tlbstate.ctxs[asid].ctx_id) != | |
91 | next->context.ctx_id) | |
92 | continue; | |
93 | ||
94 | *new_asid = asid; | |
95 | *need_flush = (this_cpu_read(cpu_tlbstate.ctxs[asid].tlb_gen) < | |
96 | next_tlb_gen); | |
97 | return; | |
98 | } | |
99 | ||
100 | /* | |
101 | * We don't currently own an ASID slot on this CPU. | |
102 | * Allocate a slot. | |
103 | */ | |
104 | *new_asid = this_cpu_add_return(cpu_tlbstate.next_asid, 1) - 1; | |
105 | if (*new_asid >= TLB_NR_DYN_ASIDS) { | |
106 | *new_asid = 0; | |
107 | this_cpu_write(cpu_tlbstate.next_asid, 1); | |
108 | } | |
109 | *need_flush = true; | |
110 | } | |
111 | ||
48e11198 DH |
112 | static void load_new_mm_cr3(pgd_t *pgdir, u16 new_asid, bool need_flush) |
113 | { | |
114 | unsigned long new_mm_cr3; | |
115 | ||
116 | if (need_flush) { | |
6fd166aa | 117 | invalidate_user_asid(new_asid); |
48e11198 DH |
118 | new_mm_cr3 = build_cr3(pgdir, new_asid); |
119 | } else { | |
120 | new_mm_cr3 = build_cr3_noflush(pgdir, new_asid); | |
121 | } | |
122 | ||
123 | /* | |
124 | * Caution: many callers of this function expect | |
125 | * that load_cr3() is serializing and orders TLB | |
126 | * fills with respect to the mm_cpumask writes. | |
127 | */ | |
128 | write_cr3(new_mm_cr3); | |
129 | } | |
130 | ||
c048fdfe GC |
131 | void leave_mm(int cpu) |
132 | { | |
3d28ebce AL |
133 | struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm); |
134 | ||
135 | /* | |
136 | * It's plausible that we're in lazy TLB mode while our mm is init_mm. | |
137 | * If so, our callers still expect us to flush the TLB, but there | |
138 | * aren't any user TLB entries in init_mm to worry about. | |
139 | * | |
140 | * This needs to happen before any other sanity checks due to | |
141 | * intel_idle's shenanigans. | |
142 | */ | |
143 | if (loaded_mm == &init_mm) | |
144 | return; | |
145 | ||
94b1b03b | 146 | /* Warn if we're not lazy. */ |
b956575b | 147 | WARN_ON(!this_cpu_read(cpu_tlbstate.is_lazy)); |
3d28ebce AL |
148 | |
149 | switch_mm(NULL, &init_mm, NULL); | |
c048fdfe | 150 | } |
67535736 | 151 | EXPORT_SYMBOL_GPL(leave_mm); |
c048fdfe | 152 | |
69c0319a AL |
153 | void switch_mm(struct mm_struct *prev, struct mm_struct *next, |
154 | struct task_struct *tsk) | |
078194f8 AL |
155 | { |
156 | unsigned long flags; | |
157 | ||
158 | local_irq_save(flags); | |
159 | switch_mm_irqs_off(prev, next, tsk); | |
160 | local_irq_restore(flags); | |
161 | } | |
162 | ||
5beda7d5 AL |
163 | static void sync_current_stack_to_mm(struct mm_struct *mm) |
164 | { | |
165 | unsigned long sp = current_stack_pointer; | |
166 | pgd_t *pgd = pgd_offset(mm, sp); | |
167 | ||
ed7588d5 | 168 | if (pgtable_l5_enabled()) { |
5beda7d5 AL |
169 | if (unlikely(pgd_none(*pgd))) { |
170 | pgd_t *pgd_ref = pgd_offset_k(sp); | |
171 | ||
172 | set_pgd(pgd, *pgd_ref); | |
173 | } | |
174 | } else { | |
175 | /* | |
176 | * "pgd" is faked. The top level entries are "p4d"s, so sync | |
177 | * the p4d. This compiles to approximately the same code as | |
178 | * the 5-level case. | |
179 | */ | |
180 | p4d_t *p4d = p4d_offset(pgd, sp); | |
181 | ||
182 | if (unlikely(p4d_none(*p4d))) { | |
183 | pgd_t *pgd_ref = pgd_offset_k(sp); | |
184 | p4d_t *p4d_ref = p4d_offset(pgd_ref, sp); | |
185 | ||
186 | set_p4d(p4d, *p4d_ref); | |
187 | } | |
188 | } | |
189 | } | |
190 | ||
4c71a2b6 TG |
191 | static inline unsigned long mm_mangle_tif_spec_ib(struct task_struct *next) |
192 | { | |
193 | unsigned long next_tif = task_thread_info(next)->flags; | |
194 | unsigned long ibpb = (next_tif >> TIF_SPEC_IB) & LAST_USER_MM_IBPB; | |
195 | ||
196 | return (unsigned long)next->mm | ibpb; | |
197 | } | |
198 | ||
199 | static void cond_ibpb(struct task_struct *next) | |
dbfe2953 | 200 | { |
4c71a2b6 TG |
201 | if (!next || !next->mm) |
202 | return; | |
203 | ||
dbfe2953 | 204 | /* |
4c71a2b6 TG |
205 | * Both, the conditional and the always IBPB mode use the mm |
206 | * pointer to avoid the IBPB when switching between tasks of the | |
207 | * same process. Using the mm pointer instead of mm->context.ctx_id | |
208 | * opens a hypothetical hole vs. mm_struct reuse, which is more or | |
209 | * less impossible to control by an attacker. Aside of that it | |
210 | * would only affect the first schedule so the theoretically | |
211 | * exposed data is not really interesting. | |
dbfe2953 | 212 | */ |
4c71a2b6 TG |
213 | if (static_branch_likely(&switch_mm_cond_ibpb)) { |
214 | unsigned long prev_mm, next_mm; | |
215 | ||
216 | /* | |
217 | * This is a bit more complex than the always mode because | |
218 | * it has to handle two cases: | |
219 | * | |
220 | * 1) Switch from a user space task (potential attacker) | |
221 | * which has TIF_SPEC_IB set to a user space task | |
222 | * (potential victim) which has TIF_SPEC_IB not set. | |
223 | * | |
224 | * 2) Switch from a user space task (potential attacker) | |
225 | * which has TIF_SPEC_IB not set to a user space task | |
226 | * (potential victim) which has TIF_SPEC_IB set. | |
227 | * | |
228 | * This could be done by unconditionally issuing IBPB when | |
229 | * a task which has TIF_SPEC_IB set is either scheduled in | |
230 | * or out. Though that results in two flushes when: | |
231 | * | |
232 | * - the same user space task is scheduled out and later | |
233 | * scheduled in again and only a kernel thread ran in | |
234 | * between. | |
235 | * | |
236 | * - a user space task belonging to the same process is | |
237 | * scheduled in after a kernel thread ran in between | |
238 | * | |
239 | * - a user space task belonging to the same process is | |
240 | * scheduled in immediately. | |
241 | * | |
242 | * Optimize this with reasonably small overhead for the | |
243 | * above cases. Mangle the TIF_SPEC_IB bit into the mm | |
244 | * pointer of the incoming task which is stored in | |
245 | * cpu_tlbstate.last_user_mm_ibpb for comparison. | |
246 | */ | |
247 | next_mm = mm_mangle_tif_spec_ib(next); | |
248 | prev_mm = this_cpu_read(cpu_tlbstate.last_user_mm_ibpb); | |
249 | ||
250 | /* | |
251 | * Issue IBPB only if the mm's are different and one or | |
252 | * both have the IBPB bit set. | |
253 | */ | |
254 | if (next_mm != prev_mm && | |
255 | (next_mm | prev_mm) & LAST_USER_MM_IBPB) | |
256 | indirect_branch_prediction_barrier(); | |
257 | ||
258 | this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, next_mm); | |
259 | } | |
260 | ||
261 | if (static_branch_unlikely(&switch_mm_always_ibpb)) { | |
262 | /* | |
263 | * Only flush when switching to a user space task with a | |
264 | * different context than the user space task which ran | |
265 | * last on this CPU. | |
266 | */ | |
267 | if (this_cpu_read(cpu_tlbstate.last_user_mm) != next->mm) { | |
268 | indirect_branch_prediction_barrier(); | |
269 | this_cpu_write(cpu_tlbstate.last_user_mm, next->mm); | |
270 | } | |
271 | } | |
dbfe2953 JK |
272 | } |
273 | ||
078194f8 AL |
274 | void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, |
275 | struct task_struct *tsk) | |
69c0319a | 276 | { |
3d28ebce | 277 | struct mm_struct *real_prev = this_cpu_read(cpu_tlbstate.loaded_mm); |
10af6235 | 278 | u16 prev_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid); |
145f573b | 279 | bool was_lazy = this_cpu_read(cpu_tlbstate.is_lazy); |
94b1b03b AL |
280 | unsigned cpu = smp_processor_id(); |
281 | u64 next_tlb_gen; | |
12c4d978 RR |
282 | bool need_flush; |
283 | u16 new_asid; | |
69c0319a | 284 | |
3d28ebce | 285 | /* |
94b1b03b AL |
286 | * NB: The scheduler will call us with prev == next when switching |
287 | * from lazy TLB mode to normal mode if active_mm isn't changing. | |
288 | * When this happens, we don't assume that CR3 (and hence | |
289 | * cpu_tlbstate.loaded_mm) matches next. | |
3d28ebce AL |
290 | * |
291 | * NB: leave_mm() calls us with prev == NULL and tsk == NULL. | |
292 | */ | |
e37e43a4 | 293 | |
94b1b03b AL |
294 | /* We don't want flush_tlb_func_* to run concurrently with us. */ |
295 | if (IS_ENABLED(CONFIG_PROVE_LOCKING)) | |
296 | WARN_ON_ONCE(!irqs_disabled()); | |
297 | ||
298 | /* | |
299 | * Verify that CR3 is what we think it is. This will catch | |
300 | * hypothetical buggy code that directly switches to swapper_pg_dir | |
10af6235 AL |
301 | * without going through leave_mm() / switch_mm_irqs_off() or that |
302 | * does something like write_cr3(read_cr3_pa()). | |
a376e7f9 AL |
303 | * |
304 | * Only do this check if CONFIG_DEBUG_VM=y because __read_cr3() | |
305 | * isn't free. | |
94b1b03b | 306 | */ |
a376e7f9 | 307 | #ifdef CONFIG_DEBUG_VM |
50fb83a6 | 308 | if (WARN_ON_ONCE(__read_cr3() != build_cr3(real_prev->pgd, prev_asid))) { |
a376e7f9 AL |
309 | /* |
310 | * If we were to BUG here, we'd be very likely to kill | |
311 | * the system so hard that we don't see the call trace. | |
312 | * Try to recover instead by ignoring the error and doing | |
313 | * a global flush to minimize the chance of corruption. | |
314 | * | |
315 | * (This is far from being a fully correct recovery. | |
316 | * Architecturally, the CPU could prefetch something | |
317 | * back into an incorrect ASID slot and leave it there | |
318 | * to cause trouble down the road. It's better than | |
319 | * nothing, though.) | |
320 | */ | |
321 | __flush_tlb_all(); | |
322 | } | |
323 | #endif | |
b956575b | 324 | this_cpu_write(cpu_tlbstate.is_lazy, false); |
e37e43a4 | 325 | |
306e0604 | 326 | /* |
10bcc80e MD |
327 | * The membarrier system call requires a full memory barrier and |
328 | * core serialization before returning to user-space, after | |
329 | * storing to rq->curr. Writing to CR3 provides that full | |
330 | * memory barrier and core serializing instruction. | |
306e0604 | 331 | */ |
3d28ebce | 332 | if (real_prev == next) { |
e8b9b0cc AL |
333 | VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) != |
334 | next->context.ctx_id); | |
94b1b03b | 335 | |
69c0319a | 336 | /* |
145f573b RR |
337 | * Even in lazy TLB mode, the CPU should stay set in the |
338 | * mm_cpumask. The TLB shootdown code can figure out from | |
339 | * from cpu_tlbstate.is_lazy whether or not to send an IPI. | |
69c0319a | 340 | */ |
b956575b AL |
341 | if (WARN_ON_ONCE(real_prev != &init_mm && |
342 | !cpumask_test_cpu(cpu, mm_cpumask(next)))) | |
343 | cpumask_set_cpu(cpu, mm_cpumask(next)); | |
344 | ||
145f573b RR |
345 | /* |
346 | * If the CPU is not in lazy TLB mode, we are just switching | |
347 | * from one thread in a process to another thread in the same | |
348 | * process. No TLB flush required. | |
349 | */ | |
350 | if (!was_lazy) | |
351 | return; | |
352 | ||
353 | /* | |
354 | * Read the tlb_gen to check whether a flush is needed. | |
355 | * If the TLB is up to date, just use it. | |
356 | * The barrier synchronizes with the tlb_gen increment in | |
357 | * the TLB shootdown code. | |
358 | */ | |
359 | smp_mb(); | |
360 | next_tlb_gen = atomic64_read(&next->context.tlb_gen); | |
361 | if (this_cpu_read(cpu_tlbstate.ctxs[prev_asid].tlb_gen) == | |
362 | next_tlb_gen) | |
363 | return; | |
364 | ||
365 | /* | |
366 | * TLB contents went out of date while we were in lazy | |
367 | * mode. Fall through to the TLB switching code below. | |
368 | */ | |
369 | new_asid = prev_asid; | |
370 | need_flush = true; | |
94b1b03b | 371 | } else { |
18bf3c3e TC |
372 | /* |
373 | * Avoid user/user BTB poisoning by flushing the branch | |
374 | * predictor when switching between processes. This stops | |
375 | * one process from doing Spectre-v2 attacks on another. | |
18bf3c3e | 376 | */ |
4c71a2b6 | 377 | cond_ibpb(tsk); |
94b1b03b AL |
378 | |
379 | if (IS_ENABLED(CONFIG_VMAP_STACK)) { | |
380 | /* | |
381 | * If our current stack is in vmalloc space and isn't | |
382 | * mapped in the new pgd, we'll double-fault. Forcibly | |
383 | * map it. | |
384 | */ | |
5beda7d5 | 385 | sync_current_stack_to_mm(next); |
94b1b03b | 386 | } |
69c0319a | 387 | |
e9d8c615 RR |
388 | /* |
389 | * Stop remote flushes for the previous mm. | |
390 | * Skip kernel threads; we never send init_mm TLB flushing IPIs, | |
391 | * but the bitmap manipulation can cause cache line contention. | |
392 | */ | |
393 | if (real_prev != &init_mm) { | |
394 | VM_WARN_ON_ONCE(!cpumask_test_cpu(cpu, | |
395 | mm_cpumask(real_prev))); | |
396 | cpumask_clear_cpu(cpu, mm_cpumask(real_prev)); | |
397 | } | |
3d28ebce | 398 | |
94b1b03b AL |
399 | /* |
400 | * Start remote flushes and then read tlb_gen. | |
401 | */ | |
e9d8c615 RR |
402 | if (next != &init_mm) |
403 | cpumask_set_cpu(cpu, mm_cpumask(next)); | |
94b1b03b | 404 | next_tlb_gen = atomic64_read(&next->context.tlb_gen); |
3d28ebce | 405 | |
10af6235 | 406 | choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush); |
3d28ebce | 407 | |
4012e77a AL |
408 | /* Let nmi_uaccess_okay() know that we're changing CR3. */ |
409 | this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING); | |
410 | barrier(); | |
12c4d978 | 411 | } |
4012e77a | 412 | |
12c4d978 RR |
413 | if (need_flush) { |
414 | this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id); | |
415 | this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen); | |
416 | load_new_mm_cr3(next->pgd, new_asid, true); | |
10af6235 | 417 | |
18bf3c3e | 418 | /* |
12c4d978 RR |
419 | * NB: This gets called via leave_mm() in the idle path |
420 | * where RCU functions differently. Tracing normally | |
421 | * uses RCU, so we need to use the _rcuidle variant. | |
422 | * | |
423 | * (There is no good reason for this. The idle code should | |
424 | * be rearranged to call this before rcu_idle_enter().) | |
18bf3c3e | 425 | */ |
12c4d978 RR |
426 | trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); |
427 | } else { | |
428 | /* The new ASID is already up to date. */ | |
429 | load_new_mm_cr3(next->pgd, new_asid, false); | |
4012e77a | 430 | |
12c4d978 RR |
431 | /* See above wrt _rcuidle. */ |
432 | trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0); | |
94b1b03b | 433 | } |
3d28ebce | 434 | |
12c4d978 RR |
435 | /* Make sure we write CR3 before loaded_mm. */ |
436 | barrier(); | |
437 | ||
438 | this_cpu_write(cpu_tlbstate.loaded_mm, next); | |
439 | this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid); | |
440 | ||
145f573b RR |
441 | if (next != real_prev) { |
442 | load_mm_cr4(next); | |
443 | switch_ldt(real_prev, next); | |
444 | } | |
69c0319a AL |
445 | } |
446 | ||
b956575b | 447 | /* |
4e57b946 AL |
448 | * Please ignore the name of this function. It should be called |
449 | * switch_to_kernel_thread(). | |
450 | * | |
b956575b AL |
451 | * enter_lazy_tlb() is a hint from the scheduler that we are entering a |
452 | * kernel thread or other context without an mm. Acceptable implementations | |
453 | * include doing nothing whatsoever, switching to init_mm, or various clever | |
454 | * lazy tricks to try to minimize TLB flushes. | |
455 | * | |
456 | * The scheduler reserves the right to call enter_lazy_tlb() several times | |
457 | * in a row. It will notify us that we're going back to a real mm by | |
458 | * calling switch_mm_irqs_off(). | |
459 | */ | |
460 | void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk) | |
461 | { | |
462 | if (this_cpu_read(cpu_tlbstate.loaded_mm) == &init_mm) | |
463 | return; | |
464 | ||
5462bc3a | 465 | this_cpu_write(cpu_tlbstate.is_lazy, true); |
b956575b AL |
466 | } |
467 | ||
72c0098d AL |
468 | /* |
469 | * Call this when reinitializing a CPU. It fixes the following potential | |
470 | * problems: | |
471 | * | |
472 | * - The ASID changed from what cpu_tlbstate thinks it is (most likely | |
473 | * because the CPU was taken down and came back up with CR3's PCID | |
474 | * bits clear. CPU hotplug can do this. | |
475 | * | |
476 | * - The TLB contains junk in slots corresponding to inactive ASIDs. | |
477 | * | |
478 | * - The CPU went so far out to lunch that it may have missed a TLB | |
479 | * flush. | |
480 | */ | |
481 | void initialize_tlbstate_and_flush(void) | |
482 | { | |
483 | int i; | |
484 | struct mm_struct *mm = this_cpu_read(cpu_tlbstate.loaded_mm); | |
485 | u64 tlb_gen = atomic64_read(&init_mm.context.tlb_gen); | |
486 | unsigned long cr3 = __read_cr3(); | |
487 | ||
488 | /* Assert that CR3 already references the right mm. */ | |
489 | WARN_ON((cr3 & CR3_ADDR_MASK) != __pa(mm->pgd)); | |
490 | ||
491 | /* | |
492 | * Assert that CR4.PCIDE is set if needed. (CR4.PCIDE initialization | |
493 | * doesn't work like other CR4 bits because it can only be set from | |
494 | * long mode.) | |
495 | */ | |
7898f796 | 496 | WARN_ON(boot_cpu_has(X86_FEATURE_PCID) && |
72c0098d AL |
497 | !(cr4_read_shadow() & X86_CR4_PCIDE)); |
498 | ||
499 | /* Force ASID 0 and force a TLB flush. */ | |
50fb83a6 | 500 | write_cr3(build_cr3(mm->pgd, 0)); |
72c0098d AL |
501 | |
502 | /* Reinitialize tlbstate. */ | |
4c71a2b6 | 503 | this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, LAST_USER_MM_IBPB); |
72c0098d AL |
504 | this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0); |
505 | this_cpu_write(cpu_tlbstate.next_asid, 1); | |
506 | this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id); | |
507 | this_cpu_write(cpu_tlbstate.ctxs[0].tlb_gen, tlb_gen); | |
508 | ||
509 | for (i = 1; i < TLB_NR_DYN_ASIDS; i++) | |
510 | this_cpu_write(cpu_tlbstate.ctxs[i].ctx_id, 0); | |
511 | } | |
512 | ||
b0579ade AL |
513 | /* |
514 | * flush_tlb_func_common()'s memory ordering requirement is that any | |
515 | * TLB fills that happen after we flush the TLB are ordered after we | |
516 | * read active_mm's tlb_gen. We don't need any explicit barriers | |
517 | * because all x86 flush operations are serializing and the | |
518 | * atomic64_read operation won't be reordered by the compiler. | |
519 | */ | |
454bbad9 AL |
520 | static void flush_tlb_func_common(const struct flush_tlb_info *f, |
521 | bool local, enum tlb_flush_reason reason) | |
c048fdfe | 522 | { |
b0579ade AL |
523 | /* |
524 | * We have three different tlb_gen values in here. They are: | |
525 | * | |
526 | * - mm_tlb_gen: the latest generation. | |
527 | * - local_tlb_gen: the generation that this CPU has already caught | |
528 | * up to. | |
529 | * - f->new_tlb_gen: the generation that the requester of the flush | |
530 | * wants us to catch up to. | |
531 | */ | |
532 | struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm); | |
10af6235 | 533 | u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid); |
b0579ade | 534 | u64 mm_tlb_gen = atomic64_read(&loaded_mm->context.tlb_gen); |
10af6235 | 535 | u64 local_tlb_gen = this_cpu_read(cpu_tlbstate.ctxs[loaded_mm_asid].tlb_gen); |
b0579ade | 536 | |
bc0d5a89 AL |
537 | /* This code cannot presently handle being reentered. */ |
538 | VM_WARN_ON(!irqs_disabled()); | |
539 | ||
b956575b AL |
540 | if (unlikely(loaded_mm == &init_mm)) |
541 | return; | |
542 | ||
10af6235 | 543 | VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[loaded_mm_asid].ctx_id) != |
b0579ade AL |
544 | loaded_mm->context.ctx_id); |
545 | ||
b956575b | 546 | if (this_cpu_read(cpu_tlbstate.is_lazy)) { |
b0579ade | 547 | /* |
b956575b AL |
548 | * We're in lazy mode. We need to at least flush our |
549 | * paging-structure cache to avoid speculatively reading | |
550 | * garbage into our TLB. Since switching to init_mm is barely | |
551 | * slower than a minimal flush, just switch to init_mm. | |
145f573b RR |
552 | * |
553 | * This should be rare, with native_flush_tlb_others skipping | |
554 | * IPIs to lazy TLB mode CPUs. | |
b0579ade | 555 | */ |
b956575b | 556 | switch_mm_irqs_off(NULL, &init_mm, NULL); |
b3b90e5a AL |
557 | return; |
558 | } | |
c048fdfe | 559 | |
b0579ade AL |
560 | if (unlikely(local_tlb_gen == mm_tlb_gen)) { |
561 | /* | |
562 | * There's nothing to do: we're already up to date. This can | |
563 | * happen if two concurrent flushes happen -- the first flush to | |
564 | * be handled can catch us all the way up, leaving no work for | |
565 | * the second flush. | |
566 | */ | |
94b1b03b | 567 | trace_tlb_flush(reason, 0); |
b0579ade AL |
568 | return; |
569 | } | |
570 | ||
571 | WARN_ON_ONCE(local_tlb_gen > mm_tlb_gen); | |
572 | WARN_ON_ONCE(f->new_tlb_gen > mm_tlb_gen); | |
573 | ||
574 | /* | |
575 | * If we get to this point, we know that our TLB is out of date. | |
576 | * This does not strictly imply that we need to flush (it's | |
577 | * possible that f->new_tlb_gen <= local_tlb_gen), but we're | |
578 | * going to need to flush in the very near future, so we might | |
579 | * as well get it over with. | |
580 | * | |
581 | * The only question is whether to do a full or partial flush. | |
582 | * | |
583 | * We do a partial flush if requested and two extra conditions | |
584 | * are met: | |
585 | * | |
586 | * 1. f->new_tlb_gen == local_tlb_gen + 1. We have an invariant that | |
587 | * we've always done all needed flushes to catch up to | |
588 | * local_tlb_gen. If, for example, local_tlb_gen == 2 and | |
589 | * f->new_tlb_gen == 3, then we know that the flush needed to bring | |
590 | * us up to date for tlb_gen 3 is the partial flush we're | |
591 | * processing. | |
592 | * | |
593 | * As an example of why this check is needed, suppose that there | |
594 | * are two concurrent flushes. The first is a full flush that | |
595 | * changes context.tlb_gen from 1 to 2. The second is a partial | |
596 | * flush that changes context.tlb_gen from 2 to 3. If they get | |
597 | * processed on this CPU in reverse order, we'll see | |
598 | * local_tlb_gen == 1, mm_tlb_gen == 3, and end != TLB_FLUSH_ALL. | |
1299ef1d | 599 | * If we were to use __flush_tlb_one_user() and set local_tlb_gen to |
b0579ade AL |
600 | * 3, we'd be break the invariant: we'd update local_tlb_gen above |
601 | * 1 without the full flush that's needed for tlb_gen 2. | |
602 | * | |
603 | * 2. f->new_tlb_gen == mm_tlb_gen. This is purely an optimiation. | |
604 | * Partial TLB flushes are not all that much cheaper than full TLB | |
605 | * flushes, so it seems unlikely that it would be a performance win | |
606 | * to do a partial flush if that won't bring our TLB fully up to | |
607 | * date. By doing a full flush instead, we can increase | |
608 | * local_tlb_gen all the way to mm_tlb_gen and we can probably | |
609 | * avoid another flush in the very near future. | |
610 | */ | |
611 | if (f->end != TLB_FLUSH_ALL && | |
612 | f->new_tlb_gen == local_tlb_gen + 1 && | |
613 | f->new_tlb_gen == mm_tlb_gen) { | |
614 | /* Partial flush */ | |
a31acd3e PZ |
615 | unsigned long nr_invalidate = (f->end - f->start) >> f->stride_shift; |
616 | unsigned long addr = f->start; | |
b0579ade | 617 | |
a2055abe | 618 | while (addr < f->end) { |
1299ef1d | 619 | __flush_tlb_one_user(addr); |
a31acd3e | 620 | addr += 1UL << f->stride_shift; |
b3b90e5a | 621 | } |
454bbad9 | 622 | if (local) |
a31acd3e PZ |
623 | count_vm_tlb_events(NR_TLB_LOCAL_FLUSH_ONE, nr_invalidate); |
624 | trace_tlb_flush(reason, nr_invalidate); | |
b0579ade AL |
625 | } else { |
626 | /* Full flush. */ | |
627 | local_flush_tlb(); | |
628 | if (local) | |
629 | count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); | |
630 | trace_tlb_flush(reason, TLB_FLUSH_ALL); | |
b3b90e5a | 631 | } |
b0579ade AL |
632 | |
633 | /* Both paths above update our state to mm_tlb_gen. */ | |
10af6235 | 634 | this_cpu_write(cpu_tlbstate.ctxs[loaded_mm_asid].tlb_gen, mm_tlb_gen); |
c048fdfe GC |
635 | } |
636 | ||
3db6d5a5 | 637 | static void flush_tlb_func_local(const void *info, enum tlb_flush_reason reason) |
454bbad9 AL |
638 | { |
639 | const struct flush_tlb_info *f = info; | |
640 | ||
641 | flush_tlb_func_common(f, true, reason); | |
642 | } | |
643 | ||
644 | static void flush_tlb_func_remote(void *info) | |
645 | { | |
646 | const struct flush_tlb_info *f = info; | |
647 | ||
648 | inc_irq_stat(irq_tlb_count); | |
649 | ||
3d28ebce | 650 | if (f->mm && f->mm != this_cpu_read(cpu_tlbstate.loaded_mm)) |
454bbad9 AL |
651 | return; |
652 | ||
653 | count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); | |
654 | flush_tlb_func_common(f, false, TLB_REMOTE_SHOOTDOWN); | |
655 | } | |
656 | ||
145f573b RR |
657 | static bool tlb_is_not_lazy(int cpu, void *data) |
658 | { | |
659 | return !per_cpu(cpu_tlbstate.is_lazy, cpu); | |
660 | } | |
661 | ||
4595f962 | 662 | void native_flush_tlb_others(const struct cpumask *cpumask, |
a2055abe | 663 | const struct flush_tlb_info *info) |
4595f962 | 664 | { |
ec659934 | 665 | count_vm_tlb_event(NR_TLB_REMOTE_FLUSH); |
a2055abe | 666 | if (info->end == TLB_FLUSH_ALL) |
18c98243 NA |
667 | trace_tlb_flush(TLB_REMOTE_SEND_IPI, TLB_FLUSH_ALL); |
668 | else | |
669 | trace_tlb_flush(TLB_REMOTE_SEND_IPI, | |
a2055abe | 670 | (info->end - info->start) >> PAGE_SHIFT); |
18c98243 | 671 | |
4595f962 | 672 | if (is_uv_system()) { |
94b1b03b AL |
673 | /* |
674 | * This whole special case is confused. UV has a "Broadcast | |
675 | * Assist Unit", which seems to be a fancy way to send IPIs. | |
676 | * Back when x86 used an explicit TLB flush IPI, UV was | |
677 | * optimized to use its own mechanism. These days, x86 uses | |
678 | * smp_call_function_many(), but UV still uses a manual IPI, | |
679 | * and that IPI's action is out of date -- it does a manual | |
680 | * flush instead of calling flush_tlb_func_remote(). This | |
681 | * means that the percpu tlb_gen variables won't be updated | |
682 | * and we'll do pointless flushes on future context switches. | |
683 | * | |
684 | * Rather than hooking native_flush_tlb_others() here, I think | |
685 | * that UV should be updated so that smp_call_function_many(), | |
686 | * etc, are optimal on UV. | |
687 | */ | |
a2055abe | 688 | cpumask = uv_flush_tlb_others(cpumask, info); |
bdbcdd48 | 689 | if (cpumask) |
454bbad9 | 690 | smp_call_function_many(cpumask, flush_tlb_func_remote, |
a2055abe | 691 | (void *)info, 1); |
0e21990a | 692 | return; |
4595f962 | 693 | } |
145f573b RR |
694 | |
695 | /* | |
696 | * If no page tables were freed, we can skip sending IPIs to | |
697 | * CPUs in lazy TLB mode. They will flush the CPU themselves | |
698 | * at the next context switch. | |
699 | * | |
700 | * However, if page tables are getting freed, we need to send the | |
701 | * IPI everywhere, to prevent CPUs in lazy TLB mode from tripping | |
702 | * up on the new contents of what used to be page tables, while | |
703 | * doing a speculative memory access. | |
704 | */ | |
705 | if (info->freed_tables) | |
706 | smp_call_function_many(cpumask, flush_tlb_func_remote, | |
ac031589 | 707 | (void *)info, 1); |
145f573b RR |
708 | else |
709 | on_each_cpu_cond_mask(tlb_is_not_lazy, flush_tlb_func_remote, | |
710 | (void *)info, 1, GFP_ATOMIC, cpumask); | |
c048fdfe | 711 | } |
c048fdfe | 712 | |
a5102476 DH |
713 | /* |
714 | * See Documentation/x86/tlb.txt for details. We choose 33 | |
715 | * because it is large enough to cover the vast majority (at | |
716 | * least 95%) of allocations, and is small enough that we are | |
717 | * confident it will not cause too much overhead. Each single | |
718 | * flush is about 100 ns, so this caps the maximum overhead at | |
719 | * _about_ 3,000 ns. | |
720 | * | |
721 | * This is in units of pages. | |
722 | */ | |
935f5839 | 723 | unsigned long tlb_single_page_flush_ceiling __read_mostly = 33; |
e9f4e0a9 | 724 | |
3db6d5a5 NA |
725 | static DEFINE_PER_CPU_SHARED_ALIGNED(struct flush_tlb_info, flush_tlb_info); |
726 | ||
727 | #ifdef CONFIG_DEBUG_VM | |
728 | static DEFINE_PER_CPU(unsigned int, flush_tlb_info_idx); | |
729 | #endif | |
730 | ||
731 | static inline struct flush_tlb_info *get_flush_tlb_info(struct mm_struct *mm, | |
732 | unsigned long start, unsigned long end, | |
733 | unsigned int stride_shift, bool freed_tables, | |
734 | u64 new_tlb_gen) | |
735 | { | |
736 | struct flush_tlb_info *info = this_cpu_ptr(&flush_tlb_info); | |
737 | ||
738 | #ifdef CONFIG_DEBUG_VM | |
739 | /* | |
740 | * Ensure that the following code is non-reentrant and flush_tlb_info | |
741 | * is not overwritten. This means no TLB flushing is initiated by | |
742 | * interrupt handlers and machine-check exception handlers. | |
743 | */ | |
744 | BUG_ON(this_cpu_inc_return(flush_tlb_info_idx) != 1); | |
745 | #endif | |
746 | ||
747 | info->start = start; | |
748 | info->end = end; | |
749 | info->mm = mm; | |
750 | info->stride_shift = stride_shift; | |
751 | info->freed_tables = freed_tables; | |
752 | info->new_tlb_gen = new_tlb_gen; | |
753 | ||
754 | return info; | |
755 | } | |
756 | ||
757 | static inline void put_flush_tlb_info(void) | |
758 | { | |
759 | #ifdef CONFIG_DEBUG_VM | |
760 | /* Complete reentrency prevention checks */ | |
761 | barrier(); | |
762 | this_cpu_dec(flush_tlb_info_idx); | |
763 | #endif | |
764 | } | |
765 | ||
611ae8e3 | 766 | void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, |
016c4d92 RR |
767 | unsigned long end, unsigned int stride_shift, |
768 | bool freed_tables) | |
611ae8e3 | 769 | { |
3db6d5a5 NA |
770 | struct flush_tlb_info *info; |
771 | u64 new_tlb_gen; | |
454bbad9 | 772 | int cpu; |
ce27374f | 773 | |
454bbad9 | 774 | cpu = get_cpu(); |
71b3c126 | 775 | |
454bbad9 | 776 | /* Should we flush just the requested range? */ |
3db6d5a5 NA |
777 | if ((end == TLB_FLUSH_ALL) || |
778 | ((end - start) >> stride_shift) > tlb_single_page_flush_ceiling) { | |
779 | start = 0; | |
780 | end = TLB_FLUSH_ALL; | |
4995ab9c | 781 | } |
454bbad9 | 782 | |
3db6d5a5 NA |
783 | /* This is also a barrier that synchronizes with switch_mm(). */ |
784 | new_tlb_gen = inc_mm_tlb_gen(mm); | |
785 | ||
786 | info = get_flush_tlb_info(mm, start, end, stride_shift, freed_tables, | |
787 | new_tlb_gen); | |
788 | ||
bc0d5a89 | 789 | if (mm == this_cpu_read(cpu_tlbstate.loaded_mm)) { |
3db6d5a5 | 790 | lockdep_assert_irqs_enabled(); |
bc0d5a89 | 791 | local_irq_disable(); |
3db6d5a5 | 792 | flush_tlb_func_local(info, TLB_LOCAL_MM_SHOOTDOWN); |
bc0d5a89 AL |
793 | local_irq_enable(); |
794 | } | |
795 | ||
454bbad9 | 796 | if (cpumask_any_but(mm_cpumask(mm), cpu) < nr_cpu_ids) |
3db6d5a5 | 797 | flush_tlb_others(mm_cpumask(mm), info); |
94b1b03b | 798 | |
3db6d5a5 | 799 | put_flush_tlb_info(); |
454bbad9 | 800 | put_cpu(); |
c048fdfe GC |
801 | } |
802 | ||
a2055abe | 803 | |
c048fdfe GC |
804 | static void do_flush_tlb_all(void *info) |
805 | { | |
ec659934 | 806 | count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); |
c048fdfe | 807 | __flush_tlb_all(); |
c048fdfe GC |
808 | } |
809 | ||
810 | void flush_tlb_all(void) | |
811 | { | |
ec659934 | 812 | count_vm_tlb_event(NR_TLB_REMOTE_FLUSH); |
15c8b6c1 | 813 | on_each_cpu(do_flush_tlb_all, NULL, 1); |
c048fdfe | 814 | } |
3df3212f | 815 | |
effee4b9 AS |
816 | static void do_kernel_range_flush(void *info) |
817 | { | |
818 | struct flush_tlb_info *f = info; | |
819 | unsigned long addr; | |
820 | ||
821 | /* flush range by one by one 'invlpg' */ | |
a2055abe | 822 | for (addr = f->start; addr < f->end; addr += PAGE_SIZE) |
1299ef1d | 823 | __flush_tlb_one_kernel(addr); |
effee4b9 AS |
824 | } |
825 | ||
826 | void flush_tlb_kernel_range(unsigned long start, unsigned long end) | |
827 | { | |
effee4b9 | 828 | /* Balance as user space task's flush, a bit conservative */ |
e9f4e0a9 | 829 | if (end == TLB_FLUSH_ALL || |
be4ffc0d | 830 | (end - start) > tlb_single_page_flush_ceiling << PAGE_SHIFT) { |
effee4b9 | 831 | on_each_cpu(do_flush_tlb_all, NULL, 1); |
e9f4e0a9 | 832 | } else { |
3db6d5a5 NA |
833 | struct flush_tlb_info *info; |
834 | ||
835 | preempt_disable(); | |
836 | info = get_flush_tlb_info(NULL, start, end, 0, false, 0); | |
837 | ||
838 | on_each_cpu(do_kernel_range_flush, info, 1); | |
839 | ||
840 | put_flush_tlb_info(); | |
841 | preempt_enable(); | |
effee4b9 AS |
842 | } |
843 | } | |
2d040a1c | 844 | |
3db6d5a5 NA |
845 | /* |
846 | * arch_tlbbatch_flush() performs a full TLB flush regardless of the active mm. | |
847 | * This means that the 'struct flush_tlb_info' that describes which mappings to | |
848 | * flush is actually fixed. We therefore set a single fixed struct and use it in | |
849 | * arch_tlbbatch_flush(). | |
850 | */ | |
851 | static const struct flush_tlb_info full_flush_tlb_info = { | |
852 | .mm = NULL, | |
853 | .start = 0, | |
854 | .end = TLB_FLUSH_ALL, | |
855 | }; | |
856 | ||
e73ad5ff AL |
857 | void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch) |
858 | { | |
859 | int cpu = get_cpu(); | |
860 | ||
bc0d5a89 | 861 | if (cpumask_test_cpu(cpu, &batch->cpumask)) { |
3db6d5a5 | 862 | lockdep_assert_irqs_enabled(); |
bc0d5a89 | 863 | local_irq_disable(); |
3db6d5a5 | 864 | flush_tlb_func_local(&full_flush_tlb_info, TLB_LOCAL_SHOOTDOWN); |
bc0d5a89 AL |
865 | local_irq_enable(); |
866 | } | |
867 | ||
e73ad5ff | 868 | if (cpumask_any_but(&batch->cpumask, cpu) < nr_cpu_ids) |
3db6d5a5 | 869 | flush_tlb_others(&batch->cpumask, &full_flush_tlb_info); |
94b1b03b | 870 | |
e73ad5ff AL |
871 | cpumask_clear(&batch->cpumask); |
872 | ||
873 | put_cpu(); | |
874 | } | |
875 | ||
2d040a1c DH |
876 | static ssize_t tlbflush_read_file(struct file *file, char __user *user_buf, |
877 | size_t count, loff_t *ppos) | |
878 | { | |
879 | char buf[32]; | |
880 | unsigned int len; | |
881 | ||
882 | len = sprintf(buf, "%ld\n", tlb_single_page_flush_ceiling); | |
883 | return simple_read_from_buffer(user_buf, count, ppos, buf, len); | |
884 | } | |
885 | ||
886 | static ssize_t tlbflush_write_file(struct file *file, | |
887 | const char __user *user_buf, size_t count, loff_t *ppos) | |
888 | { | |
889 | char buf[32]; | |
890 | ssize_t len; | |
891 | int ceiling; | |
892 | ||
893 | len = min(count, sizeof(buf) - 1); | |
894 | if (copy_from_user(buf, user_buf, len)) | |
895 | return -EFAULT; | |
896 | ||
897 | buf[len] = '\0'; | |
898 | if (kstrtoint(buf, 0, &ceiling)) | |
899 | return -EINVAL; | |
900 | ||
901 | if (ceiling < 0) | |
902 | return -EINVAL; | |
903 | ||
904 | tlb_single_page_flush_ceiling = ceiling; | |
905 | return count; | |
906 | } | |
907 | ||
908 | static const struct file_operations fops_tlbflush = { | |
909 | .read = tlbflush_read_file, | |
910 | .write = tlbflush_write_file, | |
911 | .llseek = default_llseek, | |
912 | }; | |
913 | ||
914 | static int __init create_tlb_single_page_flush_ceiling(void) | |
915 | { | |
916 | debugfs_create_file("tlb_single_page_flush_ceiling", S_IRUSR | S_IWUSR, | |
917 | arch_debugfs_dir, NULL, &fops_tlbflush); | |
918 | return 0; | |
919 | } | |
920 | late_initcall(create_tlb_single_page_flush_ceiling); |