1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/mm.h>
3 #include <linux/gfp.h>
4 #include <linux/hugetlb.h>
5 #include <asm/pgalloc.h>
6 #include <asm/tlb.h>
7 #include <asm/fixmap.h>
8 #include <asm/mtrr.h>
9 
10 #ifdef CONFIG_DYNAMIC_PHYSICAL_MASK
11 phys_addr_t physical_mask __ro_after_init = (1ULL << __PHYSICAL_MASK_SHIFT) - 1;
12 EXPORT_SYMBOL(physical_mask);
13 #endif
14 
15 #ifdef CONFIG_HIGHPTE
16 #define PGTABLE_HIGHMEM __GFP_HIGHMEM
17 #else
18 #define PGTABLE_HIGHMEM 0
19 #endif
20 
21 #ifndef CONFIG_PARAVIRT
22 static inline
paravirt_tlb_remove_table(struct mmu_gather * tlb,void * table)23 void paravirt_tlb_remove_table(struct mmu_gather *tlb, void *table)
24 {
25 	tlb_remove_page(tlb, table);
26 }
27 #endif
28 
29 gfp_t __userpte_alloc_gfp = GFP_PGTABLE_USER | PGTABLE_HIGHMEM;
30 
pte_alloc_one(struct mm_struct * mm)31 pgtable_t pte_alloc_one(struct mm_struct *mm)
32 {
33 	return __pte_alloc_one(mm, __userpte_alloc_gfp);
34 }
35 
setup_userpte(char * arg)36 static int __init setup_userpte(char *arg)
37 {
38 	if (!arg)
39 		return -EINVAL;
40 
41 	/*
42 	 * "userpte=nohigh" disables allocation of user pagetables in
43 	 * high memory.
44 	 */
45 	if (strcmp(arg, "nohigh") == 0)
46 		__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
47 	else
48 		return -EINVAL;
49 	return 0;
50 }
51 early_param("userpte", setup_userpte);
52 
___pte_free_tlb(struct mmu_gather * tlb,struct page * pte)53 void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
54 {
55 	pagetable_pte_dtor(page_ptdesc(pte));
56 	paravirt_release_pte(page_to_pfn(pte));
57 	paravirt_tlb_remove_table(tlb, pte);
58 }
59 
60 #if CONFIG_PGTABLE_LEVELS > 2
___pmd_free_tlb(struct mmu_gather * tlb,pmd_t * pmd)61 void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
62 {
63 	struct ptdesc *ptdesc = virt_to_ptdesc(pmd);
64 	paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
65 	/*
66 	 * NOTE! For PAE, any changes to the top page-directory-pointer-table
67 	 * entries need a full cr3 reload to flush.
68 	 */
69 #ifdef CONFIG_X86_PAE
70 	tlb->need_flush_all = 1;
71 #endif
72 	pagetable_pmd_dtor(ptdesc);
73 	paravirt_tlb_remove_table(tlb, ptdesc_page(ptdesc));
74 }
75 
76 #if CONFIG_PGTABLE_LEVELS > 3
___pud_free_tlb(struct mmu_gather * tlb,pud_t * pud)77 void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
78 {
79 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
80 	paravirt_tlb_remove_table(tlb, virt_to_page(pud));
81 }
82 
83 #if CONFIG_PGTABLE_LEVELS > 4
___p4d_free_tlb(struct mmu_gather * tlb,p4d_t * p4d)84 void ___p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d)
85 {
86 	paravirt_release_p4d(__pa(p4d) >> PAGE_SHIFT);
87 	paravirt_tlb_remove_table(tlb, virt_to_page(p4d));
88 }
89 #endif	/* CONFIG_PGTABLE_LEVELS > 4 */
90 #endif	/* CONFIG_PGTABLE_LEVELS > 3 */
91 #endif	/* CONFIG_PGTABLE_LEVELS > 2 */
92 
pgd_list_add(pgd_t * pgd)93 static inline void pgd_list_add(pgd_t *pgd)
94 {
95 	struct ptdesc *ptdesc = virt_to_ptdesc(pgd);
96 
97 	list_add(&ptdesc->pt_list, &pgd_list);
98 }
99 
pgd_list_del(pgd_t * pgd)100 static inline void pgd_list_del(pgd_t *pgd)
101 {
102 	struct ptdesc *ptdesc = virt_to_ptdesc(pgd);
103 
104 	list_del(&ptdesc->pt_list);
105 }
106 
107 #define UNSHARED_PTRS_PER_PGD				\
108 	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
109 #define MAX_UNSHARED_PTRS_PER_PGD			\
110 	max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)
111 
112 
pgd_set_mm(pgd_t * pgd,struct mm_struct * mm)113 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
114 {
115 	virt_to_ptdesc(pgd)->pt_mm = mm;
116 }
117 
pgd_page_get_mm(struct page * page)118 struct mm_struct *pgd_page_get_mm(struct page *page)
119 {
120 	return page_ptdesc(page)->pt_mm;
121 }
122 
pgd_ctor(struct mm_struct * mm,pgd_t * pgd)123 static void pgd_ctor(struct mm_struct *mm, pgd_t *pgd)
124 {
125 	/* If the pgd points to a shared pagetable level (either the
126 	   ptes in non-PAE, or shared PMD in PAE), then just copy the
127 	   references from swapper_pg_dir. */
128 	if (CONFIG_PGTABLE_LEVELS == 2 ||
129 	    (CONFIG_PGTABLE_LEVELS == 3 && SHARED_KERNEL_PMD) ||
130 	    CONFIG_PGTABLE_LEVELS >= 4) {
131 		clone_pgd_range(pgd + KERNEL_PGD_BOUNDARY,
132 				swapper_pg_dir + KERNEL_PGD_BOUNDARY,
133 				KERNEL_PGD_PTRS);
134 	}
135 
136 	/* list required to sync kernel mapping updates */
137 	if (!SHARED_KERNEL_PMD) {
138 		pgd_set_mm(pgd, mm);
139 		pgd_list_add(pgd);
140 	}
141 }
142 
pgd_dtor(pgd_t * pgd)143 static void pgd_dtor(pgd_t *pgd)
144 {
145 	if (SHARED_KERNEL_PMD)
146 		return;
147 
148 	spin_lock(&pgd_lock);
149 	pgd_list_del(pgd);
150 	spin_unlock(&pgd_lock);
151 }
152 
153 /*
154  * List of all pgd's needed for non-PAE so it can invalidate entries
155  * in both cached and uncached pgd's; not needed for PAE since the
156  * kernel pmd is shared. If PAE were not to share the pmd a similar
157  * tactic would be needed. This is essentially codepath-based locking
158  * against pageattr.c; it is the unique case in which a valid change
159  * of kernel pagetables can't be lazily synchronized by vmalloc faults.
160  * vmalloc faults work because attached pagetables are never freed.
161  * -- nyc
162  */
163 
164 #ifdef CONFIG_X86_PAE
165 /*
166  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
167  * updating the top-level pagetable entries to guarantee the
168  * processor notices the update.  Since this is expensive, and
169  * all 4 top-level entries are used almost immediately in a
170  * new process's life, we just pre-populate them here.
171  *
172  * Also, if we're in a paravirt environment where the kernel pmd is
173  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
174  * and initialize the kernel pmds here.
175  */
176 #define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
177 #define MAX_PREALLOCATED_PMDS	MAX_UNSHARED_PTRS_PER_PGD
178 
179 /*
180  * We allocate separate PMDs for the kernel part of the user page-table
181  * when PTI is enabled. We need them to map the per-process LDT into the
182  * user-space page-table.
183  */
184 #define PREALLOCATED_USER_PMDS	 (boot_cpu_has(X86_FEATURE_PTI) ? \
185 					KERNEL_PGD_PTRS : 0)
186 #define MAX_PREALLOCATED_USER_PMDS KERNEL_PGD_PTRS
187 
pud_populate(struct mm_struct * mm,pud_t * pudp,pmd_t * pmd)188 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
189 {
190 	paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
191 
192 	/* Note: almost everything apart from _PAGE_PRESENT is
193 	   reserved at the pmd (PDPT) level. */
194 	set_pud(pudp, __pud(__pa(pmd) | _PAGE_PRESENT));
195 
196 	/*
197 	 * According to Intel App note "TLBs, Paging-Structure Caches,
198 	 * and Their Invalidation", April 2007, document 317080-001,
199 	 * section 8.1: in PAE mode we explicitly have to flush the
200 	 * TLB via cr3 if the top-level pgd is changed...
201 	 */
202 	flush_tlb_mm(mm);
203 }
204 #else  /* !CONFIG_X86_PAE */
205 
206 /* No need to prepopulate any pagetable entries in non-PAE modes. */
207 #define PREALLOCATED_PMDS	0
208 #define MAX_PREALLOCATED_PMDS	0
209 #define PREALLOCATED_USER_PMDS	 0
210 #define MAX_PREALLOCATED_USER_PMDS 0
211 #endif	/* CONFIG_X86_PAE */
212 
free_pmds(struct mm_struct * mm,pmd_t * pmds[],int count)213 static void free_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
214 {
215 	int i;
216 	struct ptdesc *ptdesc;
217 
218 	for (i = 0; i < count; i++)
219 		if (pmds[i]) {
220 			ptdesc = virt_to_ptdesc(pmds[i]);
221 
222 			pagetable_pmd_dtor(ptdesc);
223 			pagetable_free(ptdesc);
224 			mm_dec_nr_pmds(mm);
225 		}
226 }
227 
preallocate_pmds(struct mm_struct * mm,pmd_t * pmds[],int count)228 static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
229 {
230 	int i;
231 	bool failed = false;
232 	gfp_t gfp = GFP_PGTABLE_USER;
233 
234 	if (mm == &init_mm)
235 		gfp &= ~__GFP_ACCOUNT;
236 	gfp &= ~__GFP_HIGHMEM;
237 
238 	for (i = 0; i < count; i++) {
239 		pmd_t *pmd = NULL;
240 		struct ptdesc *ptdesc = pagetable_alloc(gfp, 0);
241 
242 		if (!ptdesc)
243 			failed = true;
244 		if (ptdesc && !pagetable_pmd_ctor(ptdesc)) {
245 			pagetable_free(ptdesc);
246 			ptdesc = NULL;
247 			failed = true;
248 		}
249 		if (ptdesc) {
250 			mm_inc_nr_pmds(mm);
251 			pmd = ptdesc_address(ptdesc);
252 		}
253 
254 		pmds[i] = pmd;
255 	}
256 
257 	if (failed) {
258 		free_pmds(mm, pmds, count);
259 		return -ENOMEM;
260 	}
261 
262 	return 0;
263 }
264 
265 /*
266  * Mop up any pmd pages which may still be attached to the pgd.
267  * Normally they will be freed by munmap/exit_mmap, but any pmd we
268  * preallocate which never got a corresponding vma will need to be
269  * freed manually.
270  */
mop_up_one_pmd(struct mm_struct * mm,pgd_t * pgdp)271 static void mop_up_one_pmd(struct mm_struct *mm, pgd_t *pgdp)
272 {
273 	pgd_t pgd = *pgdp;
274 
275 	if (pgd_val(pgd) != 0) {
276 		pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
277 
278 		pgd_clear(pgdp);
279 
280 		paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
281 		pmd_free(mm, pmd);
282 		mm_dec_nr_pmds(mm);
283 	}
284 }
285 
pgd_mop_up_pmds(struct mm_struct * mm,pgd_t * pgdp)286 static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
287 {
288 	int i;
289 
290 	for (i = 0; i < PREALLOCATED_PMDS; i++)
291 		mop_up_one_pmd(mm, &pgdp[i]);
292 
293 #ifdef CONFIG_PAGE_TABLE_ISOLATION
294 
295 	if (!boot_cpu_has(X86_FEATURE_PTI))
296 		return;
297 
298 	pgdp = kernel_to_user_pgdp(pgdp);
299 
300 	for (i = 0; i < PREALLOCATED_USER_PMDS; i++)
301 		mop_up_one_pmd(mm, &pgdp[i + KERNEL_PGD_BOUNDARY]);
302 #endif
303 }
304 
pgd_prepopulate_pmd(struct mm_struct * mm,pgd_t * pgd,pmd_t * pmds[])305 static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
306 {
307 	p4d_t *p4d;
308 	pud_t *pud;
309 	int i;
310 
311 	p4d = p4d_offset(pgd, 0);
312 	pud = pud_offset(p4d, 0);
313 
314 	for (i = 0; i < PREALLOCATED_PMDS; i++, pud++) {
315 		pmd_t *pmd = pmds[i];
316 
317 		if (i >= KERNEL_PGD_BOUNDARY)
318 			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
319 			       sizeof(pmd_t) * PTRS_PER_PMD);
320 
321 		pud_populate(mm, pud, pmd);
322 	}
323 }
324 
325 #ifdef CONFIG_PAGE_TABLE_ISOLATION
pgd_prepopulate_user_pmd(struct mm_struct * mm,pgd_t * k_pgd,pmd_t * pmds[])326 static void pgd_prepopulate_user_pmd(struct mm_struct *mm,
327 				     pgd_t *k_pgd, pmd_t *pmds[])
328 {
329 	pgd_t *s_pgd = kernel_to_user_pgdp(swapper_pg_dir);
330 	pgd_t *u_pgd = kernel_to_user_pgdp(k_pgd);
331 	p4d_t *u_p4d;
332 	pud_t *u_pud;
333 	int i;
334 
335 	u_p4d = p4d_offset(u_pgd, 0);
336 	u_pud = pud_offset(u_p4d, 0);
337 
338 	s_pgd += KERNEL_PGD_BOUNDARY;
339 	u_pud += KERNEL_PGD_BOUNDARY;
340 
341 	for (i = 0; i < PREALLOCATED_USER_PMDS; i++, u_pud++, s_pgd++) {
342 		pmd_t *pmd = pmds[i];
343 
344 		memcpy(pmd, (pmd_t *)pgd_page_vaddr(*s_pgd),
345 		       sizeof(pmd_t) * PTRS_PER_PMD);
346 
347 		pud_populate(mm, u_pud, pmd);
348 	}
349 
350 }
351 #else
pgd_prepopulate_user_pmd(struct mm_struct * mm,pgd_t * k_pgd,pmd_t * pmds[])352 static void pgd_prepopulate_user_pmd(struct mm_struct *mm,
353 				     pgd_t *k_pgd, pmd_t *pmds[])
354 {
355 }
356 #endif
357 /*
358  * Xen paravirt assumes pgd table should be in one page. 64 bit kernel also
359  * assumes that pgd should be in one page.
360  *
361  * But kernel with PAE paging that is not running as a Xen domain
362  * only needs to allocate 32 bytes for pgd instead of one page.
363  */
364 #ifdef CONFIG_X86_PAE
365 
366 #include <linux/slab.h>
367 
368 #define PGD_SIZE	(PTRS_PER_PGD * sizeof(pgd_t))
369 #define PGD_ALIGN	32
370 
371 static struct kmem_cache *pgd_cache;
372 
pgtable_cache_init(void)373 void __init pgtable_cache_init(void)
374 {
375 	/*
376 	 * When PAE kernel is running as a Xen domain, it does not use
377 	 * shared kernel pmd. And this requires a whole page for pgd.
378 	 */
379 	if (!SHARED_KERNEL_PMD)
380 		return;
381 
382 	/*
383 	 * when PAE kernel is not running as a Xen domain, it uses
384 	 * shared kernel pmd. Shared kernel pmd does not require a whole
385 	 * page for pgd. We are able to just allocate a 32-byte for pgd.
386 	 * During boot time, we create a 32-byte slab for pgd table allocation.
387 	 */
388 	pgd_cache = kmem_cache_create("pgd_cache", PGD_SIZE, PGD_ALIGN,
389 				      SLAB_PANIC, NULL);
390 }
391 
_pgd_alloc(void)392 static inline pgd_t *_pgd_alloc(void)
393 {
394 	/*
395 	 * If no SHARED_KERNEL_PMD, PAE kernel is running as a Xen domain.
396 	 * We allocate one page for pgd.
397 	 */
398 	if (!SHARED_KERNEL_PMD)
399 		return (pgd_t *)__get_free_pages(GFP_PGTABLE_USER,
400 						 PGD_ALLOCATION_ORDER);
401 
402 	/*
403 	 * Now PAE kernel is not running as a Xen domain. We can allocate
404 	 * a 32-byte slab for pgd to save memory space.
405 	 */
406 	return kmem_cache_alloc(pgd_cache, GFP_PGTABLE_USER);
407 }
408 
_pgd_free(pgd_t * pgd)409 static inline void _pgd_free(pgd_t *pgd)
410 {
411 	if (!SHARED_KERNEL_PMD)
412 		free_pages((unsigned long)pgd, PGD_ALLOCATION_ORDER);
413 	else
414 		kmem_cache_free(pgd_cache, pgd);
415 }
416 #else
417 
_pgd_alloc(void)418 static inline pgd_t *_pgd_alloc(void)
419 {
420 	return (pgd_t *)__get_free_pages(GFP_PGTABLE_USER,
421 					 PGD_ALLOCATION_ORDER);
422 }
423 
_pgd_free(pgd_t * pgd)424 static inline void _pgd_free(pgd_t *pgd)
425 {
426 	free_pages((unsigned long)pgd, PGD_ALLOCATION_ORDER);
427 }
428 #endif /* CONFIG_X86_PAE */
429 
pgd_alloc(struct mm_struct * mm)430 pgd_t *pgd_alloc(struct mm_struct *mm)
431 {
432 	pgd_t *pgd;
433 	pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
434 	pmd_t *pmds[MAX_PREALLOCATED_PMDS];
435 
436 	pgd = _pgd_alloc();
437 
438 	if (pgd == NULL)
439 		goto out;
440 
441 	mm->pgd = pgd;
442 
443 	if (sizeof(pmds) != 0 &&
444 			preallocate_pmds(mm, pmds, PREALLOCATED_PMDS) != 0)
445 		goto out_free_pgd;
446 
447 	if (sizeof(u_pmds) != 0 &&
448 			preallocate_pmds(mm, u_pmds, PREALLOCATED_USER_PMDS) != 0)
449 		goto out_free_pmds;
450 
451 	if (paravirt_pgd_alloc(mm) != 0)
452 		goto out_free_user_pmds;
453 
454 	/*
455 	 * Make sure that pre-populating the pmds is atomic with
456 	 * respect to anything walking the pgd_list, so that they
457 	 * never see a partially populated pgd.
458 	 */
459 	spin_lock(&pgd_lock);
460 
461 	pgd_ctor(mm, pgd);
462 	if (sizeof(pmds) != 0)
463 		pgd_prepopulate_pmd(mm, pgd, pmds);
464 
465 	if (sizeof(u_pmds) != 0)
466 		pgd_prepopulate_user_pmd(mm, pgd, u_pmds);
467 
468 	spin_unlock(&pgd_lock);
469 
470 	return pgd;
471 
472 out_free_user_pmds:
473 	if (sizeof(u_pmds) != 0)
474 		free_pmds(mm, u_pmds, PREALLOCATED_USER_PMDS);
475 out_free_pmds:
476 	if (sizeof(pmds) != 0)
477 		free_pmds(mm, pmds, PREALLOCATED_PMDS);
478 out_free_pgd:
479 	_pgd_free(pgd);
480 out:
481 	return NULL;
482 }
483 
pgd_free(struct mm_struct * mm,pgd_t * pgd)484 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
485 {
486 	pgd_mop_up_pmds(mm, pgd);
487 	pgd_dtor(pgd);
488 	paravirt_pgd_free(mm, pgd);
489 	_pgd_free(pgd);
490 }
491 
492 /*
493  * Used to set accessed or dirty bits in the page table entries
494  * on other architectures. On x86, the accessed and dirty bits
495  * are tracked by hardware. However, do_wp_page calls this function
496  * to also make the pte writeable at the same time the dirty bit is
497  * set. In that case we do actually need to write the PTE.
498  */
ptep_set_access_flags(struct vm_area_struct * vma,unsigned long address,pte_t * ptep,pte_t entry,int dirty)499 int ptep_set_access_flags(struct vm_area_struct *vma,
500 			  unsigned long address, pte_t *ptep,
501 			  pte_t entry, int dirty)
502 {
503 	int changed = !pte_same(*ptep, entry);
504 
505 	if (changed && dirty)
506 		set_pte(ptep, entry);
507 
508 	return changed;
509 }
510 
511 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
pmdp_set_access_flags(struct vm_area_struct * vma,unsigned long address,pmd_t * pmdp,pmd_t entry,int dirty)512 int pmdp_set_access_flags(struct vm_area_struct *vma,
513 			  unsigned long address, pmd_t *pmdp,
514 			  pmd_t entry, int dirty)
515 {
516 	int changed = !pmd_same(*pmdp, entry);
517 
518 	VM_BUG_ON(address & ~HPAGE_PMD_MASK);
519 
520 	if (changed && dirty) {
521 		set_pmd(pmdp, entry);
522 		/*
523 		 * We had a write-protection fault here and changed the pmd
524 		 * to to more permissive. No need to flush the TLB for that,
525 		 * #PF is architecturally guaranteed to do that and in the
526 		 * worst-case we'll generate a spurious fault.
527 		 */
528 	}
529 
530 	return changed;
531 }
532 
pudp_set_access_flags(struct vm_area_struct * vma,unsigned long address,pud_t * pudp,pud_t entry,int dirty)533 int pudp_set_access_flags(struct vm_area_struct *vma, unsigned long address,
534 			  pud_t *pudp, pud_t entry, int dirty)
535 {
536 	int changed = !pud_same(*pudp, entry);
537 
538 	VM_BUG_ON(address & ~HPAGE_PUD_MASK);
539 
540 	if (changed && dirty) {
541 		set_pud(pudp, entry);
542 		/*
543 		 * We had a write-protection fault here and changed the pud
544 		 * to to more permissive. No need to flush the TLB for that,
545 		 * #PF is architecturally guaranteed to do that and in the
546 		 * worst-case we'll generate a spurious fault.
547 		 */
548 	}
549 
550 	return changed;
551 }
552 #endif
553 
ptep_test_and_clear_young(struct vm_area_struct * vma,unsigned long addr,pte_t * ptep)554 int ptep_test_and_clear_young(struct vm_area_struct *vma,
555 			      unsigned long addr, pte_t *ptep)
556 {
557 	int ret = 0;
558 
559 	if (pte_young(*ptep))
560 		ret = test_and_clear_bit(_PAGE_BIT_ACCESSED,
561 					 (unsigned long *) &ptep->pte);
562 
563 	return ret;
564 }
565 
566 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG)
pmdp_test_and_clear_young(struct vm_area_struct * vma,unsigned long addr,pmd_t * pmdp)567 int pmdp_test_and_clear_young(struct vm_area_struct *vma,
568 			      unsigned long addr, pmd_t *pmdp)
569 {
570 	int ret = 0;
571 
572 	if (pmd_young(*pmdp))
573 		ret = test_and_clear_bit(_PAGE_BIT_ACCESSED,
574 					 (unsigned long *)pmdp);
575 
576 	return ret;
577 }
578 #endif
579 
580 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
pudp_test_and_clear_young(struct vm_area_struct * vma,unsigned long addr,pud_t * pudp)581 int pudp_test_and_clear_young(struct vm_area_struct *vma,
582 			      unsigned long addr, pud_t *pudp)
583 {
584 	int ret = 0;
585 
586 	if (pud_young(*pudp))
587 		ret = test_and_clear_bit(_PAGE_BIT_ACCESSED,
588 					 (unsigned long *)pudp);
589 
590 	return ret;
591 }
592 #endif
593 
ptep_clear_flush_young(struct vm_area_struct * vma,unsigned long address,pte_t * ptep)594 int ptep_clear_flush_young(struct vm_area_struct *vma,
595 			   unsigned long address, pte_t *ptep)
596 {
597 	/*
598 	 * On x86 CPUs, clearing the accessed bit without a TLB flush
599 	 * doesn't cause data corruption. [ It could cause incorrect
600 	 * page aging and the (mistaken) reclaim of hot pages, but the
601 	 * chance of that should be relatively low. ]
602 	 *
603 	 * So as a performance optimization don't flush the TLB when
604 	 * clearing the accessed bit, it will eventually be flushed by
605 	 * a context switch or a VM operation anyway. [ In the rare
606 	 * event of it not getting flushed for a long time the delay
607 	 * shouldn't really matter because there's no real memory
608 	 * pressure for swapout to react to. ]
609 	 */
610 	return ptep_test_and_clear_young(vma, address, ptep);
611 }
612 
613 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
pmdp_clear_flush_young(struct vm_area_struct * vma,unsigned long address,pmd_t * pmdp)614 int pmdp_clear_flush_young(struct vm_area_struct *vma,
615 			   unsigned long address, pmd_t *pmdp)
616 {
617 	int young;
618 
619 	VM_BUG_ON(address & ~HPAGE_PMD_MASK);
620 
621 	young = pmdp_test_and_clear_young(vma, address, pmdp);
622 	if (young)
623 		flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
624 
625 	return young;
626 }
627 
pmdp_invalidate_ad(struct vm_area_struct * vma,unsigned long address,pmd_t * pmdp)628 pmd_t pmdp_invalidate_ad(struct vm_area_struct *vma, unsigned long address,
629 			 pmd_t *pmdp)
630 {
631 	/*
632 	 * No flush is necessary. Once an invalid PTE is established, the PTE's
633 	 * access and dirty bits cannot be updated.
634 	 */
635 	return pmdp_establish(vma, address, pmdp, pmd_mkinvalid(*pmdp));
636 }
637 #endif
638 
639 /**
640  * reserve_top_address - reserves a hole in the top of kernel address space
641  * @reserve - size of hole to reserve
642  *
643  * Can be used to relocate the fixmap area and poke a hole in the top
644  * of kernel address space to make room for a hypervisor.
645  */
reserve_top_address(unsigned long reserve)646 void __init reserve_top_address(unsigned long reserve)
647 {
648 #ifdef CONFIG_X86_32
649 	BUG_ON(fixmaps_set > 0);
650 	__FIXADDR_TOP = round_down(-reserve, 1 << PMD_SHIFT) - PAGE_SIZE;
651 	printk(KERN_INFO "Reserving virtual address space above 0x%08lx (rounded to 0x%08lx)\n",
652 	       -reserve, __FIXADDR_TOP + PAGE_SIZE);
653 #endif
654 }
655 
656 int fixmaps_set;
657 
__native_set_fixmap(enum fixed_addresses idx,pte_t pte)658 void __native_set_fixmap(enum fixed_addresses idx, pte_t pte)
659 {
660 	unsigned long address = __fix_to_virt(idx);
661 
662 #ifdef CONFIG_X86_64
663        /*
664 	* Ensure that the static initial page tables are covering the
665 	* fixmap completely.
666 	*/
667 	BUILD_BUG_ON(__end_of_permanent_fixed_addresses >
668 		     (FIXMAP_PMD_NUM * PTRS_PER_PTE));
669 #endif
670 
671 	if (idx >= __end_of_fixed_addresses) {
672 		BUG();
673 		return;
674 	}
675 	set_pte_vaddr(address, pte);
676 	fixmaps_set++;
677 }
678 
native_set_fixmap(unsigned idx,phys_addr_t phys,pgprot_t flags)679 void native_set_fixmap(unsigned /* enum fixed_addresses */ idx,
680 		       phys_addr_t phys, pgprot_t flags)
681 {
682 	/* Sanitize 'prot' against any unsupported bits: */
683 	pgprot_val(flags) &= __default_kernel_pte_mask;
684 
685 	__native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags));
686 }
687 
688 #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
689 #ifdef CONFIG_X86_5LEVEL
690 /**
691  * p4d_set_huge - setup kernel P4D mapping
692  *
693  * No 512GB pages yet -- always return 0
694  */
p4d_set_huge(p4d_t * p4d,phys_addr_t addr,pgprot_t prot)695 int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
696 {
697 	return 0;
698 }
699 
700 /**
701  * p4d_clear_huge - clear kernel P4D mapping when it is set
702  *
703  * No 512GB pages yet -- always return 0
704  */
p4d_clear_huge(p4d_t * p4d)705 void p4d_clear_huge(p4d_t *p4d)
706 {
707 }
708 #endif
709 
710 /**
711  * pud_set_huge - setup kernel PUD mapping
712  *
713  * MTRRs can override PAT memory types with 4KiB granularity. Therefore, this
714  * function sets up a huge page only if the complete range has the same MTRR
715  * caching mode.
716  *
717  * Callers should try to decrease page size (1GB -> 2MB -> 4K) if the bigger
718  * page mapping attempt fails.
719  *
720  * Returns 1 on success and 0 on failure.
721  */
pud_set_huge(pud_t * pud,phys_addr_t addr,pgprot_t prot)722 int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot)
723 {
724 	u8 uniform;
725 
726 	mtrr_type_lookup(addr, addr + PUD_SIZE, &uniform);
727 	if (!uniform)
728 		return 0;
729 
730 	/* Bail out if we are we on a populated non-leaf entry: */
731 	if (pud_present(*pud) && !pud_huge(*pud))
732 		return 0;
733 
734 	set_pte((pte_t *)pud, pfn_pte(
735 		(u64)addr >> PAGE_SHIFT,
736 		__pgprot(protval_4k_2_large(pgprot_val(prot)) | _PAGE_PSE)));
737 
738 	return 1;
739 }
740 
741 /**
742  * pmd_set_huge - setup kernel PMD mapping
743  *
744  * See text over pud_set_huge() above.
745  *
746  * Returns 1 on success and 0 on failure.
747  */
pmd_set_huge(pmd_t * pmd,phys_addr_t addr,pgprot_t prot)748 int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
749 {
750 	u8 uniform;
751 
752 	mtrr_type_lookup(addr, addr + PMD_SIZE, &uniform);
753 	if (!uniform) {
754 		pr_warn_once("%s: Cannot satisfy [mem %#010llx-%#010llx] with a huge-page mapping due to MTRR override.\n",
755 			     __func__, addr, addr + PMD_SIZE);
756 		return 0;
757 	}
758 
759 	/* Bail out if we are we on a populated non-leaf entry: */
760 	if (pmd_present(*pmd) && !pmd_huge(*pmd))
761 		return 0;
762 
763 	set_pte((pte_t *)pmd, pfn_pte(
764 		(u64)addr >> PAGE_SHIFT,
765 		__pgprot(protval_4k_2_large(pgprot_val(prot)) | _PAGE_PSE)));
766 
767 	return 1;
768 }
769 
770 /**
771  * pud_clear_huge - clear kernel PUD mapping when it is set
772  *
773  * Returns 1 on success and 0 on failure (no PUD map is found).
774  */
pud_clear_huge(pud_t * pud)775 int pud_clear_huge(pud_t *pud)
776 {
777 	if (pud_large(*pud)) {
778 		pud_clear(pud);
779 		return 1;
780 	}
781 
782 	return 0;
783 }
784 
785 /**
786  * pmd_clear_huge - clear kernel PMD mapping when it is set
787  *
788  * Returns 1 on success and 0 on failure (no PMD map is found).
789  */
pmd_clear_huge(pmd_t * pmd)790 int pmd_clear_huge(pmd_t *pmd)
791 {
792 	if (pmd_large(*pmd)) {
793 		pmd_clear(pmd);
794 		return 1;
795 	}
796 
797 	return 0;
798 }
799 
800 #ifdef CONFIG_X86_64
801 /**
802  * pud_free_pmd_page - Clear pud entry and free pmd page.
803  * @pud: Pointer to a PUD.
804  * @addr: Virtual address associated with pud.
805  *
806  * Context: The pud range has been unmapped and TLB purged.
807  * Return: 1 if clearing the entry succeeded. 0 otherwise.
808  *
809  * NOTE: Callers must allow a single page allocation.
810  */
pud_free_pmd_page(pud_t * pud,unsigned long addr)811 int pud_free_pmd_page(pud_t *pud, unsigned long addr)
812 {
813 	pmd_t *pmd, *pmd_sv;
814 	pte_t *pte;
815 	int i;
816 
817 	pmd = pud_pgtable(*pud);
818 	pmd_sv = (pmd_t *)__get_free_page(GFP_KERNEL);
819 	if (!pmd_sv)
820 		return 0;
821 
822 	for (i = 0; i < PTRS_PER_PMD; i++) {
823 		pmd_sv[i] = pmd[i];
824 		if (!pmd_none(pmd[i]))
825 			pmd_clear(&pmd[i]);
826 	}
827 
828 	pud_clear(pud);
829 
830 	/* INVLPG to clear all paging-structure caches */
831 	flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1);
832 
833 	for (i = 0; i < PTRS_PER_PMD; i++) {
834 		if (!pmd_none(pmd_sv[i])) {
835 			pte = (pte_t *)pmd_page_vaddr(pmd_sv[i]);
836 			free_page((unsigned long)pte);
837 		}
838 	}
839 
840 	free_page((unsigned long)pmd_sv);
841 
842 	pagetable_pmd_dtor(virt_to_ptdesc(pmd));
843 	free_page((unsigned long)pmd);
844 
845 	return 1;
846 }
847 
848 /**
849  * pmd_free_pte_page - Clear pmd entry and free pte page.
850  * @pmd: Pointer to a PMD.
851  * @addr: Virtual address associated with pmd.
852  *
853  * Context: The pmd range has been unmapped and TLB purged.
854  * Return: 1 if clearing the entry succeeded. 0 otherwise.
855  */
pmd_free_pte_page(pmd_t * pmd,unsigned long addr)856 int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
857 {
858 	pte_t *pte;
859 
860 	pte = (pte_t *)pmd_page_vaddr(*pmd);
861 	pmd_clear(pmd);
862 
863 	/* INVLPG to clear all paging-structure caches */
864 	flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1);
865 
866 	free_page((unsigned long)pte);
867 
868 	return 1;
869 }
870 
871 #else /* !CONFIG_X86_64 */
872 
873 /*
874  * Disable free page handling on x86-PAE. This assures that ioremap()
875  * does not update sync'd pmd entries. See vmalloc_sync_one().
876  */
pmd_free_pte_page(pmd_t * pmd,unsigned long addr)877 int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
878 {
879 	return pmd_none(*pmd);
880 }
881 
882 #endif /* CONFIG_X86_64 */
883 #endif	/* CONFIG_HAVE_ARCH_HUGE_VMAP */
884 
pte_mkwrite(pte_t pte,struct vm_area_struct * vma)885 pte_t pte_mkwrite(pte_t pte, struct vm_area_struct *vma)
886 {
887 	if (vma->vm_flags & VM_SHADOW_STACK)
888 		return pte_mkwrite_shstk(pte);
889 
890 	pte = pte_mkwrite_novma(pte);
891 
892 	return pte_clear_saveddirty(pte);
893 }
894 
pmd_mkwrite(pmd_t pmd,struct vm_area_struct * vma)895 pmd_t pmd_mkwrite(pmd_t pmd, struct vm_area_struct *vma)
896 {
897 	if (vma->vm_flags & VM_SHADOW_STACK)
898 		return pmd_mkwrite_shstk(pmd);
899 
900 	pmd = pmd_mkwrite_novma(pmd);
901 
902 	return pmd_clear_saveddirty(pmd);
903 }
904 
arch_check_zapped_pte(struct vm_area_struct * vma,pte_t pte)905 void arch_check_zapped_pte(struct vm_area_struct *vma, pte_t pte)
906 {
907 	/*
908 	 * Hardware before shadow stack can (rarely) set Dirty=1
909 	 * on a Write=0 PTE. So the below condition
910 	 * only indicates a software bug when shadow stack is
911 	 * supported by the HW. This checking is covered in
912 	 * pte_shstk().
913 	 */
914 	VM_WARN_ON_ONCE(!(vma->vm_flags & VM_SHADOW_STACK) &&
915 			pte_shstk(pte));
916 }
917 
arch_check_zapped_pmd(struct vm_area_struct * vma,pmd_t pmd)918 void arch_check_zapped_pmd(struct vm_area_struct *vma, pmd_t pmd)
919 {
920 	/* See note in arch_check_zapped_pte() */
921 	VM_WARN_ON_ONCE(!(vma->vm_flags & VM_SHADOW_STACK) &&
922 			pmd_shstk(pmd));
923 }
924