1 // SPDX-License-Identifier: GPL-2.0
2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
4 #include <linux/errno.h>
5 #include <linux/kernel.h>
8 #include <linux/prctl.h>
9 #include <linux/slab.h>
10 #include <linux/sched.h>
11 #include <linux/sched/idle.h>
12 #include <linux/sched/debug.h>
13 #include <linux/sched/task.h>
14 #include <linux/sched/task_stack.h>
15 #include <linux/init.h>
16 #include <linux/export.h>
18 #include <linux/tick.h>
19 #include <linux/random.h>
20 #include <linux/user-return-notifier.h>
21 #include <linux/dmi.h>
22 #include <linux/utsname.h>
23 #include <linux/stackprotector.h>
24 #include <linux/cpuidle.h>
25 #include <linux/acpi.h>
26 #include <linux/elf-randomize.h>
27 #include <trace/events/power.h>
28 #include <linux/hw_breakpoint.h>
31 #include <asm/syscalls.h>
32 #include <linux/uaccess.h>
33 #include <asm/mwait.h>
34 #include <asm/fpu/internal.h>
35 #include <asm/debugreg.h>
37 #include <asm/tlbflush.h>
40 #include <asm/switch_to.h>
42 #include <asm/prctl.h>
43 #include <asm/spec-ctrl.h>
44 #include <asm/proto.h>
49 * per-CPU TSS segments. Threads are completely 'soft' on Linux,
50 * no more per-task TSS's. The TSS size is kept cacheline-aligned
51 * so they are allowed to end up in the .data..cacheline_aligned
52 * section. Since TSS's are completely CPU-local, we want them
53 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
55 __visible
DEFINE_PER_CPU_PAGE_ALIGNED(struct tss_struct
, cpu_tss_rw
) = {
58 * .sp0 is only used when entering ring 0 from a lower
59 * privilege level. Since the init task never runs anything
60 * but ring 0 code, there is no need for a valid value here.
63 .sp0
= (1UL << (BITS_PER_LONG
-1)) + 1,
66 * .sp1 is cpu_current_top_of_stack. The init task never
67 * runs user code, but cpu_current_top_of_stack should still
68 * be well defined before the first context switch.
70 .sp1
= TOP_OF_INIT_STACK
,
75 .io_bitmap_base
= INVALID_IO_BITMAP_OFFSET
,
80 * Note that the .io_bitmap member must be extra-big. This is because
81 * the CPU will access an additional byte beyond the end of the IO
82 * permission bitmap. The extra byte must be all 1 bits, and must
83 * be within the limit.
85 .io_bitmap
= { [0 ... IO_BITMAP_LONGS
] = ~0 },
88 EXPORT_PER_CPU_SYMBOL(cpu_tss_rw
);
90 DEFINE_PER_CPU(bool, __tss_limit_invalid
);
91 EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid
);
94 * this gets called so that we can store lazy state into memory and copy the
95 * current task into the new thread.
97 int arch_dup_task_struct(struct task_struct
*dst
, struct task_struct
*src
)
99 memcpy(dst
, src
, arch_task_struct_size
);
101 dst
->thread
.vm86
= NULL
;
104 return fpu__copy(&dst
->thread
.fpu
, &src
->thread
.fpu
);
108 * Free current thread data structures etc..
110 void exit_thread(struct task_struct
*tsk
)
112 struct thread_struct
*t
= &tsk
->thread
;
113 unsigned long *bp
= t
->io_bitmap_ptr
;
114 struct fpu
*fpu
= &t
->fpu
;
117 struct tss_struct
*tss
= &per_cpu(cpu_tss_rw
, get_cpu());
119 t
->io_bitmap_ptr
= NULL
;
120 clear_thread_flag(TIF_IO_BITMAP
);
122 * Careful, clear this in the TSS too:
124 memset(tss
->io_bitmap
, 0xff, t
->io_bitmap_max
);
125 t
->io_bitmap_max
= 0;
135 void flush_thread(void)
137 struct task_struct
*tsk
= current
;
139 flush_ptrace_hw_breakpoint(tsk
);
140 memset(tsk
->thread
.tls_array
, 0, sizeof(tsk
->thread
.tls_array
));
142 fpu__clear(&tsk
->thread
.fpu
);
145 void disable_TSC(void)
148 if (!test_and_set_thread_flag(TIF_NOTSC
))
150 * Must flip the CPU state synchronously with
151 * TIF_NOTSC in the current running context.
153 cr4_set_bits(X86_CR4_TSD
);
157 static void enable_TSC(void)
160 if (test_and_clear_thread_flag(TIF_NOTSC
))
162 * Must flip the CPU state synchronously with
163 * TIF_NOTSC in the current running context.
165 cr4_clear_bits(X86_CR4_TSD
);
169 int get_tsc_mode(unsigned long adr
)
173 if (test_thread_flag(TIF_NOTSC
))
174 val
= PR_TSC_SIGSEGV
;
178 return put_user(val
, (unsigned int __user
*)adr
);
181 int set_tsc_mode(unsigned int val
)
183 if (val
== PR_TSC_SIGSEGV
)
185 else if (val
== PR_TSC_ENABLE
)
193 DEFINE_PER_CPU(u64
, msr_misc_features_shadow
);
195 static void set_cpuid_faulting(bool on
)
199 msrval
= this_cpu_read(msr_misc_features_shadow
);
200 msrval
&= ~MSR_MISC_FEATURES_ENABLES_CPUID_FAULT
;
201 msrval
|= (on
<< MSR_MISC_FEATURES_ENABLES_CPUID_FAULT_BIT
);
202 this_cpu_write(msr_misc_features_shadow
, msrval
);
203 wrmsrl(MSR_MISC_FEATURES_ENABLES
, msrval
);
206 static void disable_cpuid(void)
209 if (!test_and_set_thread_flag(TIF_NOCPUID
)) {
211 * Must flip the CPU state synchronously with
212 * TIF_NOCPUID in the current running context.
214 set_cpuid_faulting(true);
219 static void enable_cpuid(void)
222 if (test_and_clear_thread_flag(TIF_NOCPUID
)) {
224 * Must flip the CPU state synchronously with
225 * TIF_NOCPUID in the current running context.
227 set_cpuid_faulting(false);
232 static int get_cpuid_mode(void)
234 return !test_thread_flag(TIF_NOCPUID
);
237 static int set_cpuid_mode(struct task_struct
*task
, unsigned long cpuid_enabled
)
239 if (!static_cpu_has(X86_FEATURE_CPUID_FAULT
))
251 * Called immediately after a successful exec.
253 void arch_setup_new_exec(void)
255 /* If cpuid was previously disabled for this task, re-enable it. */
256 if (test_thread_flag(TIF_NOCPUID
))
260 static inline void switch_to_bitmap(struct thread_struct
*prev
,
261 struct thread_struct
*next
,
262 unsigned long tifp
, unsigned long tifn
)
264 struct tss_struct
*tss
= this_cpu_ptr(&cpu_tss_rw
);
266 if (tifn
& _TIF_IO_BITMAP
) {
268 * Copy the relevant range of the IO bitmap.
269 * Normally this is 128 bytes or less:
271 memcpy(tss
->io_bitmap
, next
->io_bitmap_ptr
,
272 max(prev
->io_bitmap_max
, next
->io_bitmap_max
));
274 * Make sure that the TSS limit is correct for the CPU
275 * to notice the IO bitmap.
278 } else if (tifp
& _TIF_IO_BITMAP
) {
280 * Clear any possible leftover bits:
282 memset(tss
->io_bitmap
, 0xff, prev
->io_bitmap_max
);
289 struct ssb_state
*shared_state
;
291 unsigned int disable_state
;
292 unsigned long local_state
;
297 static DEFINE_PER_CPU(struct ssb_state
, ssb_state
);
299 void speculative_store_bypass_ht_init(void)
301 struct ssb_state
*st
= this_cpu_ptr(&ssb_state
);
302 unsigned int this_cpu
= smp_processor_id();
308 * Shared state setup happens once on the first bringup
309 * of the CPU. It's not destroyed on CPU hotunplug.
311 if (st
->shared_state
)
314 raw_spin_lock_init(&st
->lock
);
317 * Go over HT siblings and check whether one of them has set up the
318 * shared state pointer already.
320 for_each_cpu(cpu
, topology_sibling_cpumask(this_cpu
)) {
324 if (!per_cpu(ssb_state
, cpu
).shared_state
)
327 /* Link it to the state of the sibling: */
328 st
->shared_state
= per_cpu(ssb_state
, cpu
).shared_state
;
333 * First HT sibling to come up on the core. Link shared state of
334 * the first HT sibling to itself. The siblings on the same core
335 * which come up later will see the shared state pointer and link
336 * themself to the state of this CPU.
338 st
->shared_state
= st
;
342 * Logic is: First HT sibling enables SSBD for both siblings in the core
343 * and last sibling to disable it, disables it for the whole core. This how
344 * MSR_SPEC_CTRL works in "hardware":
346 * CORE_SPEC_CTRL = THREAD0_SPEC_CTRL | THREAD1_SPEC_CTRL
348 static __always_inline
void amd_set_core_ssb_state(unsigned long tifn
)
350 struct ssb_state
*st
= this_cpu_ptr(&ssb_state
);
351 u64 msr
= x86_amd_ls_cfg_base
;
353 if (!static_cpu_has(X86_FEATURE_ZEN
)) {
354 msr
|= ssbd_tif_to_amd_ls_cfg(tifn
);
355 wrmsrl(MSR_AMD64_LS_CFG
, msr
);
359 if (tifn
& _TIF_SSBD
) {
361 * Since this can race with prctl(), block reentry on the
364 if (__test_and_set_bit(LSTATE_SSB
, &st
->local_state
))
367 msr
|= x86_amd_ls_cfg_ssbd_mask
;
369 raw_spin_lock(&st
->shared_state
->lock
);
370 /* First sibling enables SSBD: */
371 if (!st
->shared_state
->disable_state
)
372 wrmsrl(MSR_AMD64_LS_CFG
, msr
);
373 st
->shared_state
->disable_state
++;
374 raw_spin_unlock(&st
->shared_state
->lock
);
376 if (!__test_and_clear_bit(LSTATE_SSB
, &st
->local_state
))
379 raw_spin_lock(&st
->shared_state
->lock
);
380 st
->shared_state
->disable_state
--;
381 if (!st
->shared_state
->disable_state
)
382 wrmsrl(MSR_AMD64_LS_CFG
, msr
);
383 raw_spin_unlock(&st
->shared_state
->lock
);
387 static __always_inline
void amd_set_core_ssb_state(unsigned long tifn
)
389 u64 msr
= x86_amd_ls_cfg_base
| ssbd_tif_to_amd_ls_cfg(tifn
);
391 wrmsrl(MSR_AMD64_LS_CFG
, msr
);
395 static __always_inline
void amd_set_ssb_virt_state(unsigned long tifn
)
398 * SSBD has the same definition in SPEC_CTRL and VIRT_SPEC_CTRL,
399 * so ssbd_tif_to_spec_ctrl() just works.
401 wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL
, ssbd_tif_to_spec_ctrl(tifn
));
405 * Update the MSRs managing speculation control, during context switch.
407 * tifp: Previous task's thread flags
408 * tifn: Next task's thread flags
410 static __always_inline
void __speculation_ctrl_update(unsigned long tifp
,
413 unsigned long tif_diff
= tifp
^ tifn
;
414 u64 msr
= x86_spec_ctrl_base
;
418 * If TIF_SSBD is different, select the proper mitigation
419 * method. Note that if SSBD mitigation is disabled or permanentely
420 * enabled this branch can't be taken because nothing can set
423 if (tif_diff
& _TIF_SSBD
) {
424 if (static_cpu_has(X86_FEATURE_VIRT_SSBD
)) {
425 amd_set_ssb_virt_state(tifn
);
426 } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD
)) {
427 amd_set_core_ssb_state(tifn
);
428 } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD
) ||
429 static_cpu_has(X86_FEATURE_AMD_SSBD
)) {
430 msr
|= ssbd_tif_to_spec_ctrl(tifn
);
436 * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled,
437 * otherwise avoid the MSR write.
439 if (IS_ENABLED(CONFIG_SMP
) &&
440 static_branch_unlikely(&switch_to_cond_stibp
)) {
441 updmsr
|= !!(tif_diff
& _TIF_SPEC_IB
);
442 msr
|= stibp_tif_to_spec_ctrl(tifn
);
446 wrmsrl(MSR_IA32_SPEC_CTRL
, msr
);
449 static unsigned long speculation_ctrl_update_tif(struct task_struct
*tsk
)
451 if (test_and_clear_tsk_thread_flag(tsk
, TIF_SPEC_FORCE_UPDATE
)) {
452 if (task_spec_ssb_disable(tsk
))
453 set_tsk_thread_flag(tsk
, TIF_SSBD
);
455 clear_tsk_thread_flag(tsk
, TIF_SSBD
);
457 if (task_spec_ib_disable(tsk
))
458 set_tsk_thread_flag(tsk
, TIF_SPEC_IB
);
460 clear_tsk_thread_flag(tsk
, TIF_SPEC_IB
);
462 /* Return the updated threadinfo flags*/
463 return task_thread_info(tsk
)->flags
;
466 void speculation_ctrl_update(unsigned long tif
)
468 /* Forced update. Make sure all relevant TIF flags are different */
470 __speculation_ctrl_update(~tif
, tif
);
474 /* Called from seccomp/prctl update */
475 void speculation_ctrl_update_current(void)
478 speculation_ctrl_update(speculation_ctrl_update_tif(current
));
482 void __switch_to_xtra(struct task_struct
*prev_p
, struct task_struct
*next_p
)
484 struct thread_struct
*prev
, *next
;
485 unsigned long tifp
, tifn
;
487 prev
= &prev_p
->thread
;
488 next
= &next_p
->thread
;
490 tifn
= READ_ONCE(task_thread_info(next_p
)->flags
);
491 tifp
= READ_ONCE(task_thread_info(prev_p
)->flags
);
492 switch_to_bitmap(prev
, next
, tifp
, tifn
);
494 propagate_user_return_notify(prev_p
, next_p
);
496 if ((tifp
& _TIF_BLOCKSTEP
|| tifn
& _TIF_BLOCKSTEP
) &&
497 arch_has_block_step()) {
498 unsigned long debugctl
, msk
;
500 rdmsrl(MSR_IA32_DEBUGCTLMSR
, debugctl
);
501 debugctl
&= ~DEBUGCTLMSR_BTF
;
502 msk
= tifn
& _TIF_BLOCKSTEP
;
503 debugctl
|= (msk
>> TIF_BLOCKSTEP
) << DEBUGCTLMSR_BTF_SHIFT
;
504 wrmsrl(MSR_IA32_DEBUGCTLMSR
, debugctl
);
507 if ((tifp
^ tifn
) & _TIF_NOTSC
)
508 cr4_toggle_bits_irqsoff(X86_CR4_TSD
);
510 if ((tifp
^ tifn
) & _TIF_NOCPUID
)
511 set_cpuid_faulting(!!(tifn
& _TIF_NOCPUID
));
513 if (likely(!((tifp
| tifn
) & _TIF_SPEC_FORCE_UPDATE
))) {
514 __speculation_ctrl_update(tifp
, tifn
);
516 speculation_ctrl_update_tif(prev_p
);
517 tifn
= speculation_ctrl_update_tif(next_p
);
519 /* Enforce MSR update to ensure consistent state */
520 __speculation_ctrl_update(~tifn
, tifn
);
525 * Idle related variables and functions
527 unsigned long boot_option_idle_override
= IDLE_NO_OVERRIDE
;
528 EXPORT_SYMBOL(boot_option_idle_override
);
530 static void (*x86_idle
)(void);
533 static inline void play_dead(void)
539 void arch_cpu_idle_enter(void)
541 tsc_verify_tsc_adjust(false);
545 void arch_cpu_idle_dead(void)
551 * Called from the generic idle code.
553 void arch_cpu_idle(void)
559 * We use this if we don't have any better idle routine..
561 void __cpuidle
default_idle(void)
563 trace_cpu_idle_rcuidle(1, smp_processor_id());
565 trace_cpu_idle_rcuidle(PWR_EVENT_EXIT
, smp_processor_id());
567 #ifdef CONFIG_APM_MODULE
568 EXPORT_SYMBOL(default_idle
);
572 bool xen_set_default_idle(void)
574 bool ret
= !!x86_idle
;
576 x86_idle
= default_idle
;
582 void stop_this_cpu(void *dummy
)
588 set_cpu_online(smp_processor_id(), false);
589 disable_local_APIC();
590 mcheck_cpu_clear(this_cpu_ptr(&cpu_info
));
593 * Use wbinvd on processors that support SME. This provides support
594 * for performing a successful kexec when going from SME inactive
595 * to SME active (or vice-versa). The cache must be cleared so that
596 * if there are entries with the same physical address, both with and
597 * without the encryption bit, they don't race each other when flushed
598 * and potentially end up with the wrong entry being committed to
601 if (boot_cpu_has(X86_FEATURE_SME
))
605 * Use native_halt() so that memory contents don't change
606 * (stack usage and variables) after possibly issuing the
607 * native_wbinvd() above.
614 * AMD Erratum 400 aware idle routine. We handle it the same way as C3 power
615 * states (local apic timer and TSC stop).
617 static void amd_e400_idle(void)
620 * We cannot use static_cpu_has_bug() here because X86_BUG_AMD_APIC_C1E
621 * gets set after static_cpu_has() places have been converted via
624 if (!boot_cpu_has_bug(X86_BUG_AMD_APIC_C1E
)) {
629 tick_broadcast_enter();
634 * The switch back from broadcast mode needs to be called with
635 * interrupts disabled.
638 tick_broadcast_exit();
643 * Intel Core2 and older machines prefer MWAIT over HALT for C1.
644 * We can't rely on cpuidle installing MWAIT, because it will not load
645 * on systems that support only C1 -- so the boot default must be MWAIT.
647 * Some AMD machines are the opposite, they depend on using HALT.
649 * So for default C1, which is used during boot until cpuidle loads,
650 * use MWAIT-C1 on Intel HW that has it, else use HALT.
652 static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86
*c
)
654 if (c
->x86_vendor
!= X86_VENDOR_INTEL
)
657 if (!cpu_has(c
, X86_FEATURE_MWAIT
) || static_cpu_has_bug(X86_BUG_MONITOR
))
664 * MONITOR/MWAIT with no hints, used for default C1 state. This invokes MWAIT
665 * with interrupts enabled and no flags, which is backwards compatible with the
666 * original MWAIT implementation.
668 static __cpuidle
void mwait_idle(void)
670 if (!current_set_polling_and_test()) {
671 trace_cpu_idle_rcuidle(1, smp_processor_id());
672 if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR
)) {
674 clflush((void *)¤t_thread_info()->flags
);
678 __monitor((void *)¤t_thread_info()->flags
, 0, 0);
683 trace_cpu_idle_rcuidle(PWR_EVENT_EXIT
, smp_processor_id());
687 __current_clr_polling();
690 void select_idle_routine(const struct cpuinfo_x86
*c
)
693 if (boot_option_idle_override
== IDLE_POLL
&& smp_num_siblings
> 1)
694 pr_warn_once("WARNING: polling idle and HT enabled, performance may degrade\n");
696 if (x86_idle
|| boot_option_idle_override
== IDLE_POLL
)
699 if (boot_cpu_has_bug(X86_BUG_AMD_E400
)) {
700 pr_info("using AMD E400 aware idle routine\n");
701 x86_idle
= amd_e400_idle
;
702 } else if (prefer_mwait_c1_over_halt(c
)) {
703 pr_info("using mwait in idle threads\n");
704 x86_idle
= mwait_idle
;
706 x86_idle
= default_idle
;
709 void amd_e400_c1e_apic_setup(void)
711 if (boot_cpu_has_bug(X86_BUG_AMD_APIC_C1E
)) {
712 pr_info("Switch to broadcast mode on CPU%d\n", smp_processor_id());
714 tick_broadcast_force();
719 void __init
arch_post_acpi_subsys_init(void)
723 if (!boot_cpu_has_bug(X86_BUG_AMD_E400
))
727 * AMD E400 detection needs to happen after ACPI has been enabled. If
728 * the machine is affected K8_INTP_C1E_ACTIVE_MASK bits are set in
729 * MSR_K8_INT_PENDING_MSG.
731 rdmsr(MSR_K8_INT_PENDING_MSG
, lo
, hi
);
732 if (!(lo
& K8_INTP_C1E_ACTIVE_MASK
))
735 boot_cpu_set_bug(X86_BUG_AMD_APIC_C1E
);
737 if (!boot_cpu_has(X86_FEATURE_NONSTOP_TSC
))
738 mark_tsc_unstable("TSC halt in AMD C1E");
739 pr_info("System has AMD C1E enabled\n");
742 static int __init
idle_setup(char *str
)
747 if (!strcmp(str
, "poll")) {
748 pr_info("using polling idle threads\n");
749 boot_option_idle_override
= IDLE_POLL
;
750 cpu_idle_poll_ctrl(true);
751 } else if (!strcmp(str
, "halt")) {
753 * When the boot option of idle=halt is added, halt is
754 * forced to be used for CPU idle. In such case CPU C2/C3
755 * won't be used again.
756 * To continue to load the CPU idle driver, don't touch
757 * the boot_option_idle_override.
759 x86_idle
= default_idle
;
760 boot_option_idle_override
= IDLE_HALT
;
761 } else if (!strcmp(str
, "nomwait")) {
763 * If the boot option of "idle=nomwait" is added,
764 * it means that mwait will be disabled for CPU C2/C3
765 * states. In such case it won't touch the variable
766 * of boot_option_idle_override.
768 boot_option_idle_override
= IDLE_NOMWAIT
;
774 early_param("idle", idle_setup
);
776 unsigned long arch_align_stack(unsigned long sp
)
778 if (!(current
->personality
& ADDR_NO_RANDOMIZE
) && randomize_va_space
)
779 sp
-= get_random_int() % 8192;
783 unsigned long arch_randomize_brk(struct mm_struct
*mm
)
785 return randomize_page(mm
->brk
, 0x02000000);
789 * Called from fs/proc with a reference on @p to find the function
790 * which called into schedule(). This needs to be done carefully
791 * because the task might wake up and we might look at a stack
794 unsigned long get_wchan(struct task_struct
*p
)
796 unsigned long start
, bottom
, top
, sp
, fp
, ip
, ret
= 0;
799 if (p
== current
|| p
->state
== TASK_RUNNING
)
802 if (!try_get_task_stack(p
))
805 start
= (unsigned long)task_stack_page(p
);
810 * Layout of the stack page:
812 * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
814 * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
816 * ----------- bottom = start
818 * The tasks stack pointer points at the location where the
819 * framepointer is stored. The data on the stack is:
820 * ... IP FP ... IP FP
822 * We need to read FP and IP, so we need to adjust the upper
823 * bound by another unsigned long.
825 top
= start
+ THREAD_SIZE
- TOP_OF_KERNEL_STACK_PADDING
;
826 top
-= 2 * sizeof(unsigned long);
829 sp
= READ_ONCE(p
->thread
.sp
);
830 if (sp
< bottom
|| sp
> top
)
833 fp
= READ_ONCE_NOCHECK(((struct inactive_task_frame
*)sp
)->bp
);
835 if (fp
< bottom
|| fp
> top
)
837 ip
= READ_ONCE_NOCHECK(*(unsigned long *)(fp
+ sizeof(unsigned long)));
838 if (!in_sched_functions(ip
)) {
842 fp
= READ_ONCE_NOCHECK(*(unsigned long *)fp
);
843 } while (count
++ < 16 && p
->state
!= TASK_RUNNING
);
850 long do_arch_prctl_common(struct task_struct
*task
, int option
,
851 unsigned long cpuid_enabled
)
855 return get_cpuid_mode();
857 return set_cpuid_mode(task
, cpuid_enabled
);