1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright 2002 Andi Kleen, SuSE Labs.
4 * Thanks to Ben LaHaise for precious feedback.
5 */
6 #include <linux/highmem.h>
7 #include <linux/memblock.h>
8 #include <linux/sched.h>
9 #include <linux/mm.h>
10 #include <linux/interrupt.h>
11 #include <linux/seq_file.h>
12 #include <linux/proc_fs.h>
13 #include <linux/debugfs.h>
14 #include <linux/pfn.h>
15 #include <linux/percpu.h>
16 #include <linux/gfp.h>
17 #include <linux/pci.h>
18 #include <linux/vmalloc.h>
19 #include <linux/libnvdimm.h>
20 #include <linux/vmstat.h>
21 #include <linux/kernel.h>
22 #include <linux/cc_platform.h>
23 #include <linux/set_memory.h>
24 #include <linux/memregion.h>
25
26 #include <asm/e820/api.h>
27 #include <asm/processor.h>
28 #include <asm/tlbflush.h>
29 #include <asm/sections.h>
30 #include <asm/setup.h>
31 #include <linux/uaccess.h>
32 #include <asm/pgalloc.h>
33 #include <asm/proto.h>
34 #include <asm/memtype.h>
35 #include <asm/hyperv-tlfs.h>
36 #include <asm/mshyperv.h>
37
38 #include "../mm_internal.h"
39
40 /*
41 * The current flushing context - we pass it instead of 5 arguments:
42 */
43 struct cpa_data {
44 unsigned long *vaddr;
45 pgd_t *pgd;
46 pgprot_t mask_set;
47 pgprot_t mask_clr;
48 unsigned long numpages;
49 unsigned long curpage;
50 unsigned long pfn;
51 unsigned int flags;
52 unsigned int force_split : 1,
53 force_static_prot : 1,
54 force_flush_all : 1;
55 struct page **pages;
56 };
57
58 enum cpa_warn {
59 CPA_CONFLICT,
60 CPA_PROTECT,
61 CPA_DETECT,
62 };
63
64 static const int cpa_warn_level = CPA_PROTECT;
65
66 /*
67 * Serialize cpa() (for !DEBUG_PAGEALLOC which uses large identity mappings)
68 * using cpa_lock. So that we don't allow any other cpu, with stale large tlb
69 * entries change the page attribute in parallel to some other cpu
70 * splitting a large page entry along with changing the attribute.
71 */
72 static DEFINE_SPINLOCK(cpa_lock);
73
74 #define CPA_FLUSHTLB 1
75 #define CPA_ARRAY 2
76 #define CPA_PAGES_ARRAY 4
77 #define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */
78
79 static inline pgprot_t cachemode2pgprot(enum page_cache_mode pcm)
80 {
81 return __pgprot(cachemode2protval(pcm));
82 }
83
84 #ifdef CONFIG_PROC_FS
85 static unsigned long direct_pages_count[PG_LEVEL_NUM];
86
87 void update_page_count(int level, unsigned long pages)
88 {
89 /* Protect against CPA */
90 spin_lock(&pgd_lock);
91 direct_pages_count[level] += pages;
92 spin_unlock(&pgd_lock);
93 }
94
95 static void split_page_count(int level)
96 {
97 if (direct_pages_count[level] == 0)
98 return;
99
100 direct_pages_count[level]--;
101 if (system_state == SYSTEM_RUNNING) {
102 if (level == PG_LEVEL_2M)
103 count_vm_event(DIRECT_MAP_LEVEL2_SPLIT);
104 else if (level == PG_LEVEL_1G)
105 count_vm_event(DIRECT_MAP_LEVEL3_SPLIT);
106 }
107 direct_pages_count[level - 1] += PTRS_PER_PTE;
108 }
109
110 void arch_report_meminfo(struct seq_file *m)
111 {
112 seq_printf(m, "DirectMap4k: %8lu kB\n",
113 direct_pages_count[PG_LEVEL_4K] << 2);
114 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
115 seq_printf(m, "DirectMap2M: %8lu kB\n",
116 direct_pages_count[PG_LEVEL_2M] << 11);
117 #else
118 seq_printf(m, "DirectMap4M: %8lu kB\n",
119 direct_pages_count[PG_LEVEL_2M] << 12);
120 #endif
121 if (direct_gbpages)
122 seq_printf(m, "DirectMap1G: %8lu kB\n",
123 direct_pages_count[PG_LEVEL_1G] << 20);
124 }
125 #else
126 static inline void split_page_count(int level) { }
127 #endif
128
129 #ifdef CONFIG_X86_CPA_STATISTICS
130
131 static unsigned long cpa_1g_checked;
132 static unsigned long cpa_1g_sameprot;
133 static unsigned long cpa_1g_preserved;
134 static unsigned long cpa_2m_checked;
135 static unsigned long cpa_2m_sameprot;
136 static unsigned long cpa_2m_preserved;
137 static unsigned long cpa_4k_install;
138
139 static inline void cpa_inc_1g_checked(void)
140 {
141 cpa_1g_checked++;
142 }
143
144 static inline void cpa_inc_2m_checked(void)
145 {
146 cpa_2m_checked++;
147 }
148
149 static inline void cpa_inc_4k_install(void)
150 {
151 data_race(cpa_4k_install++);
152 }
153
154 static inline void cpa_inc_lp_sameprot(int level)
155 {
156 if (level == PG_LEVEL_1G)
157 cpa_1g_sameprot++;
158 else
159 cpa_2m_sameprot++;
160 }
161
162 static inline void cpa_inc_lp_preserved(int level)
163 {
164 if (level == PG_LEVEL_1G)
165 cpa_1g_preserved++;
166 else
167 cpa_2m_preserved++;
168 }
169
170 static int cpastats_show(struct seq_file *m, void *p)
171 {
172 seq_printf(m, "1G pages checked: %16lu\n", cpa_1g_checked);
173 seq_printf(m, "1G pages sameprot: %16lu\n", cpa_1g_sameprot);
174 seq_printf(m, "1G pages preserved: %16lu\n", cpa_1g_preserved);
175 seq_printf(m, "2M pages checked: %16lu\n", cpa_2m_checked);
176 seq_printf(m, "2M pages sameprot: %16lu\n", cpa_2m_sameprot);
177 seq_printf(m, "2M pages preserved: %16lu\n", cpa_2m_preserved);
178 seq_printf(m, "4K pages set-checked: %16lu\n", cpa_4k_install);
179 return 0;
180 }
181
182 static int cpastats_open(struct inode *inode, struct file *file)
183 {
184 return single_open(file, cpastats_show, NULL);
185 }
186
187 static const struct file_operations cpastats_fops = {
188 .open = cpastats_open,
189 .read = seq_read,
190 .llseek = seq_lseek,
191 .release = single_release,
192 };
193
194 static int __init cpa_stats_init(void)
195 {
196 debugfs_create_file("cpa_stats", S_IRUSR, arch_debugfs_dir, NULL,
197 &cpastats_fops);
198 return 0;
199 }
200 late_initcall(cpa_stats_init);
201 #else
202 static inline void cpa_inc_1g_checked(void) { }
203 static inline void cpa_inc_2m_checked(void) { }
204 static inline void cpa_inc_4k_install(void) { }
205 static inline void cpa_inc_lp_sameprot(int level) { }
206 static inline void cpa_inc_lp_preserved(int level) { }
207 #endif
208
209
210 static inline int
211 within(unsigned long addr, unsigned long start, unsigned long end)
212 {
213 return addr >= start && addr < end;
214 }
215
216 static inline int
217 within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
218 {
219 return addr >= start && addr <= end;
220 }
221
222 #ifdef CONFIG_X86_64
223
224 /*
225 * The kernel image is mapped into two places in the virtual address space
226 * (addresses without KASLR, of course):
227 *
228 * 1. The kernel direct map (0xffff880000000000)
229 * 2. The "high kernel map" (0xffffffff81000000)
230 *
231 * We actually execute out of #2. If we get the address of a kernel symbol, it
232 * points to #2, but almost all physical-to-virtual translations point to #1.
233 *
234 * This is so that we can have both a directmap of all physical memory *and*
235 * take full advantage of the limited (s32) immediate addressing range (2G)
236 * of x86_64.
237 *
238 * See Documentation/arch/x86/x86_64/mm.rst for more detail.
239 */
240
241 static inline unsigned long highmap_start_pfn(void)
242 {
243 return __pa_symbol(_text) >> PAGE_SHIFT;
244 }
245
246 static inline unsigned long highmap_end_pfn(void)
247 {
248 /* Do not reference physical address outside the kernel. */
249 return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT;
250 }
251
252 static bool __cpa_pfn_in_highmap(unsigned long pfn)
253 {
254 /*
255 * Kernel text has an alias mapping at a high address, known
256 * here as "highmap".
257 */
258 return within_inclusive(pfn, highmap_start_pfn(), highmap_end_pfn());
259 }
260
261 #else
262
263 static bool __cpa_pfn_in_highmap(unsigned long pfn)
264 {
265 /* There is no highmap on 32-bit */
266 return false;
267 }
268
269 #endif
270
271 /*
272 * See set_mce_nospec().
273 *
274 * Machine check recovery code needs to change cache mode of poisoned pages to
275 * UC to avoid speculative access logging another error. But passing the
276 * address of the 1:1 mapping to set_memory_uc() is a fine way to encourage a
277 * speculative access. So we cheat and flip the top bit of the address. This
278 * works fine for the code that updates the page tables. But at the end of the
279 * process we need to flush the TLB and cache and the non-canonical address
280 * causes a #GP fault when used by the INVLPG and CLFLUSH instructions.
281 *
282 * But in the common case we already have a canonical address. This code
283 * will fix the top bit if needed and is a no-op otherwise.
284 */
285 static inline unsigned long fix_addr(unsigned long addr)
286 {
287 #ifdef CONFIG_X86_64
288 return (long)(addr << 1) >> 1;
289 #else
290 return addr;
291 #endif
292 }
293
294 static unsigned long __cpa_addr(struct cpa_data *cpa, unsigned long idx)
295 {
296 if (cpa->flags & CPA_PAGES_ARRAY) {
297 struct page *page = cpa->pages[idx];
298
299 if (unlikely(PageHighMem(page)))
300 return 0;
301
302 return (unsigned long)page_address(page);
303 }
304
305 if (cpa->flags & CPA_ARRAY)
306 return cpa->vaddr[idx];
307
308 return *cpa->vaddr + idx * PAGE_SIZE;
309 }
310
311 /*
312 * Flushing functions
313 */
314
315 static void clflush_cache_range_opt(void *vaddr, unsigned int size)
316 {
317 const unsigned long clflush_size = boot_cpu_data.x86_clflush_size;
318 void *p = (void *)((unsigned long)vaddr & ~(clflush_size - 1));
319 void *vend = vaddr + size;
320
321 if (p >= vend)
322 return;
323
324 for (; p < vend; p += clflush_size)
325 clflushopt(p);
326 }
327
328 /**
329 * clflush_cache_range - flush a cache range with clflush
330 * @vaddr: virtual start address
331 * @size: number of bytes to flush
332 *
333 * CLFLUSHOPT is an unordered instruction which needs fencing with MFENCE or
334 * SFENCE to avoid ordering issues.
335 */
336 void clflush_cache_range(void *vaddr, unsigned int size)
337 {
338 mb();
339 clflush_cache_range_opt(vaddr, size);
340 mb();
341 }
342 EXPORT_SYMBOL_GPL(clflush_cache_range);
343
344 #ifdef CONFIG_ARCH_HAS_PMEM_API
345 void arch_invalidate_pmem(void *addr, size_t size)
346 {
347 clflush_cache_range(addr, size);
348 }
349 EXPORT_SYMBOL_GPL(arch_invalidate_pmem);
350 #endif
351
352 #ifdef CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION
353 bool cpu_cache_has_invalidate_memregion(void)
354 {
355 return !cpu_feature_enabled(X86_FEATURE_HYPERVISOR);
356 }
357 EXPORT_SYMBOL_NS_GPL(cpu_cache_has_invalidate_memregion, DEVMEM);
358
359 int cpu_cache_invalidate_memregion(int res_desc)
360 {
361 if (WARN_ON_ONCE(!cpu_cache_has_invalidate_memregion()))
362 return -ENXIO;
363 wbinvd_on_all_cpus();
364 return 0;
365 }
366 EXPORT_SYMBOL_NS_GPL(cpu_cache_invalidate_memregion, DEVMEM);
367 #endif
368
369 static void __cpa_flush_all(void *arg)
370 {
371 unsigned long cache = (unsigned long)arg;
372
373 /*
374 * Flush all to work around Errata in early athlons regarding
375 * large page flushing.
376 */
377 __flush_tlb_all();
378
379 if (cache && boot_cpu_data.x86 >= 4)
380 wbinvd();
381 }
382
383 static void cpa_flush_all(unsigned long cache)
384 {
385 BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
386
387 on_each_cpu(__cpa_flush_all, (void *) cache, 1);
388 }
389
390 static void __cpa_flush_tlb(void *data)
391 {
392 struct cpa_data *cpa = data;
393 unsigned int i;
394
395 for (i = 0; i < cpa->numpages; i++)
396 flush_tlb_one_kernel(fix_addr(__cpa_addr(cpa, i)));
397 }
398
399 static void cpa_flush(struct cpa_data *data, int cache)
400 {
401 struct cpa_data *cpa = data;
402 unsigned int i;
403
404 BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
405
406 if (cache && !static_cpu_has(X86_FEATURE_CLFLUSH)) {
407 cpa_flush_all(cache);
408 return;
409 }
410
411 if (cpa->force_flush_all || cpa->numpages > tlb_single_page_flush_ceiling)
412 flush_tlb_all();
413 else
414 on_each_cpu(__cpa_flush_tlb, cpa, 1);
415
416 if (!cache)
417 return;
418
419 mb();
420 for (i = 0; i < cpa->numpages; i++) {
421 unsigned long addr = __cpa_addr(cpa, i);
422 unsigned int level;
423
424 pte_t *pte = lookup_address(addr, &level);
425
426 /*
427 * Only flush present addresses:
428 */
429 if (pte && (pte_val(*pte) & _PAGE_PRESENT))
430 clflush_cache_range_opt((void *)fix_addr(addr), PAGE_SIZE);
431 }
432 mb();
433 }
434
435 static bool overlaps(unsigned long r1_start, unsigned long r1_end,
436 unsigned long r2_start, unsigned long r2_end)
437 {
438 return (r1_start <= r2_end && r1_end >= r2_start) ||
439 (r2_start <= r1_end && r2_end >= r1_start);
440 }
441
442 #ifdef CONFIG_PCI_BIOS
443 /*
444 * The BIOS area between 640k and 1Mb needs to be executable for PCI BIOS
445 * based config access (CONFIG_PCI_GOBIOS) support.
446 */
447 #define BIOS_PFN PFN_DOWN(BIOS_BEGIN)
448 #define BIOS_PFN_END PFN_DOWN(BIOS_END - 1)
449
450 static pgprotval_t protect_pci_bios(unsigned long spfn, unsigned long epfn)
451 {
452 if (pcibios_enabled && overlaps(spfn, epfn, BIOS_PFN, BIOS_PFN_END))
453 return _PAGE_NX;
454 return 0;
455 }
456 #else
457 static pgprotval_t protect_pci_bios(unsigned long spfn, unsigned long epfn)
458 {
459 return 0;
460 }
461 #endif
462
463 /*
464 * The .rodata section needs to be read-only. Using the pfn catches all
465 * aliases. This also includes __ro_after_init, so do not enforce until
466 * kernel_set_to_readonly is true.
467 */
468 static pgprotval_t protect_rodata(unsigned long spfn, unsigned long epfn)
469 {
470 unsigned long epfn_ro, spfn_ro = PFN_DOWN(__pa_symbol(__start_rodata));
471
472 /*
473 * Note: __end_rodata is at page aligned and not inclusive, so
474 * subtract 1 to get the last enforced PFN in the rodata area.
475 */
476 epfn_ro = PFN_DOWN(__pa_symbol(__end_rodata)) - 1;
477
478 if (kernel_set_to_readonly && overlaps(spfn, epfn, spfn_ro, epfn_ro))
479 return _PAGE_RW;
480 return 0;
481 }
482
483 /*
484 * Protect kernel text against becoming non executable by forbidding
485 * _PAGE_NX. This protects only the high kernel mapping (_text -> _etext)
486 * out of which the kernel actually executes. Do not protect the low
487 * mapping.
488 *
489 * This does not cover __inittext since that is gone after boot.
490 */
491 static pgprotval_t protect_kernel_text(unsigned long start, unsigned long end)
492 {
493 unsigned long t_end = (unsigned long)_etext - 1;
494 unsigned long t_start = (unsigned long)_text;
495
496 if (overlaps(start, end, t_start, t_end))
497 return _PAGE_NX;
498 return 0;
499 }
500
501 #if defined(CONFIG_X86_64)
502 /*
503 * Once the kernel maps the text as RO (kernel_set_to_readonly is set),
504 * kernel text mappings for the large page aligned text, rodata sections
505 * will be always read-only. For the kernel identity mappings covering the
506 * holes caused by this alignment can be anything that user asks.
507 *
508 * This will preserve the large page mappings for kernel text/data at no
509 * extra cost.
510 */
511 static pgprotval_t protect_kernel_text_ro(unsigned long start,
512 unsigned long end)
513 {
514 unsigned long t_end = (unsigned long)__end_rodata_hpage_align - 1;
515 unsigned long t_start = (unsigned long)_text;
516 unsigned int level;
517
518 if (!kernel_set_to_readonly || !overlaps(start, end, t_start, t_end))
519 return 0;
520 /*
521 * Don't enforce the !RW mapping for the kernel text mapping, if
522 * the current mapping is already using small page mapping. No
523 * need to work hard to preserve large page mappings in this case.
524 *
525 * This also fixes the Linux Xen paravirt guest boot failure caused
526 * by unexpected read-only mappings for kernel identity
527 * mappings. In this paravirt guest case, the kernel text mapping
528 * and the kernel identity mapping share the same page-table pages,
529 * so the protections for kernel text and identity mappings have to
530 * be the same.
531 */
532 if (lookup_address(start, &level) && (level != PG_LEVEL_4K))
533 return _PAGE_RW;
534 return 0;
535 }
536 #else
537 static pgprotval_t protect_kernel_text_ro(unsigned long start,
538 unsigned long end)
539 {
540 return 0;
541 }
542 #endif
543
544 static inline bool conflicts(pgprot_t prot, pgprotval_t val)
545 {
546 return (pgprot_val(prot) & ~val) != pgprot_val(prot);
547 }
548
549 static inline void check_conflict(int warnlvl, pgprot_t prot, pgprotval_t val,
550 unsigned long start, unsigned long end,
551 unsigned long pfn, const char *txt)
552 {
553 static const char *lvltxt[] = {
554 [CPA_CONFLICT] = "conflict",
555 [CPA_PROTECT] = "protect",
556 [CPA_DETECT] = "detect",
557 };
558
559 if (warnlvl > cpa_warn_level || !conflicts(prot, val))
560 return;
561
562 pr_warn("CPA %8s %10s: 0x%016lx - 0x%016lx PFN %lx req %016llx prevent %016llx\n",
563 lvltxt[warnlvl], txt, start, end, pfn, (unsigned long long)pgprot_val(prot),
564 (unsigned long long)val);
565 }
566
567 /*
568 * Certain areas of memory on x86 require very specific protection flags,
569 * for example the BIOS area or kernel text. Callers don't always get this
570 * right (again, ioremap() on BIOS memory is not uncommon) so this function
571 * checks and fixes these known static required protection bits.
572 */
573 static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
574 unsigned long pfn, unsigned long npg,
575 unsigned long lpsize, int warnlvl)
576 {
577 pgprotval_t forbidden, res;
578 unsigned long end;
579
580 /*
581 * There is no point in checking RW/NX conflicts when the requested
582 * mapping is setting the page !PRESENT.
583 */
584 if (!(pgprot_val(prot) & _PAGE_PRESENT))
585 return prot;
586
587 /* Operate on the virtual address */
588 end = start + npg * PAGE_SIZE - 1;
589
590 res = protect_kernel_text(start, end);
591 check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX");
592 forbidden = res;
593
594 /*
595 * Special case to preserve a large page. If the change spawns the
596 * full large page mapping then there is no point to split it
597 * up. Happens with ftrace and is going to be removed once ftrace
598 * switched to text_poke().
599 */
600 if (lpsize != (npg * PAGE_SIZE) || (start & (lpsize - 1))) {
601 res = protect_kernel_text_ro(start, end);
602 check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO");
603 forbidden |= res;
604 }
605
606 /* Check the PFN directly */
607 res = protect_pci_bios(pfn, pfn + npg - 1);
608 check_conflict(warnlvl, prot, res, start, end, pfn, "PCIBIOS NX");
609 forbidden |= res;
610
611 res = protect_rodata(pfn, pfn + npg - 1);
612 check_conflict(warnlvl, prot, res, start, end, pfn, "Rodata RO");
613 forbidden |= res;
614
615 return __pgprot(pgprot_val(prot) & ~forbidden);
616 }
617
618 /*
619 * Validate strict W^X semantics.
620 */
621 static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start,
622 unsigned long pfn, unsigned long npg,
623 bool nx, bool rw)
624 {
625 unsigned long end;
626
627 /*
628 * 32-bit has some unfixable W+X issues, like EFI code
629 * and writeable data being in the same page. Disable
630 * detection and enforcement there.
631 */
632 if (IS_ENABLED(CONFIG_X86_32))
633 return new;
634
635 /* Only verify when NX is supported: */
636 if (!(__supported_pte_mask & _PAGE_NX))
637 return new;
638
639 if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
640 return new;
641
642 if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW)
643 return new;
644
645 /* Non-leaf translation entries can disable writing or execution. */
646 if (!rw || nx)
647 return new;
648
649 end = start + npg * PAGE_SIZE - 1;
650 WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
651 (unsigned long long)pgprot_val(old),
652 (unsigned long long)pgprot_val(new),
653 start, end, pfn);
654
655 /*
656 * For now, allow all permission change attempts by returning the
657 * attempted permissions. This can 'return old' to actively
658 * refuse the permission change at a later time.
659 */
660 return new;
661 }
662
663 /*
664 * Lookup the page table entry for a virtual address in a specific pgd.
665 * Return a pointer to the entry (or NULL if the entry does not exist),
666 * the level of the entry, and the effective NX and RW bits of all
667 * page table levels.
668 */
669 pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
670 unsigned int *level, bool *nx, bool *rw)
671 {
672 p4d_t *p4d;
673 pud_t *pud;
674 pmd_t *pmd;
675
676 *level = PG_LEVEL_256T;
677 *nx = false;
678 *rw = true;
679
680 if (pgd_none(*pgd))
681 return NULL;
682
683 *level = PG_LEVEL_512G;
684 *nx |= pgd_flags(*pgd) & _PAGE_NX;
685 *rw &= pgd_flags(*pgd) & _PAGE_RW;
686
687 p4d = p4d_offset(pgd, address);
688 if (p4d_none(*p4d))
689 return NULL;
690
691 if (p4d_leaf(*p4d) || !p4d_present(*p4d))
692 return (pte_t *)p4d;
693
694 *level = PG_LEVEL_1G;
695 *nx |= p4d_flags(*p4d) & _PAGE_NX;
696 *rw &= p4d_flags(*p4d) & _PAGE_RW;
697
698 pud = pud_offset(p4d, address);
699 if (pud_none(*pud))
700 return NULL;
701
702 if (pud_leaf(*pud) || !pud_present(*pud))
703 return (pte_t *)pud;
704
705 *level = PG_LEVEL_2M;
706 *nx |= pud_flags(*pud) & _PAGE_NX;
707 *rw &= pud_flags(*pud) & _PAGE_RW;
708
709 pmd = pmd_offset(pud, address);
710 if (pmd_none(*pmd))
711 return NULL;
712
713 if (pmd_leaf(*pmd) || !pmd_present(*pmd))
714 return (pte_t *)pmd;
715
716 *level = PG_LEVEL_4K;
717 *nx |= pmd_flags(*pmd) & _PAGE_NX;
718 *rw &= pmd_flags(*pmd) & _PAGE_RW;
719
720 return pte_offset_kernel(pmd, address);
721 }
722
723 /*
724 * Lookup the page table entry for a virtual address in a specific pgd.
725 * Return a pointer to the entry and the level of the mapping.
726 */
727 pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
728 unsigned int *level)
729 {
730 bool nx, rw;
731
732 return lookup_address_in_pgd_attr(pgd, address, level, &nx, &rw);
733 }
734
735 /*
736 * Lookup the page table entry for a virtual address. Return a pointer
737 * to the entry and the level of the mapping.
738 *
739 * Note: the function returns p4d, pud or pmd either when the entry is marked
740 * large or when the present bit is not set. Otherwise it returns NULL.
741 */
742 pte_t *lookup_address(unsigned long address, unsigned int *level)
743 {
744 return lookup_address_in_pgd(pgd_offset_k(address), address, level);
745 }
746 EXPORT_SYMBOL_GPL(lookup_address);
747
748 static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address,
749 unsigned int *level, bool *nx, bool *rw)
750 {
751 pgd_t *pgd;
752
753 if (!cpa->pgd)
754 pgd = pgd_offset_k(address);
755 else
756 pgd = cpa->pgd + pgd_index(address);
757
758 return lookup_address_in_pgd_attr(pgd, address, level, nx, rw);
759 }
760
761 /*
762 * Lookup the PMD entry for a virtual address. Return a pointer to the entry
763 * or NULL if not present.
764 */
765 pmd_t *lookup_pmd_address(unsigned long address)
766 {
767 pgd_t *pgd;
768 p4d_t *p4d;
769 pud_t *pud;
770
771 pgd = pgd_offset_k(address);
772 if (pgd_none(*pgd))
773 return NULL;
774
775 p4d = p4d_offset(pgd, address);
776 if (p4d_none(*p4d) || p4d_leaf(*p4d) || !p4d_present(*p4d))
777 return NULL;
778
779 pud = pud_offset(p4d, address);
780 if (pud_none(*pud) || pud_leaf(*pud) || !pud_present(*pud))
781 return NULL;
782
783 return pmd_offset(pud, address);
784 }
785
786 /*
787 * This is necessary because __pa() does not work on some
788 * kinds of memory, like vmalloc() or the alloc_remap()
789 * areas on 32-bit NUMA systems. The percpu areas can
790 * end up in this kind of memory, for instance.
791 *
792 * Note that as long as the PTEs are well-formed with correct PFNs, this
793 * works without checking the PRESENT bit in the leaf PTE. This is unlike
794 * the similar vmalloc_to_page() and derivatives. Callers may depend on
795 * this behavior.
796 *
797 * This could be optimized, but it is only used in paths that are not perf
798 * sensitive, and keeping it unoptimized should increase the testing coverage
799 * for the more obscure platforms.
800 */
801 phys_addr_t slow_virt_to_phys(void *__virt_addr)
802 {
803 unsigned long virt_addr = (unsigned long)__virt_addr;
804 phys_addr_t phys_addr;
805 unsigned long offset;
806 enum pg_level level;
807 pte_t *pte;
808
809 pte = lookup_address(virt_addr, &level);
810 BUG_ON(!pte);
811
812 /*
813 * pXX_pfn() returns unsigned long, which must be cast to phys_addr_t
814 * before being left-shifted PAGE_SHIFT bits -- this trick is to
815 * make 32-PAE kernel work correctly.
816 */
817 switch (level) {
818 case PG_LEVEL_1G:
819 phys_addr = (phys_addr_t)pud_pfn(*(pud_t *)pte) << PAGE_SHIFT;
820 offset = virt_addr & ~PUD_MASK;
821 break;
822 case PG_LEVEL_2M:
823 phys_addr = (phys_addr_t)pmd_pfn(*(pmd_t *)pte) << PAGE_SHIFT;
824 offset = virt_addr & ~PMD_MASK;
825 break;
826 default:
827 phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT;
828 offset = virt_addr & ~PAGE_MASK;
829 }
830
831 return (phys_addr_t)(phys_addr | offset);
832 }
833 EXPORT_SYMBOL_GPL(slow_virt_to_phys);
834
835 /*
836 * Set the new pmd in all the pgds we know about:
837 */
838 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
839 {
840 /* change init_mm */
841 set_pte_atomic(kpte, pte);
842 #ifdef CONFIG_X86_32
843 if (!SHARED_KERNEL_PMD) {
844 struct page *page;
845
846 list_for_each_entry(page, &pgd_list, lru) {
847 pgd_t *pgd;
848 p4d_t *p4d;
849 pud_t *pud;
850 pmd_t *pmd;
851
852 pgd = (pgd_t *)page_address(page) + pgd_index(address);
853 p4d = p4d_offset(pgd, address);
854 pud = pud_offset(p4d, address);
855 pmd = pmd_offset(pud, address);
856 set_pte_atomic((pte_t *)pmd, pte);
857 }
858 }
859 #endif
860 }
861
862 static pgprot_t pgprot_clear_protnone_bits(pgprot_t prot)
863 {
864 /*
865 * _PAGE_GLOBAL means "global page" for present PTEs.
866 * But, it is also used to indicate _PAGE_PROTNONE
867 * for non-present PTEs.
868 *
869 * This ensures that a _PAGE_GLOBAL PTE going from
870 * present to non-present is not confused as
871 * _PAGE_PROTNONE.
872 */
873 if (!(pgprot_val(prot) & _PAGE_PRESENT))
874 pgprot_val(prot) &= ~_PAGE_GLOBAL;
875
876 return prot;
877 }
878
879 static int __should_split_large_page(pte_t *kpte, unsigned long address,
880 struct cpa_data *cpa)
881 {
882 unsigned long numpages, pmask, psize, lpaddr, pfn, old_pfn;
883 pgprot_t old_prot, new_prot, req_prot, chk_prot;
884 pte_t new_pte, *tmp;
885 enum pg_level level;
886 bool nx, rw;
887
888 /*
889 * Check for races, another CPU might have split this page
890 * up already:
891 */
892 tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
893 if (tmp != kpte)
894 return 1;
895
896 switch (level) {
897 case PG_LEVEL_2M:
898 old_prot = pmd_pgprot(*(pmd_t *)kpte);
899 old_pfn = pmd_pfn(*(pmd_t *)kpte);
900 cpa_inc_2m_checked();
901 break;
902 case PG_LEVEL_1G:
903 old_prot = pud_pgprot(*(pud_t *)kpte);
904 old_pfn = pud_pfn(*(pud_t *)kpte);
905 cpa_inc_1g_checked();
906 break;
907 default:
908 return -EINVAL;
909 }
910
911 psize = page_level_size(level);
912 pmask = page_level_mask(level);
913
914 /*
915 * Calculate the number of pages, which fit into this large
916 * page starting at address:
917 */
918 lpaddr = (address + psize) & pmask;
919 numpages = (lpaddr - address) >> PAGE_SHIFT;
920 if (numpages < cpa->numpages)
921 cpa->numpages = numpages;
922
923 /*
924 * We are safe now. Check whether the new pgprot is the same:
925 * Convert protection attributes to 4k-format, as cpa->mask* are set
926 * up accordingly.
927 */
928
929 /* Clear PSE (aka _PAGE_PAT) and move PAT bit to correct position */
930 req_prot = pgprot_large_2_4k(old_prot);
931
932 pgprot_val(req_prot) &= ~pgprot_val(cpa->mask_clr);
933 pgprot_val(req_prot) |= pgprot_val(cpa->mask_set);
934
935 /*
936 * req_prot is in format of 4k pages. It must be converted to large
937 * page format: the caching mode includes the PAT bit located at
938 * different bit positions in the two formats.
939 */
940 req_prot = pgprot_4k_2_large(req_prot);
941 req_prot = pgprot_clear_protnone_bits(req_prot);
942 if (pgprot_val(req_prot) & _PAGE_PRESENT)
943 pgprot_val(req_prot) |= _PAGE_PSE;
944
945 /*
946 * old_pfn points to the large page base pfn. So we need to add the
947 * offset of the virtual address:
948 */
949 pfn = old_pfn + ((address & (psize - 1)) >> PAGE_SHIFT);
950 cpa->pfn = pfn;
951
952 /*
953 * Calculate the large page base address and the number of 4K pages
954 * in the large page
955 */
956 lpaddr = address & pmask;
957 numpages = psize >> PAGE_SHIFT;
958
959 /*
960 * Sanity check that the existing mapping is correct versus the static
961 * protections. static_protections() guards against !PRESENT, so no
962 * extra conditional required here.
963 */
964 chk_prot = static_protections(old_prot, lpaddr, old_pfn, numpages,
965 psize, CPA_CONFLICT);
966
967 if (WARN_ON_ONCE(pgprot_val(chk_prot) != pgprot_val(old_prot))) {
968 /*
969 * Split the large page and tell the split code to
970 * enforce static protections.
971 */
972 cpa->force_static_prot = 1;
973 return 1;
974 }
975
976 /*
977 * Optimization: If the requested pgprot is the same as the current
978 * pgprot, then the large page can be preserved and no updates are
979 * required independent of alignment and length of the requested
980 * range. The above already established that the current pgprot is
981 * correct, which in consequence makes the requested pgprot correct
982 * as well if it is the same. The static protection scan below will
983 * not come to a different conclusion.
984 */
985 if (pgprot_val(req_prot) == pgprot_val(old_prot)) {
986 cpa_inc_lp_sameprot(level);
987 return 0;
988 }
989
990 /*
991 * If the requested range does not cover the full page, split it up
992 */
993 if (address != lpaddr || cpa->numpages != numpages)
994 return 1;
995
996 /*
997 * Check whether the requested pgprot is conflicting with a static
998 * protection requirement in the large page.
999 */
1000 new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
1001 psize, CPA_DETECT);
1002
1003 new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages,
1004 nx, rw);
1005
1006 /*
1007 * If there is a conflict, split the large page.
1008 *
1009 * There used to be a 4k wise evaluation trying really hard to
1010 * preserve the large pages, but experimentation has shown, that this
1011 * does not help at all. There might be corner cases which would
1012 * preserve one large page occasionally, but it's really not worth the
1013 * extra code and cycles for the common case.
1014 */
1015 if (pgprot_val(req_prot) != pgprot_val(new_prot))
1016 return 1;
1017
1018 /* All checks passed. Update the large page mapping. */
1019 new_pte = pfn_pte(old_pfn, new_prot);
1020 __set_pmd_pte(kpte, address, new_pte);
1021 cpa->flags |= CPA_FLUSHTLB;
1022 cpa_inc_lp_preserved(level);
1023 return 0;
1024 }
1025
1026 static int should_split_large_page(pte_t *kpte, unsigned long address,
1027 struct cpa_data *cpa)
1028 {
1029 int do_split;
1030
1031 if (cpa->force_split)
1032 return 1;
1033
1034 spin_lock(&pgd_lock);
1035 do_split = __should_split_large_page(kpte, address, cpa);
1036 spin_unlock(&pgd_lock);
1037
1038 return do_split;
1039 }
1040
1041 static void split_set_pte(struct cpa_data *cpa, pte_t *pte, unsigned long pfn,
1042 pgprot_t ref_prot, unsigned long address,
1043 unsigned long size)
1044 {
1045 unsigned int npg = PFN_DOWN(size);
1046 pgprot_t prot;
1047
1048 /*
1049 * If should_split_large_page() discovered an inconsistent mapping,
1050 * remove the invalid protection in the split mapping.
1051 */
1052 if (!cpa->force_static_prot)
1053 goto set;
1054
1055 /* Hand in lpsize = 0 to enforce the protection mechanism */
1056 prot = static_protections(ref_prot, address, pfn, npg, 0, CPA_PROTECT);
1057
1058 if (pgprot_val(prot) == pgprot_val(ref_prot))
1059 goto set;
1060
1061 /*
1062 * If this is splitting a PMD, fix it up. PUD splits cannot be
1063 * fixed trivially as that would require to rescan the newly
1064 * installed PMD mappings after returning from split_large_page()
1065 * so an eventual further split can allocate the necessary PTE
1066 * pages. Warn for now and revisit it in case this actually
1067 * happens.
1068 */
1069 if (size == PAGE_SIZE)
1070 ref_prot = prot;
1071 else
1072 pr_warn_once("CPA: Cannot fixup static protections for PUD split\n");
1073 set:
1074 set_pte(pte, pfn_pte(pfn, ref_prot));
1075 }
1076
1077 static int
1078 __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address,
1079 struct page *base)
1080 {
1081 unsigned long lpaddr, lpinc, ref_pfn, pfn, pfninc = 1;
1082 pte_t *pbase = (pte_t *)page_address(base);
1083 unsigned int i, level;
1084 pgprot_t ref_prot;
1085 bool nx, rw;
1086 pte_t *tmp;
1087
1088 spin_lock(&pgd_lock);
1089 /*
1090 * Check for races, another CPU might have split this page
1091 * up for us already:
1092 */
1093 tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
1094 if (tmp != kpte) {
1095 spin_unlock(&pgd_lock);
1096 return 1;
1097 }
1098
1099 paravirt_alloc_pte(&init_mm, page_to_pfn(base));
1100
1101 switch (level) {
1102 case PG_LEVEL_2M:
1103 ref_prot = pmd_pgprot(*(pmd_t *)kpte);
1104 /*
1105 * Clear PSE (aka _PAGE_PAT) and move
1106 * PAT bit to correct position.
1107 */
1108 ref_prot = pgprot_large_2_4k(ref_prot);
1109 ref_pfn = pmd_pfn(*(pmd_t *)kpte);
1110 lpaddr = address & PMD_MASK;
1111 lpinc = PAGE_SIZE;
1112 break;
1113
1114 case PG_LEVEL_1G:
1115 ref_prot = pud_pgprot(*(pud_t *)kpte);
1116 ref_pfn = pud_pfn(*(pud_t *)kpte);
1117 pfninc = PMD_SIZE >> PAGE_SHIFT;
1118 lpaddr = address & PUD_MASK;
1119 lpinc = PMD_SIZE;
1120 /*
1121 * Clear the PSE flags if the PRESENT flag is not set
1122 * otherwise pmd_present() will return true even on a non
1123 * present pmd.
1124 */
1125 if (!(pgprot_val(ref_prot) & _PAGE_PRESENT))
1126 pgprot_val(ref_prot) &= ~_PAGE_PSE;
1127 break;
1128
1129 default:
1130 spin_unlock(&pgd_lock);
1131 return 1;
1132 }
1133
1134 ref_prot = pgprot_clear_protnone_bits(ref_prot);
1135
1136 /*
1137 * Get the target pfn from the original entry:
1138 */
1139 pfn = ref_pfn;
1140 for (i = 0; i < PTRS_PER_PTE; i++, pfn += pfninc, lpaddr += lpinc)
1141 split_set_pte(cpa, pbase + i, pfn, ref_prot, lpaddr, lpinc);
1142
1143 if (virt_addr_valid(address)) {
1144 unsigned long pfn = PFN_DOWN(__pa(address));
1145
1146 if (pfn_range_is_mapped(pfn, pfn + 1))
1147 split_page_count(level);
1148 }
1149
1150 /*
1151 * Install the new, split up pagetable.
1152 *
1153 * We use the standard kernel pagetable protections for the new
1154 * pagetable protections, the actual ptes set above control the
1155 * primary protection behavior:
1156 */
1157 __set_pmd_pte(kpte, address, mk_pte(base, __pgprot(_KERNPG_TABLE)));
1158
1159 /*
1160 * Do a global flush tlb after splitting the large page
1161 * and before we do the actual change page attribute in the PTE.
1162 *
1163 * Without this, we violate the TLB application note, that says:
1164 * "The TLBs may contain both ordinary and large-page
1165 * translations for a 4-KByte range of linear addresses. This
1166 * may occur if software modifies the paging structures so that
1167 * the page size used for the address range changes. If the two
1168 * translations differ with respect to page frame or attributes
1169 * (e.g., permissions), processor behavior is undefined and may
1170 * be implementation-specific."
1171 *
1172 * We do this global tlb flush inside the cpa_lock, so that we
1173 * don't allow any other cpu, with stale tlb entries change the
1174 * page attribute in parallel, that also falls into the
1175 * just split large page entry.
1176 */
1177 flush_tlb_all();
1178 spin_unlock(&pgd_lock);
1179
1180 return 0;
1181 }
1182
1183 static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
1184 unsigned long address)
1185 {
1186 struct page *base;
1187
1188 if (!debug_pagealloc_enabled())
1189 spin_unlock(&cpa_lock);
1190 base = alloc_pages(GFP_KERNEL, 0);
1191 if (!debug_pagealloc_enabled())
1192 spin_lock(&cpa_lock);
1193 if (!base)
1194 return -ENOMEM;
1195
1196 if (__split_large_page(cpa, kpte, address, base))
1197 __free_page(base);
1198
1199 return 0;
1200 }
1201
1202 static bool try_to_free_pte_page(pte_t *pte)
1203 {
1204 int i;
1205
1206 for (i = 0; i < PTRS_PER_PTE; i++)
1207 if (!pte_none(pte[i]))
1208 return false;
1209
1210 free_page((unsigned long)pte);
1211 return true;
1212 }
1213
1214 static bool try_to_free_pmd_page(pmd_t *pmd)
1215 {
1216 int i;
1217
1218 for (i = 0; i < PTRS_PER_PMD; i++)
1219 if (!pmd_none(pmd[i]))
1220 return false;
1221
1222 free_page((unsigned long)pmd);
1223 return true;
1224 }
1225
1226 static bool unmap_pte_range(pmd_t *pmd, unsigned long start, unsigned long end)
1227 {
1228 pte_t *pte = pte_offset_kernel(pmd, start);
1229
1230 while (start < end) {
1231 set_pte(pte, __pte(0));
1232
1233 start += PAGE_SIZE;
1234 pte++;
1235 }
1236
1237 if (try_to_free_pte_page((pte_t *)pmd_page_vaddr(*pmd))) {
1238 pmd_clear(pmd);
1239 return true;
1240 }
1241 return false;
1242 }
1243
1244 static void __unmap_pmd_range(pud_t *pud, pmd_t *pmd,
1245 unsigned long start, unsigned long end)
1246 {
1247 if (unmap_pte_range(pmd, start, end))
1248 if (try_to_free_pmd_page(pud_pgtable(*pud)))
1249 pud_clear(pud);
1250 }
1251
1252 static void unmap_pmd_range(pud_t *pud, unsigned long start, unsigned long end)
1253 {
1254 pmd_t *pmd = pmd_offset(pud, start);
1255
1256 /*
1257 * Not on a 2MB page boundary?
1258 */
1259 if (start & (PMD_SIZE - 1)) {
1260 unsigned long next_page = (start + PMD_SIZE) & PMD_MASK;
1261 unsigned long pre_end = min_t(unsigned long, end, next_page);
1262
1263 __unmap_pmd_range(pud, pmd, start, pre_end);
1264
1265 start = pre_end;
1266 pmd++;
1267 }
1268
1269 /*
1270 * Try to unmap in 2M chunks.
1271 */
1272 while (end - start >= PMD_SIZE) {
1273 if (pmd_leaf(*pmd))
1274 pmd_clear(pmd);
1275 else
1276 __unmap_pmd_range(pud, pmd, start, start + PMD_SIZE);
1277
1278 start += PMD_SIZE;
1279 pmd++;
1280 }
1281
1282 /*
1283 * 4K leftovers?
1284 */
1285 if (start < end)
1286 return __unmap_pmd_range(pud, pmd, start, end);
1287
1288 /*
1289 * Try again to free the PMD page if haven't succeeded above.
1290 */
1291 if (!pud_none(*pud))
1292 if (try_to_free_pmd_page(pud_pgtable(*pud)))
1293 pud_clear(pud);
1294 }
1295
1296 static void unmap_pud_range(p4d_t *p4d, unsigned long start, unsigned long end)
1297 {
1298 pud_t *pud = pud_offset(p4d, start);
1299
1300 /*
1301 * Not on a GB page boundary?
1302 */
1303 if (start & (PUD_SIZE - 1)) {
1304 unsigned long next_page = (start + PUD_SIZE) & PUD_MASK;
1305 unsigned long pre_end = min_t(unsigned long, end, next_page);
1306
1307 unmap_pmd_range(pud, start, pre_end);
1308
1309 start = pre_end;
1310 pud++;
1311 }
1312
1313 /*
1314 * Try to unmap in 1G chunks?
1315 */
1316 while (end - start >= PUD_SIZE) {
1317
1318 if (pud_leaf(*pud))
1319 pud_clear(pud);
1320 else
1321 unmap_pmd_range(pud, start, start + PUD_SIZE);
1322
1323 start += PUD_SIZE;
1324 pud++;
1325 }
1326
1327 /*
1328 * 2M leftovers?
1329 */
1330 if (start < end)
1331 unmap_pmd_range(pud, start, end);
1332
1333 /*
1334 * No need to try to free the PUD page because we'll free it in
1335 * populate_pgd's error path
1336 */
1337 }
1338
1339 static int alloc_pte_page(pmd_t *pmd)
1340 {
1341 pte_t *pte = (pte_t *)get_zeroed_page(GFP_KERNEL);
1342 if (!pte)
1343 return -1;
1344
1345 set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
1346 return 0;
1347 }
1348
1349 static int alloc_pmd_page(pud_t *pud)
1350 {
1351 pmd_t *pmd = (pmd_t *)get_zeroed_page(GFP_KERNEL);
1352 if (!pmd)
1353 return -1;
1354
1355 set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
1356 return 0;
1357 }
1358
1359 static void populate_pte(struct cpa_data *cpa,
1360 unsigned long start, unsigned long end,
1361 unsigned num_pages, pmd_t *pmd, pgprot_t pgprot)
1362 {
1363 pte_t *pte;
1364
1365 pte = pte_offset_kernel(pmd, start);
1366
1367 pgprot = pgprot_clear_protnone_bits(pgprot);
1368
1369 while (num_pages-- && start < end) {
1370 set_pte(pte, pfn_pte(cpa->pfn, pgprot));
1371
1372 start += PAGE_SIZE;
1373 cpa->pfn++;
1374 pte++;
1375 }
1376 }
1377
1378 static long populate_pmd(struct cpa_data *cpa,
1379 unsigned long start, unsigned long end,
1380 unsigned num_pages, pud_t *pud, pgprot_t pgprot)
1381 {
1382 long cur_pages = 0;
1383 pmd_t *pmd;
1384 pgprot_t pmd_pgprot;
1385
1386 /*
1387 * Not on a 2M boundary?
1388 */
1389 if (start & (PMD_SIZE - 1)) {
1390 unsigned long pre_end = start + (num_pages << PAGE_SHIFT);
1391 unsigned long next_page = (start + PMD_SIZE) & PMD_MASK;
1392
1393 pre_end = min_t(unsigned long, pre_end, next_page);
1394 cur_pages = (pre_end - start) >> PAGE_SHIFT;
1395 cur_pages = min_t(unsigned int, num_pages, cur_pages);
1396
1397 /*
1398 * Need a PTE page?
1399 */
1400 pmd = pmd_offset(pud, start);
1401 if (pmd_none(*pmd))
1402 if (alloc_pte_page(pmd))
1403 return -1;
1404
1405 populate_pte(cpa, start, pre_end, cur_pages, pmd, pgprot);
1406
1407 start = pre_end;
1408 }
1409
1410 /*
1411 * We mapped them all?
1412 */
1413 if (num_pages == cur_pages)
1414 return cur_pages;
1415
1416 pmd_pgprot = pgprot_4k_2_large(pgprot);
1417
1418 while (end - start >= PMD_SIZE) {
1419
1420 /*
1421 * We cannot use a 1G page so allocate a PMD page if needed.
1422 */
1423 if (pud_none(*pud))
1424 if (alloc_pmd_page(pud))
1425 return -1;
1426
1427 pmd = pmd_offset(pud, start);
1428
1429 set_pmd(pmd, pmd_mkhuge(pfn_pmd(cpa->pfn,
1430 canon_pgprot(pmd_pgprot))));
1431
1432 start += PMD_SIZE;
1433 cpa->pfn += PMD_SIZE >> PAGE_SHIFT;
1434 cur_pages += PMD_SIZE >> PAGE_SHIFT;
1435 }
1436
1437 /*
1438 * Map trailing 4K pages.
1439 */
1440 if (start < end) {
1441 pmd = pmd_offset(pud, start);
1442 if (pmd_none(*pmd))
1443 if (alloc_pte_page(pmd))
1444 return -1;
1445
1446 populate_pte(cpa, start, end, num_pages - cur_pages,
1447 pmd, pgprot);
1448 }
1449 return num_pages;
1450 }
1451
1452 static int populate_pud(struct cpa_data *cpa, unsigned long start, p4d_t *p4d,
1453 pgprot_t pgprot)
1454 {
1455 pud_t *pud;
1456 unsigned long end;
1457 long cur_pages = 0;
1458 pgprot_t pud_pgprot;
1459
1460 end = start + (cpa->numpages << PAGE_SHIFT);
1461
1462 /*
1463 * Not on a Gb page boundary? => map everything up to it with
1464 * smaller pages.
1465 */
1466 if (start & (PUD_SIZE - 1)) {
1467 unsigned long pre_end;
1468 unsigned long next_page = (start + PUD_SIZE) & PUD_MASK;
1469
1470 pre_end = min_t(unsigned long, end, next_page);
1471 cur_pages = (pre_end - start) >> PAGE_SHIFT;
1472 cur_pages = min_t(int, (int)cpa->numpages, cur_pages);
1473
1474 pud = pud_offset(p4d, start);
1475
1476 /*
1477 * Need a PMD page?
1478 */
1479 if (pud_none(*pud))
1480 if (alloc_pmd_page(pud))
1481 return -1;
1482
1483 cur_pages = populate_pmd(cpa, start, pre_end, cur_pages,
1484 pud, pgprot);
1485 if (cur_pages < 0)
1486 return cur_pages;
1487
1488 start = pre_end;
1489 }
1490
1491 /* We mapped them all? */
1492 if (cpa->numpages == cur_pages)
1493 return cur_pages;
1494
1495 pud = pud_offset(p4d, start);
1496 pud_pgprot = pgprot_4k_2_large(pgprot);
1497
1498 /*
1499 * Map everything starting from the Gb boundary, possibly with 1G pages
1500 */
1501 while (boot_cpu_has(X86_FEATURE_GBPAGES) && end - start >= PUD_SIZE) {
1502 set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn,
1503 canon_pgprot(pud_pgprot))));
1504
1505 start += PUD_SIZE;
1506 cpa->pfn += PUD_SIZE >> PAGE_SHIFT;
1507 cur_pages += PUD_SIZE >> PAGE_SHIFT;
1508 pud++;
1509 }
1510
1511 /* Map trailing leftover */
1512 if (start < end) {
1513 long tmp;
1514
1515 pud = pud_offset(p4d, start);
1516 if (pud_none(*pud))
1517 if (alloc_pmd_page(pud))
1518 return -1;
1519
1520 tmp = populate_pmd(cpa, start, end, cpa->numpages - cur_pages,
1521 pud, pgprot);
1522 if (tmp < 0)
1523 return cur_pages;
1524
1525 cur_pages += tmp;
1526 }
1527 return cur_pages;
1528 }
1529
1530 /*
1531 * Restrictions for kernel page table do not necessarily apply when mapping in
1532 * an alternate PGD.
1533 */
1534 static int populate_pgd(struct cpa_data *cpa, unsigned long addr)
1535 {
1536 pgprot_t pgprot = __pgprot(_KERNPG_TABLE);
1537 pud_t *pud = NULL; /* shut up gcc */
1538 p4d_t *p4d;
1539 pgd_t *pgd_entry;
1540 long ret;
1541
1542 pgd_entry = cpa->pgd + pgd_index(addr);
1543
1544 if (pgd_none(*pgd_entry)) {
1545 p4d = (p4d_t *)get_zeroed_page(GFP_KERNEL);
1546 if (!p4d)
1547 return -1;
1548
1549 set_pgd(pgd_entry, __pgd(__pa(p4d) | _KERNPG_TABLE));
1550 }
1551
1552 /*
1553 * Allocate a PUD page and hand it down for mapping.
1554 */
1555 p4d = p4d_offset(pgd_entry, addr);
1556 if (p4d_none(*p4d)) {
1557 pud = (pud_t *)get_zeroed_page(GFP_KERNEL);
1558 if (!pud)
1559 return -1;
1560
1561 set_p4d(p4d, __p4d(__pa(pud) | _KERNPG_TABLE));
1562 }
1563
1564 pgprot_val(pgprot) &= ~pgprot_val(cpa->mask_clr);
1565 pgprot_val(pgprot) |= pgprot_val(cpa->mask_set);
1566
1567 ret = populate_pud(cpa, addr, p4d, pgprot);
1568 if (ret < 0) {
1569 /*
1570 * Leave the PUD page in place in case some other CPU or thread
1571 * already found it, but remove any useless entries we just
1572 * added to it.
1573 */
1574 unmap_pud_range(p4d, addr,
1575 addr + (cpa->numpages << PAGE_SHIFT));
1576 return ret;
1577 }
1578
1579 cpa->numpages = ret;
1580 return 0;
1581 }
1582
1583 static int __cpa_process_fault(struct cpa_data *cpa, unsigned long vaddr,
1584 int primary)
1585 {
1586 if (cpa->pgd) {
1587 /*
1588 * Right now, we only execute this code path when mapping
1589 * the EFI virtual memory map regions, no other users
1590 * provide a ->pgd value. This may change in the future.
1591 */
1592 return populate_pgd(cpa, vaddr);
1593 }
1594
1595 /*
1596 * Ignore all non primary paths.
1597 */
1598 if (!primary) {
1599 cpa->numpages = 1;
1600 return 0;
1601 }
1602
1603 /*
1604 * Ignore the NULL PTE for kernel identity mapping, as it is expected
1605 * to have holes.
1606 * Also set numpages to '1' indicating that we processed cpa req for
1607 * one virtual address page and its pfn. TBD: numpages can be set based
1608 * on the initial value and the level returned by lookup_address().
1609 */
1610 if (within(vaddr, PAGE_OFFSET,
1611 PAGE_OFFSET + (max_pfn_mapped << PAGE_SHIFT))) {
1612 cpa->numpages = 1;
1613 cpa->pfn = __pa(vaddr) >> PAGE_SHIFT;
1614 return 0;
1615
1616 } else if (__cpa_pfn_in_highmap(cpa->pfn)) {
1617 /* Faults in the highmap are OK, so do not warn: */
1618 return -EFAULT;
1619 } else {
1620 WARN(1, KERN_WARNING "CPA: called for zero pte. "
1621 "vaddr = %lx cpa->vaddr = %lx\n", vaddr,
1622 *cpa->vaddr);
1623
1624 return -EFAULT;
1625 }
1626 }
1627
1628 static int __change_page_attr(struct cpa_data *cpa, int primary)
1629 {
1630 unsigned long address;
1631 int do_split, err;
1632 unsigned int level;
1633 pte_t *kpte, old_pte;
1634 bool nx, rw;
1635
1636 address = __cpa_addr(cpa, cpa->curpage);
1637 repeat:
1638 kpte = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
1639 if (!kpte)
1640 return __cpa_process_fault(cpa, address, primary);
1641
1642 old_pte = *kpte;
1643 if (pte_none(old_pte))
1644 return __cpa_process_fault(cpa, address, primary);
1645
1646 if (level == PG_LEVEL_4K) {
1647 pte_t new_pte;
1648 pgprot_t old_prot = pte_pgprot(old_pte);
1649 pgprot_t new_prot = pte_pgprot(old_pte);
1650 unsigned long pfn = pte_pfn(old_pte);
1651
1652 pgprot_val(new_prot) &= ~pgprot_val(cpa->mask_clr);
1653 pgprot_val(new_prot) |= pgprot_val(cpa->mask_set);
1654
1655 cpa_inc_4k_install();
1656 /* Hand in lpsize = 0 to enforce the protection mechanism */
1657 new_prot = static_protections(new_prot, address, pfn, 1, 0,
1658 CPA_PROTECT);
1659
1660 new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1,
1661 nx, rw);
1662
1663 new_prot = pgprot_clear_protnone_bits(new_prot);
1664
1665 /*
1666 * We need to keep the pfn from the existing PTE,
1667 * after all we're only going to change its attributes
1668 * not the memory it points to
1669 */
1670 new_pte = pfn_pte(pfn, new_prot);
1671 cpa->pfn = pfn;
1672 /*
1673 * Do we really change anything ?
1674 */
1675 if (pte_val(old_pte) != pte_val(new_pte)) {
1676 set_pte_atomic(kpte, new_pte);
1677 cpa->flags |= CPA_FLUSHTLB;
1678 }
1679 cpa->numpages = 1;
1680 return 0;
1681 }
1682
1683 /*
1684 * Check, whether we can keep the large page intact
1685 * and just change the pte:
1686 */
1687 do_split = should_split_large_page(kpte, address, cpa);
1688 /*
1689 * When the range fits into the existing large page,
1690 * return. cp->numpages and cpa->tlbflush have been updated in
1691 * try_large_page:
1692 */
1693 if (do_split <= 0)
1694 return do_split;
1695
1696 /*
1697 * We have to split the large page:
1698 */
1699 err = split_large_page(cpa, kpte, address);
1700 if (!err)
1701 goto repeat;
1702
1703 return err;
1704 }
1705
1706 static int __change_page_attr_set_clr(struct cpa_data *cpa, int primary);
1707
1708 /*
1709 * Check the directmap and "high kernel map" 'aliases'.
1710 */
1711 static int cpa_process_alias(struct cpa_data *cpa)
1712 {
1713 struct cpa_data alias_cpa;
1714 unsigned long laddr = (unsigned long)__va(cpa->pfn << PAGE_SHIFT);
1715 unsigned long vaddr;
1716 int ret;
1717
1718 if (!pfn_range_is_mapped(cpa->pfn, cpa->pfn + 1))
1719 return 0;
1720
1721 /*
1722 * No need to redo, when the primary call touched the direct
1723 * mapping already:
1724 */
1725 vaddr = __cpa_addr(cpa, cpa->curpage);
1726 if (!(within(vaddr, PAGE_OFFSET,
1727 PAGE_OFFSET + (max_pfn_mapped << PAGE_SHIFT)))) {
1728
1729 alias_cpa = *cpa;
1730 alias_cpa.vaddr = &laddr;
1731 alias_cpa.flags &= ~(CPA_PAGES_ARRAY | CPA_ARRAY);
1732 alias_cpa.curpage = 0;
1733
1734 /* Directmap always has NX set, do not modify. */
1735 if (__supported_pte_mask & _PAGE_NX) {
1736 alias_cpa.mask_clr.pgprot &= ~_PAGE_NX;
1737 alias_cpa.mask_set.pgprot &= ~_PAGE_NX;
1738 }
1739
1740 cpa->force_flush_all = 1;
1741
1742 ret = __change_page_attr_set_clr(&alias_cpa, 0);
1743 if (ret)
1744 return ret;
1745 }
1746
1747 #ifdef CONFIG_X86_64
1748 /*
1749 * If the primary call didn't touch the high mapping already
1750 * and the physical address is inside the kernel map, we need
1751 * to touch the high mapped kernel as well:
1752 */
1753 if (!within(vaddr, (unsigned long)_text, _brk_end) &&
1754 __cpa_pfn_in_highmap(cpa->pfn)) {
1755 unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
1756 __START_KERNEL_map - phys_base;
1757 alias_cpa = *cpa;
1758 alias_cpa.vaddr = &temp_cpa_vaddr;
1759 alias_cpa.flags &= ~(CPA_PAGES_ARRAY | CPA_ARRAY);
1760 alias_cpa.curpage = 0;
1761
1762 /*
1763 * [_text, _brk_end) also covers data, do not modify NX except
1764 * in cases where the highmap is the primary target.
1765 */
1766 if (__supported_pte_mask & _PAGE_NX) {
1767 alias_cpa.mask_clr.pgprot &= ~_PAGE_NX;
1768 alias_cpa.mask_set.pgprot &= ~_PAGE_NX;
1769 }
1770
1771 cpa->force_flush_all = 1;
1772 /*
1773 * The high mapping range is imprecise, so ignore the
1774 * return value.
1775 */
1776 __change_page_attr_set_clr(&alias_cpa, 0);
1777 }
1778 #endif
1779
1780 return 0;
1781 }
1782
1783 static int __change_page_attr_set_clr(struct cpa_data *cpa, int primary)
1784 {
1785 unsigned long numpages = cpa->numpages;
1786 unsigned long rempages = numpages;
1787 int ret = 0;
1788
1789 /*
1790 * No changes, easy!
1791 */
1792 if (!(pgprot_val(cpa->mask_set) | pgprot_val(cpa->mask_clr)) &&
1793 !cpa->force_split)
1794 return ret;
1795
1796 while (rempages) {
1797 /*
1798 * Store the remaining nr of pages for the large page
1799 * preservation check.
1800 */
1801 cpa->numpages = rempages;
1802 /* for array changes, we can't use large page */
1803 if (cpa->flags & (CPA_ARRAY | CPA_PAGES_ARRAY))
1804 cpa->numpages = 1;
1805
1806 if (!debug_pagealloc_enabled())
1807 spin_lock(&cpa_lock);
1808 ret = __change_page_attr(cpa, primary);
1809 if (!debug_pagealloc_enabled())
1810 spin_unlock(&cpa_lock);
1811 if (ret)
1812 goto out;
1813
1814 if (primary && !(cpa->flags & CPA_NO_CHECK_ALIAS)) {
1815 ret = cpa_process_alias(cpa);
1816 if (ret)
1817 goto out;
1818 }
1819
1820 /*
1821 * Adjust the number of pages with the result of the
1822 * CPA operation. Either a large page has been
1823 * preserved or a single page update happened.
1824 */
1825 BUG_ON(cpa->numpages > rempages || !cpa->numpages);
1826 rempages -= cpa->numpages;
1827 cpa->curpage += cpa->numpages;
1828 }
1829
1830 out:
1831 /* Restore the original numpages */
1832 cpa->numpages = numpages;
1833 return ret;
1834 }
1835
1836 static int change_page_attr_set_clr(unsigned long *addr, int numpages,
1837 pgprot_t mask_set, pgprot_t mask_clr,
1838 int force_split, int in_flag,
1839 struct page **pages)
1840 {
1841 struct cpa_data cpa;
1842 int ret, cache;
1843
1844 memset(&cpa, 0, sizeof(cpa));
1845
1846 /*
1847 * Check, if we are requested to set a not supported
1848 * feature. Clearing non-supported features is OK.
1849 */
1850 mask_set = canon_pgprot(mask_set);
1851
1852 if (!pgprot_val(mask_set) && !pgprot_val(mask_clr) && !force_split)
1853 return 0;
1854
1855 /* Ensure we are PAGE_SIZE aligned */
1856 if (in_flag & CPA_ARRAY) {
1857 int i;
1858 for (i = 0; i < numpages; i++) {
1859 if (addr[i] & ~PAGE_MASK) {
1860 addr[i] &= PAGE_MASK;
1861 WARN_ON_ONCE(1);
1862 }
1863 }
1864 } else if (!(in_flag & CPA_PAGES_ARRAY)) {
1865 /*
1866 * in_flag of CPA_PAGES_ARRAY implies it is aligned.
1867 * No need to check in that case
1868 */
1869 if (*addr & ~PAGE_MASK) {
1870 *addr &= PAGE_MASK;
1871 /*
1872 * People should not be passing in unaligned addresses:
1873 */
1874 WARN_ON_ONCE(1);
1875 }
1876 }
1877
1878 /* Must avoid aliasing mappings in the highmem code */
1879 kmap_flush_unused();
1880
1881 vm_unmap_aliases();
1882
1883 cpa.vaddr = addr;
1884 cpa.pages = pages;
1885 cpa.numpages = numpages;
1886 cpa.mask_set = mask_set;
1887 cpa.mask_clr = mask_clr;
1888 cpa.flags = in_flag;
1889 cpa.curpage = 0;
1890 cpa.force_split = force_split;
1891
1892 ret = __change_page_attr_set_clr(&cpa, 1);
1893
1894 /*
1895 * Check whether we really changed something:
1896 */
1897 if (!(cpa.flags & CPA_FLUSHTLB))
1898 goto out;
1899
1900 /*
1901 * No need to flush, when we did not set any of the caching
1902 * attributes:
1903 */
1904 cache = !!pgprot2cachemode(mask_set);
1905
1906 /*
1907 * On error; flush everything to be sure.
1908 */
1909 if (ret) {
1910 cpa_flush_all(cache);
1911 goto out;
1912 }
1913
1914 cpa_flush(&cpa, cache);
1915 out:
1916 return ret;
1917 }
1918
1919 static inline int change_page_attr_set(unsigned long *addr, int numpages,
1920 pgprot_t mask, int array)
1921 {
1922 return change_page_attr_set_clr(addr, numpages, mask, __pgprot(0), 0,
1923 (array ? CPA_ARRAY : 0), NULL);
1924 }
1925
1926 static inline int change_page_attr_clear(unsigned long *addr, int numpages,
1927 pgprot_t mask, int array)
1928 {
1929 return change_page_attr_set_clr(addr, numpages, __pgprot(0), mask, 0,
1930 (array ? CPA_ARRAY : 0), NULL);
1931 }
1932
1933 static inline int cpa_set_pages_array(struct page **pages, int numpages,
1934 pgprot_t mask)
1935 {
1936 return change_page_attr_set_clr(NULL, numpages, mask, __pgprot(0), 0,
1937 CPA_PAGES_ARRAY, pages);
1938 }
1939
1940 static inline int cpa_clear_pages_array(struct page **pages, int numpages,
1941 pgprot_t mask)
1942 {
1943 return change_page_attr_set_clr(NULL, numpages, __pgprot(0), mask, 0,
1944 CPA_PAGES_ARRAY, pages);
1945 }
1946
1947 /*
1948 * __set_memory_prot is an internal helper for callers that have been passed
1949 * a pgprot_t value from upper layers and a reservation has already been taken.
1950 * If you want to set the pgprot to a specific page protocol, use the
1951 * set_memory_xx() functions.
1952 */
1953 int __set_memory_prot(unsigned long addr, int numpages, pgprot_t prot)
1954 {
1955 return change_page_attr_set_clr(&addr, numpages, prot,
1956 __pgprot(~pgprot_val(prot)), 0, 0,
1957 NULL);
1958 }
1959
1960 int _set_memory_uc(unsigned long addr, int numpages)
1961 {
1962 /*
1963 * for now UC MINUS. see comments in ioremap()
1964 * If you really need strong UC use ioremap_uc(), but note
1965 * that you cannot override IO areas with set_memory_*() as
1966 * these helpers cannot work with IO memory.
1967 */
1968 return change_page_attr_set(&addr, numpages,
1969 cachemode2pgprot(_PAGE_CACHE_MODE_UC_MINUS),
1970 0);
1971 }
1972
1973 int set_memory_uc(unsigned long addr, int numpages)
1974 {
1975 int ret;
1976
1977 /*
1978 * for now UC MINUS. see comments in ioremap()
1979 */
1980 ret = memtype_reserve(__pa(addr), __pa(addr) + numpages * PAGE_SIZE,
1981 _PAGE_CACHE_MODE_UC_MINUS, NULL);
1982 if (ret)
1983 goto out_err;
1984
1985 ret = _set_memory_uc(addr, numpages);
1986 if (ret)
1987 goto out_free;
1988
1989 return 0;
1990
1991 out_free:
1992 memtype_free(__pa(addr), __pa(addr) + numpages * PAGE_SIZE);
1993 out_err:
1994 return ret;
1995 }
1996 EXPORT_SYMBOL(set_memory_uc);
1997
1998 int _set_memory_wc(unsigned long addr, int numpages)
1999 {
2000 int ret;
2001
2002 ret = change_page_attr_set(&addr, numpages,
2003 cachemode2pgprot(_PAGE_CACHE_MODE_UC_MINUS),
2004 0);
2005 if (!ret) {
2006 ret = change_page_attr_set_clr(&addr, numpages,
2007 cachemode2pgprot(_PAGE_CACHE_MODE_WC),
2008 __pgprot(_PAGE_CACHE_MASK),
2009 0, 0, NULL);
2010 }
2011 return ret;
2012 }
2013
2014 int set_memory_wc(unsigned long addr, int numpages)
2015 {
2016 int ret;
2017
2018 ret = memtype_reserve(__pa(addr), __pa(addr) + numpages * PAGE_SIZE,
2019 _PAGE_CACHE_MODE_WC, NULL);
2020 if (ret)
2021 return ret;
2022
2023 ret = _set_memory_wc(addr, numpages);
2024 if (ret)
2025 memtype_free(__pa(addr), __pa(addr) + numpages * PAGE_SIZE);
2026
2027 return ret;
2028 }
2029 EXPORT_SYMBOL(set_memory_wc);
2030
2031 int _set_memory_wt(unsigned long addr, int numpages)
2032 {
2033 return change_page_attr_set(&addr, numpages,
2034 cachemode2pgprot(_PAGE_CACHE_MODE_WT), 0);
2035 }
2036
2037 int _set_memory_wb(unsigned long addr, int numpages)
2038 {
2039 /* WB cache mode is hard wired to all cache attribute bits being 0 */
2040 return change_page_attr_clear(&addr, numpages,
2041 __pgprot(_PAGE_CACHE_MASK), 0);
2042 }
2043
2044 int set_memory_wb(unsigned long addr, int numpages)
2045 {
2046 int ret;
2047
2048 ret = _set_memory_wb(addr, numpages);
2049 if (ret)
2050 return ret;
2051
2052 memtype_free(__pa(addr), __pa(addr) + numpages * PAGE_SIZE);
2053 return 0;
2054 }
2055 EXPORT_SYMBOL(set_memory_wb);
2056
2057 /* Prevent speculative access to a page by marking it not-present */
2058 #ifdef CONFIG_X86_64
2059 int set_mce_nospec(unsigned long pfn)
2060 {
2061 unsigned long decoy_addr;
2062 int rc;
2063
2064 /* SGX pages are not in the 1:1 map */
2065 if (arch_is_platform_page(pfn << PAGE_SHIFT))
2066 return 0;
2067 /*
2068 * We would like to just call:
2069 * set_memory_XX((unsigned long)pfn_to_kaddr(pfn), 1);
2070 * but doing that would radically increase the odds of a
2071 * speculative access to the poison page because we'd have
2072 * the virtual address of the kernel 1:1 mapping sitting
2073 * around in registers.
2074 * Instead we get tricky. We create a non-canonical address
2075 * that looks just like the one we want, but has bit 63 flipped.
2076 * This relies on set_memory_XX() properly sanitizing any __pa()
2077 * results with __PHYSICAL_MASK or PTE_PFN_MASK.
2078 */
2079 decoy_addr = (pfn << PAGE_SHIFT) + (PAGE_OFFSET ^ BIT(63));
2080
2081 rc = set_memory_np(decoy_addr, 1);
2082 if (rc)
2083 pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
2084 return rc;
2085 }
2086
2087 /* Restore full speculative operation to the pfn. */
2088 int clear_mce_nospec(unsigned long pfn)
2089 {
2090 unsigned long addr = (unsigned long) pfn_to_kaddr(pfn);
2091
2092 return set_memory_p(addr, 1);
2093 }
2094 EXPORT_SYMBOL_GPL(clear_mce_nospec);
2095 #endif /* CONFIG_X86_64 */
2096
2097 int set_memory_x(unsigned long addr, int numpages)
2098 {
2099 if (!(__supported_pte_mask & _PAGE_NX))
2100 return 0;
2101
2102 return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_NX), 0);
2103 }
2104
2105 int set_memory_nx(unsigned long addr, int numpages)
2106 {
2107 if (!(__supported_pte_mask & _PAGE_NX))
2108 return 0;
2109
2110 return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_NX), 0);
2111 }
2112
2113 int set_memory_ro(unsigned long addr, int numpages)
2114 {
2115 return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW | _PAGE_DIRTY), 0);
2116 }
2117
2118 int set_memory_rox(unsigned long addr, int numpages)
2119 {
2120 pgprot_t clr = __pgprot(_PAGE_RW | _PAGE_DIRTY);
2121
2122 if (__supported_pte_mask & _PAGE_NX)
2123 clr.pgprot |= _PAGE_NX;
2124
2125 return change_page_attr_clear(&addr, numpages, clr, 0);
2126 }
2127
2128 int set_memory_rw(unsigned long addr, int numpages)
2129 {
2130 return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0);
2131 }
2132
2133 int set_memory_np(unsigned long addr, int numpages)
2134 {
2135 return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0);
2136 }
2137
2138 int set_memory_np_noalias(unsigned long addr, int numpages)
2139 {
2140 return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
2141 __pgprot(_PAGE_PRESENT), 0,
2142 CPA_NO_CHECK_ALIAS, NULL);
2143 }
2144
2145 int set_memory_p(unsigned long addr, int numpages)
2146 {
2147 return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_PRESENT), 0);
2148 }
2149
2150 int set_memory_4k(unsigned long addr, int numpages)
2151 {
2152 return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
2153 __pgprot(0), 1, 0, NULL);
2154 }
2155
2156 int set_memory_nonglobal(unsigned long addr, int numpages)
2157 {
2158 return change_page_attr_clear(&addr, numpages,
2159 __pgprot(_PAGE_GLOBAL), 0);
2160 }
2161
2162 int set_memory_global(unsigned long addr, int numpages)
2163 {
2164 return change_page_attr_set(&addr, numpages,
2165 __pgprot(_PAGE_GLOBAL), 0);
2166 }
2167
2168 /*
2169 * __set_memory_enc_pgtable() is used for the hypervisors that get
2170 * informed about "encryption" status via page tables.
2171 */
2172 static int __set_memory_enc_pgtable(unsigned long addr, int numpages, bool enc)
2173 {
2174 pgprot_t empty = __pgprot(0);
2175 struct cpa_data cpa;
2176 int ret;
2177
2178 /* Should not be working on unaligned addresses */
2179 if (WARN_ONCE(addr & ~PAGE_MASK, "misaligned address: %#lx\n", addr))
2180 addr &= PAGE_MASK;
2181
2182 memset(&cpa, 0, sizeof(cpa));
2183 cpa.vaddr = &addr;
2184 cpa.numpages = numpages;
2185 cpa.mask_set = enc ? pgprot_encrypted(empty) : pgprot_decrypted(empty);
2186 cpa.mask_clr = enc ? pgprot_decrypted(empty) : pgprot_encrypted(empty);
2187 cpa.pgd = init_mm.pgd;
2188
2189 /* Must avoid aliasing mappings in the highmem code */
2190 kmap_flush_unused();
2191 vm_unmap_aliases();
2192
2193 /* Flush the caches as needed before changing the encryption attribute. */
2194 if (x86_platform.guest.enc_tlb_flush_required(enc))
2195 cpa_flush(&cpa, x86_platform.guest.enc_cache_flush_required());
2196
2197 /* Notify hypervisor that we are about to set/clr encryption attribute. */
2198 ret = x86_platform.guest.enc_status_change_prepare(addr, numpages, enc);
2199 if (ret)
2200 goto vmm_fail;
2201
2202 ret = __change_page_attr_set_clr(&cpa, 1);
2203
2204 /*
2205 * After changing the encryption attribute, we need to flush TLBs again
2206 * in case any speculative TLB caching occurred (but no need to flush
2207 * caches again). We could just use cpa_flush_all(), but in case TLB
2208 * flushing gets optimized in the cpa_flush() path use the same logic
2209 * as above.
2210 */
2211 cpa_flush(&cpa, 0);
2212
2213 if (ret)
2214 return ret;
2215
2216 /* Notify hypervisor that we have successfully set/clr encryption attribute. */
2217 ret = x86_platform.guest.enc_status_change_finish(addr, numpages, enc);
2218 if (ret)
2219 goto vmm_fail;
2220
2221 return 0;
2222
2223 vmm_fail:
2224 WARN_ONCE(1, "CPA VMM failure to convert memory (addr=%p, numpages=%d) to %s: %d\n",
2225 (void *)addr, numpages, enc ? "private" : "shared", ret);
2226
2227 return ret;
2228 }
2229
2230 /*
2231 * The lock serializes conversions between private and shared memory.
2232 *
2233 * It is taken for read on conversion. A write lock guarantees that no
2234 * concurrent conversions are in progress.
2235 */
2236 static DECLARE_RWSEM(mem_enc_lock);
2237
2238 /*
2239 * Stop new private<->shared conversions.
2240 *
2241 * Taking the exclusive mem_enc_lock waits for in-flight conversions to complete.
2242 * The lock is not released to prevent new conversions from being started.
2243 */
2244 bool set_memory_enc_stop_conversion(void)
2245 {
2246 /*
2247 * In a crash scenario, sleep is not allowed. Try to take the lock.
2248 * Failure indicates that there is a race with the conversion.
2249 */
2250 if (oops_in_progress)
2251 return down_write_trylock(&mem_enc_lock);
2252
2253 down_write(&mem_enc_lock);
2254
2255 return true;
2256 }
2257
2258 static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc)
2259 {
2260 int ret = 0;
2261
2262 if (cc_platform_has(CC_ATTR_MEM_ENCRYPT)) {
2263 if (!down_read_trylock(&mem_enc_lock))
2264 return -EBUSY;
2265
2266 ret = __set_memory_enc_pgtable(addr, numpages, enc);
2267
2268 up_read(&mem_enc_lock);
2269 }
2270
2271 return ret;
2272 }
2273
2274 int set_memory_encrypted(unsigned long addr, int numpages)
2275 {
2276 return __set_memory_enc_dec(addr, numpages, true);
2277 }
2278 EXPORT_SYMBOL_GPL(set_memory_encrypted);
2279
2280 int set_memory_decrypted(unsigned long addr, int numpages)
2281 {
2282 return __set_memory_enc_dec(addr, numpages, false);
2283 }
2284 EXPORT_SYMBOL_GPL(set_memory_decrypted);
2285
2286 int set_pages_uc(struct page *page, int numpages)
2287 {
2288 unsigned long addr = (unsigned long)page_address(page);
2289
2290 return set_memory_uc(addr, numpages);
2291 }
2292 EXPORT_SYMBOL(set_pages_uc);
2293
2294 static int _set_pages_array(struct page **pages, int numpages,
2295 enum page_cache_mode new_type)
2296 {
2297 unsigned long start;
2298 unsigned long end;
2299 enum page_cache_mode set_type;
2300 int i;
2301 int free_idx;
2302 int ret;
2303
2304 for (i = 0; i < numpages; i++) {
2305 if (PageHighMem(pages[i]))
2306 continue;
2307 start = page_to_pfn(pages[i]) << PAGE_SHIFT;
2308 end = start + PAGE_SIZE;
2309 if (memtype_reserve(start, end, new_type, NULL))
2310 goto err_out;
2311 }
2312
2313 /* If WC, set to UC- first and then WC */
2314 set_type = (new_type == _PAGE_CACHE_MODE_WC) ?
2315 _PAGE_CACHE_MODE_UC_MINUS : new_type;
2316
2317 ret = cpa_set_pages_array(pages, numpages,
2318 cachemode2pgprot(set_type));
2319 if (!ret && new_type == _PAGE_CACHE_MODE_WC)
2320 ret = change_page_attr_set_clr(NULL, numpages,
2321 cachemode2pgprot(
2322 _PAGE_CACHE_MODE_WC),
2323 __pgprot(_PAGE_CACHE_MASK),
2324 0, CPA_PAGES_ARRAY, pages);
2325 if (ret)
2326 goto err_out;
2327 return 0; /* Success */
2328 err_out:
2329 free_idx = i;
2330 for (i = 0; i < free_idx; i++) {
2331 if (PageHighMem(pages[i]))
2332 continue;
2333 start = page_to_pfn(pages[i]) << PAGE_SHIFT;
2334 end = start + PAGE_SIZE;
2335 memtype_free(start, end);
2336 }
2337 return -EINVAL;
2338 }
2339
2340 int set_pages_array_uc(struct page **pages, int numpages)
2341 {
2342 return _set_pages_array(pages, numpages, _PAGE_CACHE_MODE_UC_MINUS);
2343 }
2344 EXPORT_SYMBOL(set_pages_array_uc);
2345
2346 int set_pages_array_wc(struct page **pages, int numpages)
2347 {
2348 return _set_pages_array(pages, numpages, _PAGE_CACHE_MODE_WC);
2349 }
2350 EXPORT_SYMBOL(set_pages_array_wc);
2351
2352 int set_pages_wb(struct page *page, int numpages)
2353 {
2354 unsigned long addr = (unsigned long)page_address(page);
2355
2356 return set_memory_wb(addr, numpages);
2357 }
2358 EXPORT_SYMBOL(set_pages_wb);
2359
2360 int set_pages_array_wb(struct page **pages, int numpages)
2361 {
2362 int retval;
2363 unsigned long start;
2364 unsigned long end;
2365 int i;
2366
2367 /* WB cache mode is hard wired to all cache attribute bits being 0 */
2368 retval = cpa_clear_pages_array(pages, numpages,
2369 __pgprot(_PAGE_CACHE_MASK));
2370 if (retval)
2371 return retval;
2372
2373 for (i = 0; i < numpages; i++) {
2374 if (PageHighMem(pages[i]))
2375 continue;
2376 start = page_to_pfn(pages[i]) << PAGE_SHIFT;
2377 end = start + PAGE_SIZE;
2378 memtype_free(start, end);
2379 }
2380
2381 return 0;
2382 }
2383 EXPORT_SYMBOL(set_pages_array_wb);
2384
2385 int set_pages_ro(struct page *page, int numpages)
2386 {
2387 unsigned long addr = (unsigned long)page_address(page);
2388
2389 return set_memory_ro(addr, numpages);
2390 }
2391
2392 int set_pages_rw(struct page *page, int numpages)
2393 {
2394 unsigned long addr = (unsigned long)page_address(page);
2395
2396 return set_memory_rw(addr, numpages);
2397 }
2398
2399 static int __set_pages_p(struct page *page, int numpages)
2400 {
2401 unsigned long tempaddr = (unsigned long) page_address(page);
2402 struct cpa_data cpa = { .vaddr = &tempaddr,
2403 .pgd = NULL,
2404 .numpages = numpages,
2405 .mask_set = __pgprot(_PAGE_PRESENT | _PAGE_RW),
2406 .mask_clr = __pgprot(0),
2407 .flags = CPA_NO_CHECK_ALIAS };
2408
2409 /*
2410 * No alias checking needed for setting present flag. otherwise,
2411 * we may need to break large pages for 64-bit kernel text
2412 * mappings (this adds to complexity if we want to do this from
2413 * atomic context especially). Let's keep it simple!
2414 */
2415 return __change_page_attr_set_clr(&cpa, 1);
2416 }
2417
2418 static int __set_pages_np(struct page *page, int numpages)
2419 {
2420 unsigned long tempaddr = (unsigned long) page_address(page);
2421 struct cpa_data cpa = { .vaddr = &tempaddr,
2422 .pgd = NULL,
2423 .numpages = numpages,
2424 .mask_set = __pgprot(0),
2425 .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW),
2426 .flags = CPA_NO_CHECK_ALIAS };
2427
2428 /*
2429 * No alias checking needed for setting not present flag. otherwise,
2430 * we may need to break large pages for 64-bit kernel text
2431 * mappings (this adds to complexity if we want to do this from
2432 * atomic context especially). Let's keep it simple!
2433 */
2434 return __change_page_attr_set_clr(&cpa, 1);
2435 }
2436
2437 int set_direct_map_invalid_noflush(struct page *page)
2438 {
2439 return __set_pages_np(page, 1);
2440 }
2441
2442 int set_direct_map_default_noflush(struct page *page)
2443 {
2444 return __set_pages_p(page, 1);
2445 }
2446
2447 #ifdef CONFIG_DEBUG_PAGEALLOC
2448 void __kernel_map_pages(struct page *page, int numpages, int enable)
2449 {
2450 if (PageHighMem(page))
2451 return;
2452 if (!enable) {
2453 debug_check_no_locks_freed(page_address(page),
2454 numpages * PAGE_SIZE);
2455 }
2456
2457 /*
2458 * The return value is ignored as the calls cannot fail.
2459 * Large pages for identity mappings are not used at boot time
2460 * and hence no memory allocations during large page split.
2461 */
2462 if (enable)
2463 __set_pages_p(page, numpages);
2464 else
2465 __set_pages_np(page, numpages);
2466
2467 /*
2468 * We should perform an IPI and flush all tlbs,
2469 * but that can deadlock->flush only current cpu.
2470 * Preemption needs to be disabled around __flush_tlb_all() due to
2471 * CR3 reload in __native_flush_tlb().
2472 */
2473 preempt_disable();
2474 __flush_tlb_all();
2475 preempt_enable();
2476
2477 arch_flush_lazy_mmu_mode();
2478 }
2479 #endif /* CONFIG_DEBUG_PAGEALLOC */
2480
2481 bool kernel_page_present(struct page *page)
2482 {
2483 unsigned int level;
2484 pte_t *pte;
2485
2486 if (PageHighMem(page))
2487 return false;
2488
2489 pte = lookup_address((unsigned long)page_address(page), &level);
2490 return (pte_val(*pte) & _PAGE_PRESENT);
2491 }
2492
2493 int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
2494 unsigned numpages, unsigned long page_flags)
2495 {
2496 int retval = -EINVAL;
2497
2498 struct cpa_data cpa = {
2499 .vaddr = &address,
2500 .pfn = pfn,
2501 .pgd = pgd,
2502 .numpages = numpages,
2503 .mask_set = __pgprot(0),
2504 .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)),
2505 .flags = CPA_NO_CHECK_ALIAS,
2506 };
2507
2508 WARN_ONCE(num_online_cpus() > 1, "Don't call after initializing SMP");
2509
2510 if (!(__supported_pte_mask & _PAGE_NX))
2511 goto out;
2512
2513 if (!(page_flags & _PAGE_ENC))
2514 cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);
2515
2516 cpa.mask_set = __pgprot(_PAGE_PRESENT | page_flags);
2517
2518 retval = __change_page_attr_set_clr(&cpa, 1);
2519 __flush_tlb_all();
2520
2521 out:
2522 return retval;
2523 }
2524
2525 /*
2526 * __flush_tlb_all() flushes mappings only on current CPU and hence this
2527 * function shouldn't be used in an SMP environment. Presently, it's used only
2528 * during boot (way before smp_init()) by EFI subsystem and hence is ok.
2529 */
2530 int __init kernel_unmap_pages_in_pgd(pgd_t *pgd, unsigned long address,
2531 unsigned long numpages)
2532 {
2533 int retval;
2534
2535 /*
2536 * The typical sequence for unmapping is to find a pte through
2537 * lookup_address_in_pgd() (ideally, it should never return NULL because
2538 * the address is already mapped) and change its protections. As pfn is
2539 * the *target* of a mapping, it's not useful while unmapping.
2540 */
2541 struct cpa_data cpa = {
2542 .vaddr = &address,
2543 .pfn = 0,
2544 .pgd = pgd,
2545 .numpages = numpages,
2546 .mask_set = __pgprot(0),
2547 .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW),
2548 .flags = CPA_NO_CHECK_ALIAS,
2549 };
2550
2551 WARN_ONCE(num_online_cpus() > 1, "Don't call after initializing SMP");
2552
2553 retval = __change_page_attr_set_clr(&cpa, 1);
2554 __flush_tlb_all();
2555
2556 return retval;
2557 }
2558
2559 /*
2560 * The testcases use internal knowledge of the implementation that shouldn't
2561 * be exposed to the rest of the kernel. Include these directly here.
2562 */
2563 #ifdef CONFIG_CPA_DEBUG
2564 #include "cpa-test.c"
2565 #endif
2566
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.