xref: /linux/arch/x86/kernel/process.c (revision cea0f76a483d1270ac6f6513964e3e75193dda48)
1 // SPDX-License-Identifier: GPL-2.0
2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
3 
4 #include <linux/errno.h>
5 #include <linux/kernel.h>
6 #include <linux/mm.h>
7 #include <linux/smp.h>
8 #include <linux/prctl.h>
9 #include <linux/slab.h>
10 #include <linux/sched.h>
11 #include <linux/sched/idle.h>
12 #include <linux/sched/debug.h>
13 #include <linux/sched/task.h>
14 #include <linux/sched/task_stack.h>
15 #include <linux/init.h>
16 #include <linux/export.h>
17 #include <linux/pm.h>
18 #include <linux/tick.h>
19 #include <linux/random.h>
20 #include <linux/user-return-notifier.h>
21 #include <linux/dmi.h>
22 #include <linux/utsname.h>
23 #include <linux/stackprotector.h>
24 #include <linux/cpuidle.h>
25 #include <linux/acpi.h>
26 #include <linux/elf-randomize.h>
27 #include <trace/events/power.h>
28 #include <linux/hw_breakpoint.h>
29 #include <asm/cpu.h>
30 #include <asm/apic.h>
31 #include <linux/uaccess.h>
32 #include <asm/mwait.h>
33 #include <asm/fpu/internal.h>
34 #include <asm/debugreg.h>
35 #include <asm/nmi.h>
36 #include <asm/tlbflush.h>
37 #include <asm/mce.h>
38 #include <asm/vm86.h>
39 #include <asm/switch_to.h>
40 #include <asm/desc.h>
41 #include <asm/prctl.h>
42 #include <asm/spec-ctrl.h>
43 #include <asm/io_bitmap.h>
44 #include <asm/proto.h>
45 
46 #include "process.h"
47 
48 /*
49  * per-CPU TSS segments. Threads are completely 'soft' on Linux,
50  * no more per-task TSS's. The TSS size is kept cacheline-aligned
51  * so they are allowed to end up in the .data..cacheline_aligned
52  * section. Since TSS's are completely CPU-local, we want them
53  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
54  */
55 __visible DEFINE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss_rw) = {
56 	.x86_tss = {
57 		/*
58 		 * .sp0 is only used when entering ring 0 from a lower
59 		 * privilege level.  Since the init task never runs anything
60 		 * but ring 0 code, there is no need for a valid value here.
61 		 * Poison it.
62 		 */
63 		.sp0 = (1UL << (BITS_PER_LONG-1)) + 1,
64 
65 		/*
66 		 * .sp1 is cpu_current_top_of_stack.  The init task never
67 		 * runs user code, but cpu_current_top_of_stack should still
68 		 * be well defined before the first context switch.
69 		 */
70 		.sp1 = TOP_OF_INIT_STACK,
71 
72 #ifdef CONFIG_X86_32
73 		.ss0 = __KERNEL_DS,
74 		.ss1 = __KERNEL_CS,
75 #endif
76 		.io_bitmap_base	= IO_BITMAP_OFFSET_INVALID,
77 	 },
78 };
79 EXPORT_PER_CPU_SYMBOL(cpu_tss_rw);
80 
81 DEFINE_PER_CPU(bool, __tss_limit_invalid);
82 EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);
83 
84 /*
85  * this gets called so that we can store lazy state into memory and copy the
86  * current task into the new thread.
87  */
88 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
89 {
90 	memcpy(dst, src, arch_task_struct_size);
91 #ifdef CONFIG_VM86
92 	dst->thread.vm86 = NULL;
93 #endif
94 
95 	return fpu__copy(dst, src);
96 }
97 
98 /*
99  * Free thread data structures etc..
100  */
101 void exit_thread(struct task_struct *tsk)
102 {
103 	struct thread_struct *t = &tsk->thread;
104 	struct fpu *fpu = &t->fpu;
105 
106 	if (test_thread_flag(TIF_IO_BITMAP))
107 		io_bitmap_exit(tsk);
108 
109 	free_vm86(t);
110 
111 	fpu__drop(fpu);
112 }
113 
114 static int set_new_tls(struct task_struct *p, unsigned long tls)
115 {
116 	struct user_desc __user *utls = (struct user_desc __user *)tls;
117 
118 	if (in_ia32_syscall())
119 		return do_set_thread_area(p, -1, utls, 0);
120 	else
121 		return do_set_thread_area_64(p, ARCH_SET_FS, tls);
122 }
123 
124 int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
125 		    unsigned long arg, struct task_struct *p, unsigned long tls)
126 {
127 	struct inactive_task_frame *frame;
128 	struct fork_frame *fork_frame;
129 	struct pt_regs *childregs;
130 	int ret = 0;
131 
132 	childregs = task_pt_regs(p);
133 	fork_frame = container_of(childregs, struct fork_frame, regs);
134 	frame = &fork_frame->frame;
135 
136 	frame->bp = 0;
137 	frame->ret_addr = (unsigned long) ret_from_fork;
138 	p->thread.sp = (unsigned long) fork_frame;
139 	p->thread.io_bitmap = NULL;
140 	memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
141 
142 #ifdef CONFIG_X86_64
143 	savesegment(gs, p->thread.gsindex);
144 	p->thread.gsbase = p->thread.gsindex ? 0 : current->thread.gsbase;
145 	savesegment(fs, p->thread.fsindex);
146 	p->thread.fsbase = p->thread.fsindex ? 0 : current->thread.fsbase;
147 	savesegment(es, p->thread.es);
148 	savesegment(ds, p->thread.ds);
149 #else
150 	p->thread.sp0 = (unsigned long) (childregs + 1);
151 	/*
152 	 * Clear all status flags including IF and set fixed bit. 64bit
153 	 * does not have this initialization as the frame does not contain
154 	 * flags. The flags consistency (especially vs. AC) is there
155 	 * ensured via objtool, which lacks 32bit support.
156 	 */
157 	frame->flags = X86_EFLAGS_FIXED;
158 #endif
159 
160 	/* Kernel thread ? */
161 	if (unlikely(p->flags & PF_KTHREAD)) {
162 		memset(childregs, 0, sizeof(struct pt_regs));
163 		kthread_frame_init(frame, sp, arg);
164 		return 0;
165 	}
166 
167 	frame->bx = 0;
168 	*childregs = *current_pt_regs();
169 	childregs->ax = 0;
170 	if (sp)
171 		childregs->sp = sp;
172 
173 #ifdef CONFIG_X86_32
174 	task_user_gs(p) = get_user_gs(current_pt_regs());
175 #endif
176 
177 	/* Set a new TLS for the child thread? */
178 	if (clone_flags & CLONE_SETTLS)
179 		ret = set_new_tls(p, tls);
180 
181 	if (!ret && unlikely(test_tsk_thread_flag(current, TIF_IO_BITMAP)))
182 		io_bitmap_share(p);
183 
184 	return ret;
185 }
186 
187 void flush_thread(void)
188 {
189 	struct task_struct *tsk = current;
190 
191 	flush_ptrace_hw_breakpoint(tsk);
192 	memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
193 
194 	fpu__clear_all(&tsk->thread.fpu);
195 }
196 
197 void disable_TSC(void)
198 {
199 	preempt_disable();
200 	if (!test_and_set_thread_flag(TIF_NOTSC))
201 		/*
202 		 * Must flip the CPU state synchronously with
203 		 * TIF_NOTSC in the current running context.
204 		 */
205 		cr4_set_bits(X86_CR4_TSD);
206 	preempt_enable();
207 }
208 
209 static void enable_TSC(void)
210 {
211 	preempt_disable();
212 	if (test_and_clear_thread_flag(TIF_NOTSC))
213 		/*
214 		 * Must flip the CPU state synchronously with
215 		 * TIF_NOTSC in the current running context.
216 		 */
217 		cr4_clear_bits(X86_CR4_TSD);
218 	preempt_enable();
219 }
220 
221 int get_tsc_mode(unsigned long adr)
222 {
223 	unsigned int val;
224 
225 	if (test_thread_flag(TIF_NOTSC))
226 		val = PR_TSC_SIGSEGV;
227 	else
228 		val = PR_TSC_ENABLE;
229 
230 	return put_user(val, (unsigned int __user *)adr);
231 }
232 
233 int set_tsc_mode(unsigned int val)
234 {
235 	if (val == PR_TSC_SIGSEGV)
236 		disable_TSC();
237 	else if (val == PR_TSC_ENABLE)
238 		enable_TSC();
239 	else
240 		return -EINVAL;
241 
242 	return 0;
243 }
244 
245 DEFINE_PER_CPU(u64, msr_misc_features_shadow);
246 
247 static void set_cpuid_faulting(bool on)
248 {
249 	u64 msrval;
250 
251 	msrval = this_cpu_read(msr_misc_features_shadow);
252 	msrval &= ~MSR_MISC_FEATURES_ENABLES_CPUID_FAULT;
253 	msrval |= (on << MSR_MISC_FEATURES_ENABLES_CPUID_FAULT_BIT);
254 	this_cpu_write(msr_misc_features_shadow, msrval);
255 	wrmsrl(MSR_MISC_FEATURES_ENABLES, msrval);
256 }
257 
258 static void disable_cpuid(void)
259 {
260 	preempt_disable();
261 	if (!test_and_set_thread_flag(TIF_NOCPUID)) {
262 		/*
263 		 * Must flip the CPU state synchronously with
264 		 * TIF_NOCPUID in the current running context.
265 		 */
266 		set_cpuid_faulting(true);
267 	}
268 	preempt_enable();
269 }
270 
271 static void enable_cpuid(void)
272 {
273 	preempt_disable();
274 	if (test_and_clear_thread_flag(TIF_NOCPUID)) {
275 		/*
276 		 * Must flip the CPU state synchronously with
277 		 * TIF_NOCPUID in the current running context.
278 		 */
279 		set_cpuid_faulting(false);
280 	}
281 	preempt_enable();
282 }
283 
284 static int get_cpuid_mode(void)
285 {
286 	return !test_thread_flag(TIF_NOCPUID);
287 }
288 
289 static int set_cpuid_mode(struct task_struct *task, unsigned long cpuid_enabled)
290 {
291 	if (!boot_cpu_has(X86_FEATURE_CPUID_FAULT))
292 		return -ENODEV;
293 
294 	if (cpuid_enabled)
295 		enable_cpuid();
296 	else
297 		disable_cpuid();
298 
299 	return 0;
300 }
301 
302 /*
303  * Called immediately after a successful exec.
304  */
305 void arch_setup_new_exec(void)
306 {
307 	/* If cpuid was previously disabled for this task, re-enable it. */
308 	if (test_thread_flag(TIF_NOCPUID))
309 		enable_cpuid();
310 
311 	/*
312 	 * Don't inherit TIF_SSBD across exec boundary when
313 	 * PR_SPEC_DISABLE_NOEXEC is used.
314 	 */
315 	if (test_thread_flag(TIF_SSBD) &&
316 	    task_spec_ssb_noexec(current)) {
317 		clear_thread_flag(TIF_SSBD);
318 		task_clear_spec_ssb_disable(current);
319 		task_clear_spec_ssb_noexec(current);
320 		speculation_ctrl_update(task_thread_info(current)->flags);
321 	}
322 }
323 
324 #ifdef CONFIG_X86_IOPL_IOPERM
325 static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
326 {
327 	/*
328 	 * Invalidate the I/O bitmap by moving io_bitmap_base outside the
329 	 * TSS limit so any subsequent I/O access from user space will
330 	 * trigger a #GP.
331 	 *
332 	 * This is correct even when VMEXIT rewrites the TSS limit
333 	 * to 0x67 as the only requirement is that the base points
334 	 * outside the limit.
335 	 */
336 	tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
337 }
338 
339 static inline void switch_to_bitmap(unsigned long tifp)
340 {
341 	/*
342 	 * Invalidate I/O bitmap if the previous task used it. This prevents
343 	 * any possible leakage of an active I/O bitmap.
344 	 *
345 	 * If the next task has an I/O bitmap it will handle it on exit to
346 	 * user mode.
347 	 */
348 	if (tifp & _TIF_IO_BITMAP)
349 		tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
350 }
351 
352 static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
353 {
354 	/*
355 	 * Copy at least the byte range of the incoming tasks bitmap which
356 	 * covers the permitted I/O ports.
357 	 *
358 	 * If the previous task which used an I/O bitmap had more bits
359 	 * permitted, then the copy needs to cover those as well so they
360 	 * get turned off.
361 	 */
362 	memcpy(tss->io_bitmap.bitmap, iobm->bitmap,
363 	       max(tss->io_bitmap.prev_max, iobm->max));
364 
365 	/*
366 	 * Store the new max and the sequence number of this bitmap
367 	 * and a pointer to the bitmap itself.
368 	 */
369 	tss->io_bitmap.prev_max = iobm->max;
370 	tss->io_bitmap.prev_sequence = iobm->sequence;
371 }
372 
373 /**
374  * tss_update_io_bitmap - Update I/O bitmap before exiting to usermode
375  */
376 void native_tss_update_io_bitmap(void)
377 {
378 	struct tss_struct *tss = this_cpu_ptr(&cpu_tss_rw);
379 	struct thread_struct *t = &current->thread;
380 	u16 *base = &tss->x86_tss.io_bitmap_base;
381 
382 	if (!test_thread_flag(TIF_IO_BITMAP)) {
383 		tss_invalidate_io_bitmap(tss);
384 		return;
385 	}
386 
387 	if (IS_ENABLED(CONFIG_X86_IOPL_IOPERM) && t->iopl_emul == 3) {
388 		*base = IO_BITMAP_OFFSET_VALID_ALL;
389 	} else {
390 		struct io_bitmap *iobm = t->io_bitmap;
391 
392 		/*
393 		 * Only copy bitmap data when the sequence number differs. The
394 		 * update time is accounted to the incoming task.
395 		 */
396 		if (tss->io_bitmap.prev_sequence != iobm->sequence)
397 			tss_copy_io_bitmap(tss, iobm);
398 
399 		/* Enable the bitmap */
400 		*base = IO_BITMAP_OFFSET_VALID_MAP;
401 	}
402 
403 	/*
404 	 * Make sure that the TSS limit is covering the IO bitmap. It might have
405 	 * been cut down by a VMEXIT to 0x67 which would cause a subsequent I/O
406 	 * access from user space to trigger a #GP because tbe bitmap is outside
407 	 * the TSS limit.
408 	 */
409 	refresh_tss_limit();
410 }
411 #else /* CONFIG_X86_IOPL_IOPERM */
412 static inline void switch_to_bitmap(unsigned long tifp) { }
413 #endif
414 
415 #ifdef CONFIG_SMP
416 
417 struct ssb_state {
418 	struct ssb_state	*shared_state;
419 	raw_spinlock_t		lock;
420 	unsigned int		disable_state;
421 	unsigned long		local_state;
422 };
423 
424 #define LSTATE_SSB	0
425 
426 static DEFINE_PER_CPU(struct ssb_state, ssb_state);
427 
428 void speculative_store_bypass_ht_init(void)
429 {
430 	struct ssb_state *st = this_cpu_ptr(&ssb_state);
431 	unsigned int this_cpu = smp_processor_id();
432 	unsigned int cpu;
433 
434 	st->local_state = 0;
435 
436 	/*
437 	 * Shared state setup happens once on the first bringup
438 	 * of the CPU. It's not destroyed on CPU hotunplug.
439 	 */
440 	if (st->shared_state)
441 		return;
442 
443 	raw_spin_lock_init(&st->lock);
444 
445 	/*
446 	 * Go over HT siblings and check whether one of them has set up the
447 	 * shared state pointer already.
448 	 */
449 	for_each_cpu(cpu, topology_sibling_cpumask(this_cpu)) {
450 		if (cpu == this_cpu)
451 			continue;
452 
453 		if (!per_cpu(ssb_state, cpu).shared_state)
454 			continue;
455 
456 		/* Link it to the state of the sibling: */
457 		st->shared_state = per_cpu(ssb_state, cpu).shared_state;
458 		return;
459 	}
460 
461 	/*
462 	 * First HT sibling to come up on the core.  Link shared state of
463 	 * the first HT sibling to itself. The siblings on the same core
464 	 * which come up later will see the shared state pointer and link
465 	 * themself to the state of this CPU.
466 	 */
467 	st->shared_state = st;
468 }
469 
470 /*
471  * Logic is: First HT sibling enables SSBD for both siblings in the core
472  * and last sibling to disable it, disables it for the whole core. This how
473  * MSR_SPEC_CTRL works in "hardware":
474  *
475  *  CORE_SPEC_CTRL = THREAD0_SPEC_CTRL | THREAD1_SPEC_CTRL
476  */
477 static __always_inline void amd_set_core_ssb_state(unsigned long tifn)
478 {
479 	struct ssb_state *st = this_cpu_ptr(&ssb_state);
480 	u64 msr = x86_amd_ls_cfg_base;
481 
482 	if (!static_cpu_has(X86_FEATURE_ZEN)) {
483 		msr |= ssbd_tif_to_amd_ls_cfg(tifn);
484 		wrmsrl(MSR_AMD64_LS_CFG, msr);
485 		return;
486 	}
487 
488 	if (tifn & _TIF_SSBD) {
489 		/*
490 		 * Since this can race with prctl(), block reentry on the
491 		 * same CPU.
492 		 */
493 		if (__test_and_set_bit(LSTATE_SSB, &st->local_state))
494 			return;
495 
496 		msr |= x86_amd_ls_cfg_ssbd_mask;
497 
498 		raw_spin_lock(&st->shared_state->lock);
499 		/* First sibling enables SSBD: */
500 		if (!st->shared_state->disable_state)
501 			wrmsrl(MSR_AMD64_LS_CFG, msr);
502 		st->shared_state->disable_state++;
503 		raw_spin_unlock(&st->shared_state->lock);
504 	} else {
505 		if (!__test_and_clear_bit(LSTATE_SSB, &st->local_state))
506 			return;
507 
508 		raw_spin_lock(&st->shared_state->lock);
509 		st->shared_state->disable_state--;
510 		if (!st->shared_state->disable_state)
511 			wrmsrl(MSR_AMD64_LS_CFG, msr);
512 		raw_spin_unlock(&st->shared_state->lock);
513 	}
514 }
515 #else
516 static __always_inline void amd_set_core_ssb_state(unsigned long tifn)
517 {
518 	u64 msr = x86_amd_ls_cfg_base | ssbd_tif_to_amd_ls_cfg(tifn);
519 
520 	wrmsrl(MSR_AMD64_LS_CFG, msr);
521 }
522 #endif
523 
524 static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
525 {
526 	/*
527 	 * SSBD has the same definition in SPEC_CTRL and VIRT_SPEC_CTRL,
528 	 * so ssbd_tif_to_spec_ctrl() just works.
529 	 */
530 	wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn));
531 }
532 
533 /*
534  * Update the MSRs managing speculation control, during context switch.
535  *
536  * tifp: Previous task's thread flags
537  * tifn: Next task's thread flags
538  */
539 static __always_inline void __speculation_ctrl_update(unsigned long tifp,
540 						      unsigned long tifn)
541 {
542 	unsigned long tif_diff = tifp ^ tifn;
543 	u64 msr = x86_spec_ctrl_base;
544 	bool updmsr = false;
545 
546 	lockdep_assert_irqs_disabled();
547 
548 	/* Handle change of TIF_SSBD depending on the mitigation method. */
549 	if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
550 		if (tif_diff & _TIF_SSBD)
551 			amd_set_ssb_virt_state(tifn);
552 	} else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
553 		if (tif_diff & _TIF_SSBD)
554 			amd_set_core_ssb_state(tifn);
555 	} else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
556 		   static_cpu_has(X86_FEATURE_AMD_SSBD)) {
557 		updmsr |= !!(tif_diff & _TIF_SSBD);
558 		msr |= ssbd_tif_to_spec_ctrl(tifn);
559 	}
560 
561 	/* Only evaluate TIF_SPEC_IB if conditional STIBP is enabled. */
562 	if (IS_ENABLED(CONFIG_SMP) &&
563 	    static_branch_unlikely(&switch_to_cond_stibp)) {
564 		updmsr |= !!(tif_diff & _TIF_SPEC_IB);
565 		msr |= stibp_tif_to_spec_ctrl(tifn);
566 	}
567 
568 	if (updmsr)
569 		wrmsrl(MSR_IA32_SPEC_CTRL, msr);
570 }
571 
572 static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
573 {
574 	if (test_and_clear_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE)) {
575 		if (task_spec_ssb_disable(tsk))
576 			set_tsk_thread_flag(tsk, TIF_SSBD);
577 		else
578 			clear_tsk_thread_flag(tsk, TIF_SSBD);
579 
580 		if (task_spec_ib_disable(tsk))
581 			set_tsk_thread_flag(tsk, TIF_SPEC_IB);
582 		else
583 			clear_tsk_thread_flag(tsk, TIF_SPEC_IB);
584 	}
585 	/* Return the updated threadinfo flags*/
586 	return task_thread_info(tsk)->flags;
587 }
588 
589 void speculation_ctrl_update(unsigned long tif)
590 {
591 	unsigned long flags;
592 
593 	/* Forced update. Make sure all relevant TIF flags are different */
594 	local_irq_save(flags);
595 	__speculation_ctrl_update(~tif, tif);
596 	local_irq_restore(flags);
597 }
598 
599 /* Called from seccomp/prctl update */
600 void speculation_ctrl_update_current(void)
601 {
602 	preempt_disable();
603 	speculation_ctrl_update(speculation_ctrl_update_tif(current));
604 	preempt_enable();
605 }
606 
607 static inline void cr4_toggle_bits_irqsoff(unsigned long mask)
608 {
609 	unsigned long newval, cr4 = this_cpu_read(cpu_tlbstate.cr4);
610 
611 	newval = cr4 ^ mask;
612 	if (newval != cr4) {
613 		this_cpu_write(cpu_tlbstate.cr4, newval);
614 		__write_cr4(newval);
615 	}
616 }
617 
618 void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
619 {
620 	unsigned long tifp, tifn;
621 
622 	tifn = READ_ONCE(task_thread_info(next_p)->flags);
623 	tifp = READ_ONCE(task_thread_info(prev_p)->flags);
624 
625 	switch_to_bitmap(tifp);
626 
627 	propagate_user_return_notify(prev_p, next_p);
628 
629 	if ((tifp & _TIF_BLOCKSTEP || tifn & _TIF_BLOCKSTEP) &&
630 	    arch_has_block_step()) {
631 		unsigned long debugctl, msk;
632 
633 		rdmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
634 		debugctl &= ~DEBUGCTLMSR_BTF;
635 		msk = tifn & _TIF_BLOCKSTEP;
636 		debugctl |= (msk >> TIF_BLOCKSTEP) << DEBUGCTLMSR_BTF_SHIFT;
637 		wrmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
638 	}
639 
640 	if ((tifp ^ tifn) & _TIF_NOTSC)
641 		cr4_toggle_bits_irqsoff(X86_CR4_TSD);
642 
643 	if ((tifp ^ tifn) & _TIF_NOCPUID)
644 		set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
645 
646 	if (likely(!((tifp | tifn) & _TIF_SPEC_FORCE_UPDATE))) {
647 		__speculation_ctrl_update(tifp, tifn);
648 	} else {
649 		speculation_ctrl_update_tif(prev_p);
650 		tifn = speculation_ctrl_update_tif(next_p);
651 
652 		/* Enforce MSR update to ensure consistent state */
653 		__speculation_ctrl_update(~tifn, tifn);
654 	}
655 
656 	if ((tifp ^ tifn) & _TIF_SLD)
657 		switch_to_sld(tifn);
658 }
659 
660 /*
661  * Idle related variables and functions
662  */
663 unsigned long boot_option_idle_override = IDLE_NO_OVERRIDE;
664 EXPORT_SYMBOL(boot_option_idle_override);
665 
666 static void (*x86_idle)(void);
667 
668 #ifndef CONFIG_SMP
669 static inline void play_dead(void)
670 {
671 	BUG();
672 }
673 #endif
674 
675 void arch_cpu_idle_enter(void)
676 {
677 	tsc_verify_tsc_adjust(false);
678 	local_touch_nmi();
679 }
680 
681 void arch_cpu_idle_dead(void)
682 {
683 	play_dead();
684 }
685 
686 /*
687  * Called from the generic idle code.
688  */
689 void arch_cpu_idle(void)
690 {
691 	x86_idle();
692 }
693 
694 /*
695  * We use this if we don't have any better idle routine..
696  */
697 void __cpuidle default_idle(void)
698 {
699 	trace_cpu_idle_rcuidle(1, smp_processor_id());
700 	safe_halt();
701 	trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
702 }
703 #if defined(CONFIG_APM_MODULE) || defined(CONFIG_HALTPOLL_CPUIDLE_MODULE)
704 EXPORT_SYMBOL(default_idle);
705 #endif
706 
707 #ifdef CONFIG_XEN
708 bool xen_set_default_idle(void)
709 {
710 	bool ret = !!x86_idle;
711 
712 	x86_idle = default_idle;
713 
714 	return ret;
715 }
716 #endif
717 
718 void stop_this_cpu(void *dummy)
719 {
720 	local_irq_disable();
721 	/*
722 	 * Remove this CPU:
723 	 */
724 	set_cpu_online(smp_processor_id(), false);
725 	disable_local_APIC();
726 	mcheck_cpu_clear(this_cpu_ptr(&cpu_info));
727 
728 	/*
729 	 * Use wbinvd on processors that support SME. This provides support
730 	 * for performing a successful kexec when going from SME inactive
731 	 * to SME active (or vice-versa). The cache must be cleared so that
732 	 * if there are entries with the same physical address, both with and
733 	 * without the encryption bit, they don't race each other when flushed
734 	 * and potentially end up with the wrong entry being committed to
735 	 * memory.
736 	 */
737 	if (boot_cpu_has(X86_FEATURE_SME))
738 		native_wbinvd();
739 	for (;;) {
740 		/*
741 		 * Use native_halt() so that memory contents don't change
742 		 * (stack usage and variables) after possibly issuing the
743 		 * native_wbinvd() above.
744 		 */
745 		native_halt();
746 	}
747 }
748 
749 /*
750  * AMD Erratum 400 aware idle routine. We handle it the same way as C3 power
751  * states (local apic timer and TSC stop).
752  */
753 static void amd_e400_idle(void)
754 {
755 	/*
756 	 * We cannot use static_cpu_has_bug() here because X86_BUG_AMD_APIC_C1E
757 	 * gets set after static_cpu_has() places have been converted via
758 	 * alternatives.
759 	 */
760 	if (!boot_cpu_has_bug(X86_BUG_AMD_APIC_C1E)) {
761 		default_idle();
762 		return;
763 	}
764 
765 	tick_broadcast_enter();
766 
767 	default_idle();
768 
769 	/*
770 	 * The switch back from broadcast mode needs to be called with
771 	 * interrupts disabled.
772 	 */
773 	local_irq_disable();
774 	tick_broadcast_exit();
775 	local_irq_enable();
776 }
777 
778 /*
779  * Intel Core2 and older machines prefer MWAIT over HALT for C1.
780  * We can't rely on cpuidle installing MWAIT, because it will not load
781  * on systems that support only C1 -- so the boot default must be MWAIT.
782  *
783  * Some AMD machines are the opposite, they depend on using HALT.
784  *
785  * So for default C1, which is used during boot until cpuidle loads,
786  * use MWAIT-C1 on Intel HW that has it, else use HALT.
787  */
788 static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c)
789 {
790 	if (c->x86_vendor != X86_VENDOR_INTEL)
791 		return 0;
792 
793 	if (!cpu_has(c, X86_FEATURE_MWAIT) || boot_cpu_has_bug(X86_BUG_MONITOR))
794 		return 0;
795 
796 	return 1;
797 }
798 
799 /*
800  * MONITOR/MWAIT with no hints, used for default C1 state. This invokes MWAIT
801  * with interrupts enabled and no flags, which is backwards compatible with the
802  * original MWAIT implementation.
803  */
804 static __cpuidle void mwait_idle(void)
805 {
806 	if (!current_set_polling_and_test()) {
807 		trace_cpu_idle_rcuidle(1, smp_processor_id());
808 		if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) {
809 			mb(); /* quirk */
810 			clflush((void *)&current_thread_info()->flags);
811 			mb(); /* quirk */
812 		}
813 
814 		__monitor((void *)&current_thread_info()->flags, 0, 0);
815 		if (!need_resched())
816 			__sti_mwait(0, 0);
817 		else
818 			local_irq_enable();
819 		trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
820 	} else {
821 		local_irq_enable();
822 	}
823 	__current_clr_polling();
824 }
825 
826 void select_idle_routine(const struct cpuinfo_x86 *c)
827 {
828 #ifdef CONFIG_SMP
829 	if (boot_option_idle_override == IDLE_POLL && smp_num_siblings > 1)
830 		pr_warn_once("WARNING: polling idle and HT enabled, performance may degrade\n");
831 #endif
832 	if (x86_idle || boot_option_idle_override == IDLE_POLL)
833 		return;
834 
835 	if (boot_cpu_has_bug(X86_BUG_AMD_E400)) {
836 		pr_info("using AMD E400 aware idle routine\n");
837 		x86_idle = amd_e400_idle;
838 	} else if (prefer_mwait_c1_over_halt(c)) {
839 		pr_info("using mwait in idle threads\n");
840 		x86_idle = mwait_idle;
841 	} else
842 		x86_idle = default_idle;
843 }
844 
845 void amd_e400_c1e_apic_setup(void)
846 {
847 	if (boot_cpu_has_bug(X86_BUG_AMD_APIC_C1E)) {
848 		pr_info("Switch to broadcast mode on CPU%d\n", smp_processor_id());
849 		local_irq_disable();
850 		tick_broadcast_force();
851 		local_irq_enable();
852 	}
853 }
854 
855 void __init arch_post_acpi_subsys_init(void)
856 {
857 	u32 lo, hi;
858 
859 	if (!boot_cpu_has_bug(X86_BUG_AMD_E400))
860 		return;
861 
862 	/*
863 	 * AMD E400 detection needs to happen after ACPI has been enabled. If
864 	 * the machine is affected K8_INTP_C1E_ACTIVE_MASK bits are set in
865 	 * MSR_K8_INT_PENDING_MSG.
866 	 */
867 	rdmsr(MSR_K8_INT_PENDING_MSG, lo, hi);
868 	if (!(lo & K8_INTP_C1E_ACTIVE_MASK))
869 		return;
870 
871 	boot_cpu_set_bug(X86_BUG_AMD_APIC_C1E);
872 
873 	if (!boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
874 		mark_tsc_unstable("TSC halt in AMD C1E");
875 	pr_info("System has AMD C1E enabled\n");
876 }
877 
878 static int __init idle_setup(char *str)
879 {
880 	if (!str)
881 		return -EINVAL;
882 
883 	if (!strcmp(str, "poll")) {
884 		pr_info("using polling idle threads\n");
885 		boot_option_idle_override = IDLE_POLL;
886 		cpu_idle_poll_ctrl(true);
887 	} else if (!strcmp(str, "halt")) {
888 		/*
889 		 * When the boot option of idle=halt is added, halt is
890 		 * forced to be used for CPU idle. In such case CPU C2/C3
891 		 * won't be used again.
892 		 * To continue to load the CPU idle driver, don't touch
893 		 * the boot_option_idle_override.
894 		 */
895 		x86_idle = default_idle;
896 		boot_option_idle_override = IDLE_HALT;
897 	} else if (!strcmp(str, "nomwait")) {
898 		/*
899 		 * If the boot option of "idle=nomwait" is added,
900 		 * it means that mwait will be disabled for CPU C2/C3
901 		 * states. In such case it won't touch the variable
902 		 * of boot_option_idle_override.
903 		 */
904 		boot_option_idle_override = IDLE_NOMWAIT;
905 	} else
906 		return -1;
907 
908 	return 0;
909 }
910 early_param("idle", idle_setup);
911 
912 unsigned long arch_align_stack(unsigned long sp)
913 {
914 	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
915 		sp -= get_random_int() % 8192;
916 	return sp & ~0xf;
917 }
918 
919 unsigned long arch_randomize_brk(struct mm_struct *mm)
920 {
921 	return randomize_page(mm->brk, 0x02000000);
922 }
923 
924 /*
925  * Called from fs/proc with a reference on @p to find the function
926  * which called into schedule(). This needs to be done carefully
927  * because the task might wake up and we might look at a stack
928  * changing under us.
929  */
930 unsigned long get_wchan(struct task_struct *p)
931 {
932 	unsigned long start, bottom, top, sp, fp, ip, ret = 0;
933 	int count = 0;
934 
935 	if (p == current || p->state == TASK_RUNNING)
936 		return 0;
937 
938 	if (!try_get_task_stack(p))
939 		return 0;
940 
941 	start = (unsigned long)task_stack_page(p);
942 	if (!start)
943 		goto out;
944 
945 	/*
946 	 * Layout of the stack page:
947 	 *
948 	 * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
949 	 * PADDING
950 	 * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
951 	 * stack
952 	 * ----------- bottom = start
953 	 *
954 	 * The tasks stack pointer points at the location where the
955 	 * framepointer is stored. The data on the stack is:
956 	 * ... IP FP ... IP FP
957 	 *
958 	 * We need to read FP and IP, so we need to adjust the upper
959 	 * bound by another unsigned long.
960 	 */
961 	top = start + THREAD_SIZE - TOP_OF_KERNEL_STACK_PADDING;
962 	top -= 2 * sizeof(unsigned long);
963 	bottom = start;
964 
965 	sp = READ_ONCE(p->thread.sp);
966 	if (sp < bottom || sp > top)
967 		goto out;
968 
969 	fp = READ_ONCE_NOCHECK(((struct inactive_task_frame *)sp)->bp);
970 	do {
971 		if (fp < bottom || fp > top)
972 			goto out;
973 		ip = READ_ONCE_NOCHECK(*(unsigned long *)(fp + sizeof(unsigned long)));
974 		if (!in_sched_functions(ip)) {
975 			ret = ip;
976 			goto out;
977 		}
978 		fp = READ_ONCE_NOCHECK(*(unsigned long *)fp);
979 	} while (count++ < 16 && p->state != TASK_RUNNING);
980 
981 out:
982 	put_task_stack(p);
983 	return ret;
984 }
985 
986 long do_arch_prctl_common(struct task_struct *task, int option,
987 			  unsigned long cpuid_enabled)
988 {
989 	switch (option) {
990 	case ARCH_GET_CPUID:
991 		return get_cpuid_mode();
992 	case ARCH_SET_CPUID:
993 		return set_cpuid_mode(task, cpuid_enabled);
994 	}
995 
996 	return -EINVAL;
997 }
998