Commit ec225f8c authored by Yosry Ahmed's avatar Yosry Ahmed Committed by Dave Hansen
Browse files

x86/mm: Fix LAM inconsistency during context switch 



LAM can only be enabled when a process is single-threaded.  But _kernel_
threads can temporarily use a single-threaded process's mm.  That means
that a context-switching kernel thread can race and observe the mm's LAM
metadata (mm->context.lam_cr3_mask) change.

The context switch code does two logical things with that metadata:
populate CR3 and populate 'cpu_tlbstate.lam'.  If it hits this race,
'cpu_tlbstate.lam' and CR3 can end up out of sync.

This de-synchronization is currently harmless.  But it is confusing and
might lead to warnings or real bugs.

Update set_tlbstate_lam_mode() to take in the LAM mask and untag mask
instead of an mm_struct pointer, and while we are at it, rename it to
cpu_tlbstate_update_lam(). This should also make it clearer that we are
updating cpu_tlbstate. In switch_mm_irqs_off(), read the LAM mask once
and use it for both the cpu_tlbstate update and the CR3 update.

Signed-off-by: default avatarYosry Ahmed <yosryahmed@google.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Link: https://lore.kernel.org/all/20240702132139.3332013-3-yosryahmed%40google.com
parent 3b299b99

arch/x86/include/asm/mmu_context.h

+7 −1
Original line number Diff line number Diff line
@@ -88,7 +88,13 @@ static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next) 
#ifdef CONFIG_ADDRESS_MASKING

static inline unsigned long mm_lam_cr3_mask(struct mm_struct *mm)

{

	return mm->context.lam_cr3_mask;

	/*

	 * When switch_mm_irqs_off() is called for a kthread, it may race with

	 * LAM enablement. switch_mm_irqs_off() uses the LAM mask to do two

	 * things: populate CR3 and populate 'cpu_tlbstate.lam'. Make sure it

	 * reads a single value for both.

	 */

	return READ_ONCE(mm->context.lam_cr3_mask);

}



static inline void dup_lam(struct mm_struct *oldmm, struct mm_struct *mm)

arch/x86/include/asm/tlbflush.h

+4 −5
Original line number Diff line number Diff line
@@ -399,11 +399,10 @@ static inline u64 tlbstate_lam_cr3_mask(void) 
	return lam << X86_CR3_LAM_U57_BIT;

}



static inline void set_tlbstate_lam_mode(struct mm_struct *mm)

static inline void cpu_tlbstate_update_lam(unsigned long lam, u64 untag_mask)

{

	this_cpu_write(cpu_tlbstate.lam,

		       mm->context.lam_cr3_mask >> X86_CR3_LAM_U57_BIT);

	this_cpu_write(tlbstate_untag_mask, mm->context.untag_mask);

	this_cpu_write(cpu_tlbstate.lam, lam >> X86_CR3_LAM_U57_BIT);

	this_cpu_write(tlbstate_untag_mask, untag_mask);

}



#else
@@ -413,7 +412,7 @@ static inline u64 tlbstate_lam_cr3_mask(void) 
	return 0;

}



static inline void set_tlbstate_lam_mode(struct mm_struct *mm)

static inline void cpu_tlbstate_update_lam(unsigned long lam, u64 untag_mask)

{

}

#endif

arch/x86/kernel/process_64.c

+4 −2
Original line number Diff line number Diff line
@@ -801,10 +801,12 @@ static long prctl_map_vdso(const struct vdso_image *image, unsigned long addr) 
static void enable_lam_func(void *__mm)

{

	struct mm_struct *mm = __mm;

	unsigned long lam;



	if (this_cpu_read(cpu_tlbstate.loaded_mm) == mm) {

		write_cr3(__read_cr3() | mm->context.lam_cr3_mask);

		set_tlbstate_lam_mode(mm);

		lam = mm_lam_cr3_mask(mm);

		write_cr3(__read_cr3() | lam);

		cpu_tlbstate_update_lam(lam, mm_untag_mask(mm));

	}

}

arch/x86/mm/tlb.c

+5 −3
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <linux/sched/smt.h>

#include <linux/task_work.h>

#include <linux/mmu_notifier.h>

#include <linux/mmu_context.h>



#include <asm/tlbflush.h>

#include <asm/mmu_context.h>
@@ -632,7 +633,6 @@ void switch_mm_irqs_off(struct mm_struct *unused, struct mm_struct *next, 
	}



	new_lam = mm_lam_cr3_mask(next);

	set_tlbstate_lam_mode(next);

	if (need_flush) {

		this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);

		this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
@@ -651,6 +651,7 @@ void switch_mm_irqs_off(struct mm_struct *unused, struct mm_struct *next, 


	this_cpu_write(cpu_tlbstate.loaded_mm, next);

	this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid);

	cpu_tlbstate_update_lam(new_lam, mm_untag_mask(next));



	if (next != prev) {

		cr4_update_pce_mm(next);
@@ -697,6 +698,7 @@ void initialize_tlbstate_and_flush(void) 
	int i;

	struct mm_struct *mm = this_cpu_read(cpu_tlbstate.loaded_mm);

	u64 tlb_gen = atomic64_read(&init_mm.context.tlb_gen);

	unsigned long lam = mm_lam_cr3_mask(mm);

	unsigned long cr3 = __read_cr3();



	/* Assert that CR3 already references the right mm. */
@@ -704,7 +706,7 @@ void initialize_tlbstate_and_flush(void) 


	/* LAM expected to be disabled */

	WARN_ON(cr3 & (X86_CR3_LAM_U48 | X86_CR3_LAM_U57));

	WARN_ON(mm_lam_cr3_mask(mm));

	WARN_ON(lam);



	/*

	 * Assert that CR4.PCIDE is set if needed.  (CR4.PCIDE initialization
@@ -723,7 +725,7 @@ void initialize_tlbstate_and_flush(void) 
	this_cpu_write(cpu_tlbstate.next_asid, 1);

	this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id);

	this_cpu_write(cpu_tlbstate.ctxs[0].tlb_gen, tlb_gen);

	set_tlbstate_lam_mode(mm);

	cpu_tlbstate_update_lam(lam, mm_untag_mask(mm));



	for (i = 1; i < TLB_NR_DYN_ASIDS; i++)

		this_cpu_write(cpu_tlbstate.ctxs[i].ctx_id, 0);