1 #ifndef _ASM_X86_KAISER_H
2 #define _ASM_X86_KAISER_H
4 #include <asm/processor-flags.h> /* For PCID constants */
7 * This file includes the definitions for the KAISER feature.
8 * KAISER is a counter measure against x86_64 side channel attacks on
9 * the kernel virtual memory. It has a shadow pgd for every process: the
10 * shadow pgd has a minimalistic kernel-set mapped, but includes the whole
11 * user memory. Within a kernel context switch, or when an interrupt is handled,
12 * the pgd is switched to the normal one. When the system switches to user mode,
13 * the shadow pgd is enabled. By this, the virtual memory caches are freed,
14 * and the user may not attack the whole kernel memory.
16 * A minimalistic kernel mapping holds the parts needed to be mapped in user
17 * mode, such as the entry/exit functions of the user space, or the stacks.
20 #define KAISER_SHADOW_PGD_OFFSET 0x1000
25 .macro _SWITCH_TO_KERNEL_CR3 reg
27 andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), \reg
28 orq x86_cr3_pcid_noflush, \reg
32 .macro _SWITCH_TO_USER_CR3 reg regb
34 * regb must be the low byte portion of reg: because we have arranged
35 * for the low byte of the user PCID to serve as the high byte of NOFLUSH
36 * (0x80 for each when PCID is enabled, or 0x00 when PCID and NOFLUSH are
37 * not enabled): so that the one register can update both memory and cr3.
40 orq PER_CPU_VAR(x86_cr3_pcid_user), \reg
42 /* FLUSH this time, reset to NOFLUSH for next time (if PCID enabled) */
43 movb \regb, PER_CPU_VAR(x86_cr3_pcid_user+7)
48 .macro SWITCH_KERNEL_CR3
49 ALTERNATIVE "jmp 8f", "pushq %rax", X86_FEATURE_KAISER
50 _SWITCH_TO_KERNEL_CR3 %rax
55 .macro SWITCH_USER_CR3
56 ALTERNATIVE "jmp 8f", "pushq %rax", X86_FEATURE_KAISER
57 _SWITCH_TO_USER_CR3 %rax %al
62 .macro SWITCH_KERNEL_CR3_NO_STACK
63 ALTERNATIVE "jmp 8f", \
64 __stringify(movq %rax, PER_CPU_VAR(unsafe_stack_register_backup)), \
66 _SWITCH_TO_KERNEL_CR3 %rax
67 movq PER_CPU_VAR(unsafe_stack_register_backup), %rax
71 #else /* CONFIG_KAISER */
73 .macro SWITCH_KERNEL_CR3
75 .macro SWITCH_USER_CR3
77 .macro SWITCH_KERNEL_CR3_NO_STACK
80 #endif /* CONFIG_KAISER */
82 #else /* __ASSEMBLY__ */
86 * Upon kernel/user mode switch, it may happen that the address
87 * space has to be switched before the registers have been
88 * stored. To change the address space, another register is
89 * needed. A register therefore has to be stored/restored.
91 DECLARE_PER_CPU_USER_MAPPED(unsigned long, unsafe_stack_register_backup);
93 extern unsigned long x86_cr3_pcid_noflush;
94 DECLARE_PER_CPU(unsigned long, x86_cr3_pcid_user);
96 extern char __per_cpu_user_mapped_start[], __per_cpu_user_mapped_end[];
98 extern int kaiser_enabled;
100 #define kaiser_enabled 0
101 #endif /* CONFIG_KAISER */
104 * Kaiser function prototypes are needed even when CONFIG_KAISER is not set,
105 * so as to build with tests on kaiser_enabled instead of #ifdefs.
109 * kaiser_add_mapping - map a virtual memory part to the shadow (user) mapping
110 * @addr: the start address of the range
111 * @size: the size of the range
112 * @flags: The mapping flags of the pages
114 * The mapping is done on a global scope, so no bigger
115 * synchronization has to be done. the pages have to be
116 * manually unmapped again when they are not needed any longer.
118 extern int kaiser_add_mapping(unsigned long addr, unsigned long size, unsigned long flags);
121 * kaiser_remove_mapping - unmap a virtual memory part of the shadow mapping
122 * @addr: the start address of the range
123 * @size: the size of the range
125 extern void kaiser_remove_mapping(unsigned long start, unsigned long size);
128 * kaiser_init - Initialize the shadow mapping
130 * Most parts of the shadow mapping can be mapped upon boot
131 * time. Only per-process things like the thread stacks
132 * or a new LDT have to be mapped at runtime. These boot-
133 * time mappings are permanent and never unmapped.
135 extern void kaiser_init(void);
137 #endif /* __ASSEMBLY */
139 #endif /* _ASM_X86_KAISER_H */