Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0 |
| 2 | // Copyright(c) 2018 Linus Torvalds. All rights reserved. |
| 3 | // Copyright(c) 2018 Alexei Starovoitov. All rights reserved. |
| 4 | // Copyright(c) 2018 Intel Corporation. All rights reserved. |
| 5 | |
| 6 | #ifndef _LINUX_NOSPEC_H |
| 7 | #define _LINUX_NOSPEC_H |
Dan Williams | 2e19277 | 2018-02-16 13:20:54 -0800 | [diff] [blame] | 8 | #include <asm/barrier.h> |
Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 9 | |
Kees Cook | 7d1254a | 2018-05-01 15:19:04 -0700 | [diff] [blame] | 10 | struct task_struct; |
| 11 | |
Dave Hansen | e0fbff1 | 2023-02-21 12:30:15 -0800 | [diff] [blame] | 12 | #ifndef barrier_nospec |
| 13 | # define barrier_nospec() do { } while (0) |
| 14 | #endif |
| 15 | |
Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 16 | /** |
| 17 | * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise |
| 18 | * @index: array element index |
| 19 | * @size: number of elements in array |
| 20 | * |
| 21 | * When @index is out of bounds (@index >= @size), the sign bit will be |
| 22 | * set. Extend the sign bit to all bits and invert, giving a result of |
| 23 | * zero for an out of bounds index, or ~0 if within bounds [0, @size). |
| 24 | */ |
| 25 | #ifndef array_index_mask_nospec |
| 26 | static inline unsigned long array_index_mask_nospec(unsigned long index, |
| 27 | unsigned long size) |
| 28 | { |
| 29 | /* |
Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 30 | * Always calculate and emit the mask even if the compiler |
| 31 | * thinks the mask is not needed. The compiler does not take |
| 32 | * into account the value of @index under speculation. |
| 33 | */ |
| 34 | OPTIMIZER_HIDE_VAR(index); |
| 35 | return ~(long)(index | (size - 1UL - index)) >> (BITS_PER_LONG - 1); |
| 36 | } |
| 37 | #endif |
| 38 | |
| 39 | /* |
| 40 | * array_index_nospec - sanitize an array index after a bounds check |
| 41 | * |
| 42 | * For a code sequence like: |
| 43 | * |
| 44 | * if (index < size) { |
| 45 | * index = array_index_nospec(index, size); |
| 46 | * val = array[index]; |
| 47 | * } |
| 48 | * |
| 49 | * ...if the CPU speculates past the bounds check then |
| 50 | * array_index_nospec() will clamp the index within the range of [0, |
| 51 | * size). |
| 52 | */ |
| 53 | #define array_index_nospec(index, size) \ |
| 54 | ({ \ |
| 55 | typeof(index) _i = (index); \ |
| 56 | typeof(size) _s = (size); \ |
Dan Williams | bebe399 | 2018-02-16 13:20:42 -0800 | [diff] [blame] | 57 | unsigned long _mask = array_index_mask_nospec(_i, _s); \ |
Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 58 | \ |
| 59 | BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ |
| 60 | BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ |
| 61 | \ |
Rasmus Villemoes | 656772c | 2018-02-16 13:20:48 -0800 | [diff] [blame] | 62 | (typeof(_i)) (_i & _mask); \ |
Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 63 | }) |
Thomas Gleixner | 33f6a06 | 2018-04-29 15:20:11 +0200 | [diff] [blame] | 64 | |
| 65 | /* Speculation control prctl */ |
Kees Cook | 7d1254a | 2018-05-01 15:19:04 -0700 | [diff] [blame] | 66 | int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which); |
| 67 | int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, |
| 68 | unsigned long ctrl); |
Thomas Gleixner | 61dfdc1 | 2018-05-04 15:12:06 +0200 | [diff] [blame] | 69 | /* Speculation control for seccomp enforced mitigation */ |
| 70 | void arch_seccomp_spec_mitigate(struct task_struct *task); |
Thomas Gleixner | 33f6a06 | 2018-04-29 15:20:11 +0200 | [diff] [blame] | 71 | |
Dan Williams | 478742c | 2018-01-29 17:02:22 -0800 | [diff] [blame] | 72 | #endif /* _LINUX_NOSPEC_H */ |