Commit 004fc58f authored by Anshuman Khandual's avatar Anshuman Khandual Committed by Catalin Marinas

arm64/mm: Intercept pfn changes in set_pte_at()

Changing pfn on a user page table mapped entry, without first going through
break-before-make (BBM) procedure is unsafe. This just updates set_pte_at()
to intercept such changes, via an updated pgattr_change_is_safe(). This new
check happens via __check_racy_pte_update(), which has now been renamed as
__check_safe_pte_update().

Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarAnshuman Khandual <anshuman.khandual@arm.com>
Link: https://lore.kernel.org/r/20230130121457.1607675-1-anshuman.khandual@arm.comSigned-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent a70f00e7
...@@ -275,6 +275,7 @@ static inline void set_pte(pte_t *ptep, pte_t pte) ...@@ -275,6 +275,7 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
} }
extern void __sync_icache_dcache(pte_t pteval); extern void __sync_icache_dcache(pte_t pteval);
bool pgattr_change_is_safe(u64 old, u64 new);
/* /*
* PTE bits configuration in the presence of hardware Dirty Bit Management * PTE bits configuration in the presence of hardware Dirty Bit Management
...@@ -292,7 +293,7 @@ extern void __sync_icache_dcache(pte_t pteval); ...@@ -292,7 +293,7 @@ extern void __sync_icache_dcache(pte_t pteval);
* PTE_DIRTY || (PTE_WRITE && !PTE_RDONLY) * PTE_DIRTY || (PTE_WRITE && !PTE_RDONLY)
*/ */
static inline void __check_racy_pte_update(struct mm_struct *mm, pte_t *ptep, static inline void __check_safe_pte_update(struct mm_struct *mm, pte_t *ptep,
pte_t pte) pte_t pte)
{ {
pte_t old_pte; pte_t old_pte;
...@@ -318,6 +319,9 @@ static inline void __check_racy_pte_update(struct mm_struct *mm, pte_t *ptep, ...@@ -318,6 +319,9 @@ static inline void __check_racy_pte_update(struct mm_struct *mm, pte_t *ptep,
VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte), VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
"%s: racy dirty state clearing: 0x%016llx -> 0x%016llx", "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
__func__, pte_val(old_pte), pte_val(pte)); __func__, pte_val(old_pte), pte_val(pte));
VM_WARN_ONCE(!pgattr_change_is_safe(pte_val(old_pte), pte_val(pte)),
"%s: unsafe attribute change: 0x%016llx -> 0x%016llx",
__func__, pte_val(old_pte), pte_val(pte));
} }
static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr, static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
...@@ -346,7 +350,7 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr, ...@@ -346,7 +350,7 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
mte_sync_tags(old_pte, pte); mte_sync_tags(old_pte, pte);
} }
__check_racy_pte_update(mm, ptep, pte); __check_safe_pte_update(mm, ptep, pte);
set_pte(ptep, pte); set_pte(ptep, pte);
} }
......
...@@ -133,7 +133,7 @@ static phys_addr_t __init early_pgtable_alloc(int shift) ...@@ -133,7 +133,7 @@ static phys_addr_t __init early_pgtable_alloc(int shift)
return phys; return phys;
} }
static bool pgattr_change_is_safe(u64 old, u64 new) bool pgattr_change_is_safe(u64 old, u64 new)
{ {
/* /*
* The following mapping attributes may be updated in live * The following mapping attributes may be updated in live
...@@ -142,9 +142,13 @@ static bool pgattr_change_is_safe(u64 old, u64 new) ...@@ -142,9 +142,13 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG; pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG;
/* creating or taking down mappings is always safe */ /* creating or taking down mappings is always safe */
if (old == 0 || new == 0) if (!pte_valid(__pte(old)) || !pte_valid(__pte(new)))
return true; return true;
/* A live entry's pfn should not change */
if (pte_pfn(__pte(old)) != pte_pfn(__pte(new)))
return false;
/* live contiguous mappings may not be manipulated at all */ /* live contiguous mappings may not be manipulated at all */
if ((old | new) & PTE_CONT) if ((old | new) & PTE_CONT)
return false; return false;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment