Date: Thu, 9 Mar 2017 18:04:06 +0000 From: Mark Rutland <mark.rutland@....com> To: Ard Biesheuvel <ard.biesheuvel@...aro.org> Cc: linux-arm-kernel@...ts.infradead.org, keescook@...omium.org, labbott@...oraproject.org, kernel-hardening@...ts.openwall.com, will.deacon@....com, catalin.marinas@....com, kvmarm@...ts.cs.columbia.edu, marc.zyngier@....com Subject: Re: [PATCH v5 08/10] arm64/mmu: add contiguous bit to sanity bug check On Thu, Mar 09, 2017 at 09:25:10AM +0100, Ard Biesheuvel wrote: > A mapping with the contiguous bit cannot be safely manipulated while > live, regardless of whether the bit changes between the old and new > mapping. So take this into account when deciding whether the change > is safe. > > Signed-off-by: Ard Biesheuvel <ard.biesheuvel@...aro.org> Reviewed-by: Mark Rutland <mark.rutland@....com> Strictly speaking, I think this is marginally more stringent than what the ARM ARM describes. My reading is that the "Misprogramming of the Contiguous bit" rules only apply when there are multiple valid entries, and hence if you had a contiguous span with only a single valid entry (and TLBs up-to-date), you could modify that in-place so long as you followed the usual BBM rules. However, I don't see us ever (deliberately) doing that, given it would require more work, and there's no guarantee that the CPU would consider the whole span as being mapped. It's also possible my reading of the ARM ARM is flawed. Thanks, Mark. > --- > arch/arm64/mm/mmu.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c > index d3fecd20a136..a6d7a86dd2b8 100644 > --- a/arch/arm64/mm/mmu.c > +++ b/arch/arm64/mm/mmu.c > @@ -103,7 +103,15 @@ static bool pgattr_change_is_safe(u64 old, u64 new) > */ > static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE; > > - return old == 0 || new == 0 || ((old ^ new) & ~mask) == 0; > + /* creating or taking down mappings is always safe */ > + if (old == 0 || new == 0) > + return true; > + > + /* live contiguous mappings may not be manipulated at all */ > + if ((old | new) & PTE_CONT) > + return false; > + > + return ((old ^ new) & ~mask) == 0; > } > > static void alloc_init_pte(pmd_t *pmd, unsigned long addr, > -- > 2.7.4 >
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.