From: Jun Yao <yaojun8558363@gmail.com> To: linux-arm-kernel@lists.infradead.org Cc: catalin.marinas@arm.com, will.deacon@arm.com, james.morse@arm.com, linux-kernel@vger.kernel.org Subject: [PATCH v5 5/6] arm64/mm: Populate the swapper_pg_dir by fixmap. Date: Mon, 17 Sep 2018 12:43:32 +0800 [thread overview] Message-ID: <20180917044333.30051-6-yaojun8558363@gmail.com> (raw) In-Reply-To: <20180917044333.30051-1-yaojun8558363@gmail.com> Since we will move the swapper_pg_dir to rodata section, we need a way to update it. The fixmap can handle it. When the swapper_pg_dir needs to be updated, we map it dynamically. The map will be canceled after the update is complete. In this way, we can defend against KSMA(Kernel Space Mirror Attack). Signed-off-by: Jun Yao <yaojun8558363@gmail.com> --- arch/arm64/include/asm/pgtable.h | 38 ++++++++++++++++++++++++++------ arch/arm64/mm/mmu.c | 25 +++++++++++++++++++-- 2 files changed, 54 insertions(+), 9 deletions(-) diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h index b11d6fc62a62..9e643fc2453d 100644 --- a/arch/arm64/include/asm/pgtable.h +++ b/arch/arm64/include/asm/pgtable.h @@ -429,8 +429,29 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, PUD_TYPE_TABLE) #endif +extern pgd_t init_pg_dir[PTRS_PER_PGD]; +extern pgd_t init_pg_end[]; +extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; +extern pgd_t swapper_pg_end[]; +extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; +extern pgd_t tramp_pg_dir[PTRS_PER_PGD]; + +extern void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd); + +static inline bool in_swapper_pgdir(void *addr) +{ + return ((unsigned long)addr & PAGE_MASK) == + ((unsigned long)swapper_pg_dir & PAGE_MASK); +} + static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) { +#ifdef __PAGETABLE_PMD_FOLDED + if (in_swapper_pgdir(pmdp)) { + set_swapper_pgd((pgd_t *)pmdp, __pgd(pmd_val(pmd))); + return; + } +#endif WRITE_ONCE(*pmdp, pmd); if (pmd_valid(pmd)) @@ -484,6 +505,12 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd) static inline void set_pud(pud_t *pudp, pud_t pud) { +#ifdef __PAGETABLE_PUD_FOLDED + if (in_swapper_pgdir(pudp)) { + set_swapper_pgd((pgd_t *)pudp, __pgd(pud_val(pud))); + return; + } +#endif WRITE_ONCE(*pudp, pud); if (pud_valid(pud)) @@ -538,6 +565,10 @@ static inline phys_addr_t pud_page_paddr(pud_t pud) static inline void set_pgd(pgd_t *pgdp, pgd_t pgd) { + if (in_swapper_pgdir(pgdp)) { + set_swapper_pgd(pgdp, pgd); + return; + } WRITE_ONCE(*pgdp, pgd); dsb(ishst); } @@ -718,13 +749,6 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, } #endif -extern pgd_t init_pg_dir[PTRS_PER_PGD]; -extern pgd_t init_pg_end[]; -extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; -extern pgd_t swapper_pg_end[]; -extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; -extern pgd_t tramp_pg_dir[PTRS_PER_PGD]; - /* * Encode and decode a swap entry: * bits 0-1: present (must be zero) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 71532bcd76c1..a8a60927f716 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -67,6 +67,24 @@ static pte_t bm_pte[PTRS_PER_PTE] __page_aligned_bss; static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused; static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused; +static DEFINE_SPINLOCK(swapper_pgdir_lock); + +void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd) +{ + pgd_t *fixmap_pgdp; + + spin_lock(&swapper_pgdir_lock); + fixmap_pgdp = pgd_set_fixmap(__pa(pgdp)); + WRITE_ONCE(*fixmap_pgdp, pgd); + /* + * We need dsb(ishst) here to ensure the page-table-walker sees + * our new entry before set_p?d() returns. The fixmap's + * flush_tlb_kernel_range() via clear_fixmap() does this for us. + */ + pgd_clear_fixmap(); + spin_unlock(&swapper_pgdir_lock); +} + pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, unsigned long size, pgprot_t vma_prot) { @@ -629,8 +647,11 @@ static void __init map_kernel(pgd_t *pgdp) */ void __init paging_init(void) { - map_kernel(swapper_pg_dir); - map_mem(swapper_pg_dir); + pgd_t *pgdp = pgd_set_fixmap(__pa_symbol(swapper_pg_dir)); + + map_kernel(pgdp); + map_mem(pgdp); + pgd_clear_fixmap(); cpu_replace_ttbr1(lm_alias(swapper_pg_dir)); init_mm.pgd = swapper_pg_dir; } -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: yaojun8558363@gmail.com (Jun Yao) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v5 5/6] arm64/mm: Populate the swapper_pg_dir by fixmap. Date: Mon, 17 Sep 2018 12:43:32 +0800 [thread overview] Message-ID: <20180917044333.30051-6-yaojun8558363@gmail.com> (raw) In-Reply-To: <20180917044333.30051-1-yaojun8558363@gmail.com> Since we will move the swapper_pg_dir to rodata section, we need a way to update it. The fixmap can handle it. When the swapper_pg_dir needs to be updated, we map it dynamically. The map will be canceled after the update is complete. In this way, we can defend against KSMA(Kernel Space Mirror Attack). Signed-off-by: Jun Yao <yaojun8558363@gmail.com> --- arch/arm64/include/asm/pgtable.h | 38 ++++++++++++++++++++++++++------ arch/arm64/mm/mmu.c | 25 +++++++++++++++++++-- 2 files changed, 54 insertions(+), 9 deletions(-) diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h index b11d6fc62a62..9e643fc2453d 100644 --- a/arch/arm64/include/asm/pgtable.h +++ b/arch/arm64/include/asm/pgtable.h @@ -429,8 +429,29 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, PUD_TYPE_TABLE) #endif +extern pgd_t init_pg_dir[PTRS_PER_PGD]; +extern pgd_t init_pg_end[]; +extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; +extern pgd_t swapper_pg_end[]; +extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; +extern pgd_t tramp_pg_dir[PTRS_PER_PGD]; + +extern void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd); + +static inline bool in_swapper_pgdir(void *addr) +{ + return ((unsigned long)addr & PAGE_MASK) == + ((unsigned long)swapper_pg_dir & PAGE_MASK); +} + static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) { +#ifdef __PAGETABLE_PMD_FOLDED + if (in_swapper_pgdir(pmdp)) { + set_swapper_pgd((pgd_t *)pmdp, __pgd(pmd_val(pmd))); + return; + } +#endif WRITE_ONCE(*pmdp, pmd); if (pmd_valid(pmd)) @@ -484,6 +505,12 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd) static inline void set_pud(pud_t *pudp, pud_t pud) { +#ifdef __PAGETABLE_PUD_FOLDED + if (in_swapper_pgdir(pudp)) { + set_swapper_pgd((pgd_t *)pudp, __pgd(pud_val(pud))); + return; + } +#endif WRITE_ONCE(*pudp, pud); if (pud_valid(pud)) @@ -538,6 +565,10 @@ static inline phys_addr_t pud_page_paddr(pud_t pud) static inline void set_pgd(pgd_t *pgdp, pgd_t pgd) { + if (in_swapper_pgdir(pgdp)) { + set_swapper_pgd(pgdp, pgd); + return; + } WRITE_ONCE(*pgdp, pgd); dsb(ishst); } @@ -718,13 +749,6 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, } #endif -extern pgd_t init_pg_dir[PTRS_PER_PGD]; -extern pgd_t init_pg_end[]; -extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; -extern pgd_t swapper_pg_end[]; -extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; -extern pgd_t tramp_pg_dir[PTRS_PER_PGD]; - /* * Encode and decode a swap entry: * bits 0-1: present (must be zero) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 71532bcd76c1..a8a60927f716 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -67,6 +67,24 @@ static pte_t bm_pte[PTRS_PER_PTE] __page_aligned_bss; static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused; static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused; +static DEFINE_SPINLOCK(swapper_pgdir_lock); + +void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd) +{ + pgd_t *fixmap_pgdp; + + spin_lock(&swapper_pgdir_lock); + fixmap_pgdp = pgd_set_fixmap(__pa(pgdp)); + WRITE_ONCE(*fixmap_pgdp, pgd); + /* + * We need dsb(ishst) here to ensure the page-table-walker sees + * our new entry before set_p?d() returns. The fixmap's + * flush_tlb_kernel_range() via clear_fixmap() does this for us. + */ + pgd_clear_fixmap(); + spin_unlock(&swapper_pgdir_lock); +} + pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, unsigned long size, pgprot_t vma_prot) { @@ -629,8 +647,11 @@ static void __init map_kernel(pgd_t *pgdp) */ void __init paging_init(void) { - map_kernel(swapper_pg_dir); - map_mem(swapper_pg_dir); + pgd_t *pgdp = pgd_set_fixmap(__pa_symbol(swapper_pg_dir)); + + map_kernel(pgdp); + map_mem(pgdp); + pgd_clear_fixmap(); cpu_replace_ttbr1(lm_alias(swapper_pg_dir)); init_mm.pgd = swapper_pg_dir; } -- 2.17.1
next prev parent reply other threads:[~2018-09-17 4:44 UTC|newest] Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-09-17 4:43 [PATCH v5 0/6] Move swapper_pg_dir to rodata section Jun Yao 2018-09-17 4:43 ` Jun Yao 2018-09-17 4:43 ` [PATCH v5 1/6] arm64/mm: Introduce the init_pg_dir Jun Yao 2018-09-17 4:43 ` Jun Yao 2018-09-24 13:01 ` Mark Rutland 2018-09-24 13:01 ` Mark Rutland 2018-09-24 14:03 ` Mark Rutland 2018-09-24 14:03 ` Mark Rutland 2018-09-17 4:43 ` [PATCH v5 2/6] arm64/mm: Pass ttbr1 as a parameter to __enable_mmu() Jun Yao 2018-09-17 4:43 ` Jun Yao 2018-09-24 13:26 ` Mark Rutland 2018-09-24 13:26 ` Mark Rutland 2018-09-17 4:43 ` [PATCH v5 3/6] arm64/mm: Create the initial page table in the init_pg_dir Jun Yao 2018-09-17 4:43 ` Jun Yao 2018-09-24 13:34 ` Mark Rutland 2018-09-24 13:34 ` Mark Rutland 2018-10-01 13:49 ` James Morse 2018-10-01 13:49 ` James Morse 2018-09-17 4:43 ` [PATCH v5 4/6] arm64/mm: Create the final page table directly in swapper_pg_dir Jun Yao 2018-09-17 4:43 ` Jun Yao 2018-09-17 4:43 ` Jun Yao [this message] 2018-09-17 4:43 ` [PATCH v5 5/6] arm64/mm: Populate the swapper_pg_dir by fixmap Jun Yao 2018-09-24 16:36 ` Mark Rutland 2018-09-24 16:36 ` Mark Rutland 2018-10-01 10:41 ` James Morse 2018-10-01 10:41 ` James Morse 2018-10-01 13:49 ` James Morse 2018-10-01 13:49 ` James Morse 2018-09-24 16:54 ` Mark Rutland 2018-09-24 16:54 ` Mark Rutland 2018-09-17 4:43 ` [PATCH v5 6/6] arm64/mm: Move {idmap_pg_dir .. swapper_pg_dir} to rodata section Jun Yao 2018-09-17 4:43 ` Jun Yao 2018-09-21 22:26 ` [PATCH v5 0/6] Move swapper_pg_dir " James Morse 2018-09-21 22:26 ` James Morse 2018-09-25 8:56 ` Jun Yao 2018-09-25 8:56 ` Jun Yao 2018-09-24 17:19 ` Mark Rutland 2018-09-24 17:19 ` Mark Rutland 2018-09-25 9:53 ` Jun Yao 2018-09-25 9:53 ` Jun Yao 2018-09-25 14:06 ` Mark Rutland, catalin.marinas 2018-09-25 14:06 ` Mark Rutland 2018-09-25 14:38 ` Catalin Marinas 2018-09-25 14:38 ` Catalin Marinas 2018-10-03 13:33 ` James Morse 2018-10-03 13:33 ` James Morse
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180917044333.30051-6-yaojun8558363@gmail.com \ --to=yaojun8558363@gmail.com \ --cc=catalin.marinas@arm.com \ --cc=james.morse@arm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.