Commit 2330b7ca authored by Jun Yao's avatar Jun Yao Committed by Catalin Marinas
Browse files

arm64/mm: use fixmap to modify swapper_pg_dir 



Once swapper_pg_dir is in the rodata section, it will not be possible to
modify it directly, but we will need to modify it in some cases.

To enable this, we can use the fixmap when deliberately modifying
swapper_pg_dir. As the pgd is only transiently mapped, this provides
some resilience against illicit modification of the pgd, e.g. for
Kernel Space Mirror Attack (KSMA).

Signed-off-by: default avatarJun Yao <yaojun8558363@gmail.com>
Reviewed-by: default avatarJames Morse <james.morse@arm.com>
[Mark: simplify ifdeffery, commit message]
Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 2b5548b6

arch/arm64/include/asm/pgtable.h

+29 −6
Original line number Diff line number Diff line
@@ -429,8 +429,27 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, 
				 PUD_TYPE_TABLE)

#endif



extern pgd_t init_pg_dir[PTRS_PER_PGD];

extern pgd_t init_pg_end[];

extern pgd_t swapper_pg_dir[PTRS_PER_PGD];

extern pgd_t idmap_pg_dir[PTRS_PER_PGD];

extern pgd_t tramp_pg_dir[PTRS_PER_PGD];



extern void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd);



static inline bool in_swapper_pgdir(void *addr)

{

	return ((unsigned long)addr & PAGE_MASK) ==

	        ((unsigned long)swapper_pg_dir & PAGE_MASK);

}



static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)

{

	if (__is_defined(__PAGETABLE_PMD_FOLDED) && in_swapper_pgdir(pmdp)) {

		set_swapper_pgd((pgd_t *)pmdp, __pgd(pmd_val(pmd)));

		return;

	}



	WRITE_ONCE(*pmdp, pmd);



	if (pmd_valid(pmd))
@@ -484,6 +503,11 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd) 


static inline void set_pud(pud_t *pudp, pud_t pud)

{

	if (__is_defined(__PAGETABLE_PUD_FOLDED) && in_swapper_pgdir(pudp)) {

		set_swapper_pgd((pgd_t *)pudp, __pgd(pud_val(pud)));

		return;

	}



	WRITE_ONCE(*pudp, pud);



	if (pud_valid(pud))
@@ -538,6 +562,11 @@ static inline phys_addr_t pud_page_paddr(pud_t pud) 


static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)

{

	if (in_swapper_pgdir(pgdp)) {

		set_swapper_pgd(pgdp, pgd);

		return;

	}



	WRITE_ONCE(*pgdp, pgd);

	dsb(ishst);

}
@@ -718,12 +747,6 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, 
}

#endif



extern pgd_t init_pg_dir[PTRS_PER_PGD];

extern pgd_t init_pg_end[];

extern pgd_t swapper_pg_dir[PTRS_PER_PGD];

extern pgd_t idmap_pg_dir[PTRS_PER_PGD];

extern pgd_t tramp_pg_dir[PTRS_PER_PGD];



/*

 * Encode and decode a swap entry:

 *	bits 0-1:	present (must be zero)

arch/arm64/mm/mmu.c

+24 −2
Original line number Diff line number Diff line
@@ -67,6 +67,24 @@ static pte_t bm_pte[PTRS_PER_PTE] __page_aligned_bss; 
static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused;

static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused;



static DEFINE_SPINLOCK(swapper_pgdir_lock);



void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd)

{

	pgd_t *fixmap_pgdp;



	spin_lock(&swapper_pgdir_lock);

	fixmap_pgdp = pgd_set_fixmap(__pa(pgdp));

	WRITE_ONCE(*fixmap_pgdp, pgd);

	/*

	 * We need dsb(ishst) here to ensure the page-table-walker sees

	 * our new entry before set_p?d() returns. The fixmap's

	 * flush_tlb_kernel_range() via clear_fixmap() does this for us.

	 */

	pgd_clear_fixmap();

	spin_unlock(&swapper_pgdir_lock);

}



pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,

			      unsigned long size, pgprot_t vma_prot)

{
@@ -629,8 +647,12 @@ static void __init map_kernel(pgd_t *pgdp) 
 */

void __init paging_init(void)

{

	map_kernel(swapper_pg_dir);

	map_mem(swapper_pg_dir);

	pgd_t *pgdp = pgd_set_fixmap(__pa_symbol(swapper_pg_dir));



	map_kernel(pgdp);

	map_mem(pgdp);



	pgd_clear_fixmap();



	cpu_replace_ttbr1(lm_alias(swapper_pg_dir));

	init_mm.pgd = swapper_pg_dir;

CRA Git | Maintained and supported by SUSTech CRA and CCSE