LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH 4/4] arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
@ 2018-06-01  8:09 Jun Yao
  2018-06-01  9:47 ` Robin Murphy
  0 siblings, 1 reply; 2+ messages in thread
From: Jun Yao @ 2018-06-01  8:09 UTC (permalink / raw)
  To: linux-arm-kernel
  Cc: catalin.marinas, will.deacon, linux-kernel, kernel-hardening, greg

Migrate swapper_pg_dir and tramp_pg_dir. And their virtual addresses
do not correlate with kernel's address.

Signed-off-by: Jun Yao <yaojun8558363@gmail.com>
---
 arch/arm64/mm/mmu.c | 70 +++++++++++++++++++++++++++------------------
 1 file changed, 42 insertions(+), 28 deletions(-)

diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 26ba3e70a91c..5baae59479d8 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -57,6 +57,9 @@ EXPORT_SYMBOL(kimage_voffset);
 
 phys_addr_t __pa_swapper_pg_dir;
 pgd_t *new_swapper_pg_dir = swapper_pg_dir;
+#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+pgd_t *new_tramp_pg_dir;
+#endif
 
 /*
  * Empty_zero_page is a special page that is used for zero-initialized data
@@ -80,19 +83,14 @@ pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 }
 EXPORT_SYMBOL(phys_mem_access_prot);
 
-static phys_addr_t __init early_pgtable_alloc(void)
+static void __init clear_page_phys(phys_addr_t phys)
 {
-	phys_addr_t phys;
-	void *ptr;
-
-	phys = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
-
 	/*
 	 * The FIX_{PGD,PUD,PMD} slots may be in active use, but the FIX_PTE
 	 * slot will be free, so we can (ab)use the FIX_PTE slot to initialise
 	 * any level of table.
 	 */
-	ptr = pte_set_fixmap(phys);
+	void *ptr = pte_set_fixmap(phys);
 
 	memset(ptr, 0, PAGE_SIZE);
 
@@ -101,6 +99,14 @@ static phys_addr_t __init early_pgtable_alloc(void)
 	 * table walker
 	 */
 	pte_clear_fixmap();
+}
+
+static phys_addr_t __init early_pgtable_alloc(void)
+{
+	phys_addr_t phys;
+
+	phys = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
+	clear_page_phys(phys);
 
 	return phys;
 }
@@ -554,6 +560,10 @@ static int __init map_entry_trampoline(void)
 	__create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,
 			     prot, pgd_pgtable_alloc, 0);
 
+	memcpy(new_tramp_pg_dir, tramp_pg_dir, PGD_SIZE);
+	memblock_free(__pa_symbol(tramp_pg_dir),
+		__pa_symbol(swapper_pg_dir) - __pa_symbol(tramp_pg_dir));
+
 	/* Map both the text and data into the kernel page table */
 	__set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot);
 	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
@@ -631,36 +641,40 @@ static void __init map_kernel(pgd_t *pgdp)
  */
 void __init paging_init(void)
 {
-	phys_addr_t pgd_phys = early_pgtable_alloc();
-	pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
+	phys_addr_t pgd_phys;
+	pgd_t *pgdp;
+
+#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+	phys_addr_t mem_size;
+	phys_addr_t p;
 
-	__pa_swapper_pg_dir = __pa_symbol(swapper_pg_dir);
+	mem_size = __pa_symbol(swapper_pg_dir) + PAGE_SIZE
+				- __pa_symbol(tramp_pg_dir);
+	pgd_phys = memblock_alloc(mem_size, PAGE_SIZE);
+
+	for (p = pgd_phys; p < pgd_phys + mem_size; p += PAGE_SIZE)
+		clear_page_phys(p);
+
+	new_tramp_pg_dir = __va(pgd_phys);
+	__pa_swapper_pg_dir = pgd_phys + PAGE_SIZE;
+#else
+	pgd_phys = early_pgtable_alloc();
+	__pa_swapper_pg_dir = pgd_phys;
+#endif
+	new_swapper_pg_dir = __va(__pa_swapper_pg_dir);
+
+	pgdp = pgd_set_fixmap(__pa_swapper_pg_dir);
 
 	map_kernel(pgdp);
 	map_mem(pgdp);
 
-	/*
-	 * We want to reuse the original swapper_pg_dir so we don't have to
-	 * communicate the new address to non-coherent secondaries in
-	 * secondary_entry, and so cpu_switch_mm can generate the address with
-	 * adrp+add rather than a load from some global variable.
-	 *
-	 * To do this we need to go via a temporary pgd.
-	 */
-	cpu_replace_ttbr1(pgd_phys);
-	memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
 	cpu_replace_ttbr1(__pa_swapper_pg_dir);
+	init_mm.pgd = new_swapper_pg_dir;
 
 	pgd_clear_fixmap();
-	memblock_free(pgd_phys, PAGE_SIZE);
 
-	/*
-	 * We only reuse the PGD from the swapper_pg_dir, not the pud + pmd
-	 * allocated with it.
-	 */
-	memblock_free(__pa_symbol(swapper_pg_dir) + PAGE_SIZE,
-		      __pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir)
-		      - PAGE_SIZE);
+	memblock_free(__pa_symbol(swapper_pg_dir),
+		__pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir));
 }
 
 /*
-- 
2.17.0

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH 4/4] arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
  2018-06-01  8:09 [PATCH 4/4] arm64/mm: migrate swapper_pg_dir and tramp_pg_dir Jun Yao
@ 2018-06-01  9:47 ` Robin Murphy
  0 siblings, 0 replies; 2+ messages in thread
From: Robin Murphy @ 2018-06-01  9:47 UTC (permalink / raw)
  To: Jun Yao, linux-arm-kernel
  Cc: catalin.marinas, will.deacon, linux-kernel, greg, kernel-hardening

On 01/06/18 09:09, Jun Yao wrote:
> Migrate swapper_pg_dir and tramp_pg_dir. And their virtual addresses
> do not correlate with kernel's address.

I think this might break software PAN, which IIRC depends on the 
reserved TTBR0 PGD being physically adjacent to the live swapper PGD for 
the trickery in __uaccess_ttbr0_{en,dis}able() to work.

Robin.

> Signed-off-by: Jun Yao <yaojun8558363@gmail.com>
> ---
>   arch/arm64/mm/mmu.c | 70 +++++++++++++++++++++++++++------------------
>   1 file changed, 42 insertions(+), 28 deletions(-)
> 
> diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
> index 26ba3e70a91c..5baae59479d8 100644
> --- a/arch/arm64/mm/mmu.c
> +++ b/arch/arm64/mm/mmu.c
> @@ -57,6 +57,9 @@ EXPORT_SYMBOL(kimage_voffset);
>   
>   phys_addr_t __pa_swapper_pg_dir;
>   pgd_t *new_swapper_pg_dir = swapper_pg_dir;
> +#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
> +pgd_t *new_tramp_pg_dir;
> +#endif
>   
>   /*
>    * Empty_zero_page is a special page that is used for zero-initialized data
> @@ -80,19 +83,14 @@ pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
>   }
>   EXPORT_SYMBOL(phys_mem_access_prot);
>   
> -static phys_addr_t __init early_pgtable_alloc(void)
> +static void __init clear_page_phys(phys_addr_t phys)
>   {
> -	phys_addr_t phys;
> -	void *ptr;
> -
> -	phys = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
> -
>   	/*
>   	 * The FIX_{PGD,PUD,PMD} slots may be in active use, but the FIX_PTE
>   	 * slot will be free, so we can (ab)use the FIX_PTE slot to initialise
>   	 * any level of table.
>   	 */
> -	ptr = pte_set_fixmap(phys);
> +	void *ptr = pte_set_fixmap(phys);
>   
>   	memset(ptr, 0, PAGE_SIZE);
>   
> @@ -101,6 +99,14 @@ static phys_addr_t __init early_pgtable_alloc(void)
>   	 * table walker
>   	 */
>   	pte_clear_fixmap();
> +}
> +
> +static phys_addr_t __init early_pgtable_alloc(void)
> +{
> +	phys_addr_t phys;
> +
> +	phys = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
> +	clear_page_phys(phys);
>   
>   	return phys;
>   }
> @@ -554,6 +560,10 @@ static int __init map_entry_trampoline(void)
>   	__create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,
>   			     prot, pgd_pgtable_alloc, 0);
>   
> +	memcpy(new_tramp_pg_dir, tramp_pg_dir, PGD_SIZE);
> +	memblock_free(__pa_symbol(tramp_pg_dir),
> +		__pa_symbol(swapper_pg_dir) - __pa_symbol(tramp_pg_dir));
> +
>   	/* Map both the text and data into the kernel page table */
>   	__set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot);
>   	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
> @@ -631,36 +641,40 @@ static void __init map_kernel(pgd_t *pgdp)
>    */
>   void __init paging_init(void)
>   {
> -	phys_addr_t pgd_phys = early_pgtable_alloc();
> -	pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
> +	phys_addr_t pgd_phys;
> +	pgd_t *pgdp;
> +
> +#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
> +	phys_addr_t mem_size;
> +	phys_addr_t p;
>   
> -	__pa_swapper_pg_dir = __pa_symbol(swapper_pg_dir);
> +	mem_size = __pa_symbol(swapper_pg_dir) + PAGE_SIZE
> +				- __pa_symbol(tramp_pg_dir);
> +	pgd_phys = memblock_alloc(mem_size, PAGE_SIZE);
> +
> +	for (p = pgd_phys; p < pgd_phys + mem_size; p += PAGE_SIZE)
> +		clear_page_phys(p);
> +
> +	new_tramp_pg_dir = __va(pgd_phys);
> +	__pa_swapper_pg_dir = pgd_phys + PAGE_SIZE;
> +#else
> +	pgd_phys = early_pgtable_alloc();
> +	__pa_swapper_pg_dir = pgd_phys;
> +#endif
> +	new_swapper_pg_dir = __va(__pa_swapper_pg_dir);
> +
> +	pgdp = pgd_set_fixmap(__pa_swapper_pg_dir);
>   
>   	map_kernel(pgdp);
>   	map_mem(pgdp);
>   
> -	/*
> -	 * We want to reuse the original swapper_pg_dir so we don't have to
> -	 * communicate the new address to non-coherent secondaries in
> -	 * secondary_entry, and so cpu_switch_mm can generate the address with
> -	 * adrp+add rather than a load from some global variable.
> -	 *
> -	 * To do this we need to go via a temporary pgd.
> -	 */
> -	cpu_replace_ttbr1(pgd_phys);
> -	memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
>   	cpu_replace_ttbr1(__pa_swapper_pg_dir);
> +	init_mm.pgd = new_swapper_pg_dir;
>   
>   	pgd_clear_fixmap();
> -	memblock_free(pgd_phys, PAGE_SIZE);
>   
> -	/*
> -	 * We only reuse the PGD from the swapper_pg_dir, not the pud + pmd
> -	 * allocated with it.
> -	 */
> -	memblock_free(__pa_symbol(swapper_pg_dir) + PAGE_SIZE,
> -		      __pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir)
> -		      - PAGE_SIZE);
> +	memblock_free(__pa_symbol(swapper_pg_dir),
> +		__pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir));
>   }
>   
>   /*
> 

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2018-06-01  9:47 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-01  8:09 [PATCH 4/4] arm64/mm: migrate swapper_pg_dir and tramp_pg_dir Jun Yao
2018-06-01  9:47 ` Robin Murphy

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).