Commit 50e1881d authored by Mark Rutland's avatar Mark Rutland Committed by Catalin Marinas

arm64: mm: add code to safely replace TTBR1_EL1

If page tables are modified without suitable TLB maintenance, the ARM
architecture permits multiple TLB entries to be allocated for the same
VA. When this occurs, it is permitted that TLB conflict aborts are
raised in response to synchronous data/instruction accesses, and/or and
amalgamation of the TLB entries may be used as a result of a TLB lookup.

The presence of conflicting TLB entries may result in a variety of
behaviours detrimental to the system (e.g. erroneous physical addresses
may be used by I-cache fetches and/or page table walks). Some of these
cases may result in unexpected changes of hardware state, and/or result
in the (asynchronous) delivery of SError.

To avoid these issues, we must avoid situations where conflicting
entries may be allocated into TLBs. For user and module mappings we can
follow a strict break-before-make approach, but this cannot work for
modifications to the swapper page tables that cover the kernel text and
data.

Instead, this patch adds code which is intended to be executed from the
idmap, which can safely unmap the swapper page tables as it only
requires the idmap to be active. This enables us to uninstall the active
TTBR1_EL1 entry, invalidate TLBs, then install a new TTBR1_EL1 entry
without potentially unmapping code or data required for the sequence.
This avoids the risk of conflict, but requires that updates are staged
in a copy of the swapper page tables prior to being installed.
Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
Reviewed-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Tested-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: default avatarJeremy Linton <jeremy.linton@arm.com>
Cc: Laura Abbott <labbott@fedoraproject.org>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 609116d2
...@@ -126,6 +126,25 @@ static inline void cpu_install_idmap(void) ...@@ -126,6 +126,25 @@ static inline void cpu_install_idmap(void)
cpu_switch_mm(idmap_pg_dir, &init_mm); cpu_switch_mm(idmap_pg_dir, &init_mm);
} }
/*
* Atomically replaces the active TTBR1_EL1 PGD with a new VA-compatible PGD,
* avoiding the possibility of conflicting TLB entries being allocated.
*/
static inline void cpu_replace_ttbr1(pgd_t *pgd)
{
typedef void (ttbr_replace_func)(phys_addr_t);
extern ttbr_replace_func idmap_cpu_replace_ttbr1;
ttbr_replace_func *replace_phys;
phys_addr_t pgd_phys = virt_to_phys(pgd);
replace_phys = (void *)virt_to_phys(idmap_cpu_replace_ttbr1);
cpu_install_idmap();
replace_phys(pgd_phys);
cpu_uninstall_idmap();
}
/* /*
* It would be nice to return ASIDs back to the allocator, but unfortunately * It would be nice to return ASIDs back to the allocator, but unfortunately
* that introduces a race with a generation rollover where we could erroneously * that introduces a race with a generation rollover where we could erroneously
......
...@@ -140,6 +140,34 @@ ENTRY(cpu_do_switch_mm) ...@@ -140,6 +140,34 @@ ENTRY(cpu_do_switch_mm)
ret ret
ENDPROC(cpu_do_switch_mm) ENDPROC(cpu_do_switch_mm)
.pushsection ".idmap.text", "ax"
/*
* void idmap_cpu_replace_ttbr1(phys_addr_t new_pgd)
*
* This is the low-level counterpart to cpu_replace_ttbr1, and should not be
* called by anything else. It can only be executed from a TTBR0 mapping.
*/
ENTRY(idmap_cpu_replace_ttbr1)
mrs x2, daif
msr daifset, #0xf
adrp x1, empty_zero_page
msr ttbr1_el1, x1
isb
tlbi vmalle1
dsb nsh
isb
msr ttbr1_el1, x0
isb
msr daif, x2
ret
ENDPROC(idmap_cpu_replace_ttbr1)
.popsection
/* /*
* __cpu_setup * __cpu_setup
* *
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment