]> www.infradead.org Git - users/jedix/linux-maple.git/commit
arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong...
authorYeoreum Yun <yeoreum.yun@arm.com>
Fri, 2 May 2025 18:04:12 +0000 (19:04 +0100)
committerCatalin Marinas <catalin.marinas@arm.com>
Tue, 6 May 2025 10:43:44 +0000 (11:43 +0100)
commit363cd2b81cfdf706bbfc9ec78db000c9b1ecc552
tree8a90dd5eabfac8e0b264b9b464293c842a6b3376
parentfee4d171451c1ad9e8aaf65fc0ab7d143a33bd72
arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation

The PTE_MAYBE_NG macro sets the nG page table bit according to the value
of "arm64_use_ng_mappings". This variable is currently placed in the
.bss section. create_init_idmap() is called before the .bss section
initialisation which is done in early_map_kernel(). Therefore,
data/test_prot in create_init_idmap() could be set incorrectly through
the PAGE_KERNEL -> PROT_DEFAULT -> PTE_MAYBE_NG macros.

   # llvm-objdump-21 --syms vmlinux-gcc | grep arm64_use_ng_mappings
     ffff800082f242a8 g     O .bss    0000000000000001 arm64_use_ng_mappings

The create_init_idmap() function disassembly compiled with llvm-21:

  // create_init_idmap()
  ffff80008255c058d10103ff      sub sp, sp, #0x40
  ffff80008255c05ca9017bfd      stp x29, x30, [sp, #0x10]
  ffff80008255c060a90257f6      stp x22, x21, [sp, #0x20]
  ffff80008255c064a9034ff4      stp x20, x19, [sp, #0x30]
  ffff80008255c068910043fd      add x29, sp, #0x10
  ffff80008255c06c90003fc8      adrp x8, 0xffff800082d54000
  ffff80008255c070d280e06a      mov x10, #0x703     // =1795
  ffff80008255c07491400409      add x9, x0, #0x1, lsl #12 // =0x1000
  ffff80008255c078394a4108      ldrb w8, [x8, #0x290] ------------- (1)
  ffff80008255c07cf2e00d0a      movk x10, #0x68, lsl #48
  ffff80008255c080f90007e9      str x9, [sp, #0x8]
  ffff80008255c084aa0103f3      mov x19, x1
  ffff80008255c088aa0003f4      mov x20, x0
  ffff80008255c08c14000000      b 0xffff80008255c08c <__pi_create_init_idmap+0x34>
  ffff80008255c090aa082d56      orr x22, x10, x8, lsl #11 -------- (2)

Note (1) is loading the arm64_use_ng_mappings value in w8 and (2) is set
the text or data prot with the w8 value to set PTE_NG bit. If the .bss
section isn't initialized, x8 could include a garbage value and generate
an incorrect mapping.

Annotate arm64_use_ng_mappings as __read_mostly so that it is placed in
the .data section.

Fixes: 84b04d3e6bdb ("arm64: kernel: Create initial ID map from C code")
Cc: stable@vger.kernel.org # 6.9.x
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Link: https://lore.kernel.org/r/20250502180412.3774883-1-yeoreum.yun@arm.com
[catalin.marinas@arm.com: use __read_mostly instead of __ro_after_init]
[catalin.marinas@arm.com: slight tweaking of the code comment]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
arch/arm64/kernel/cpufeature.c