From patchwork Thu Oct 25 14:16:27 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 149538 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp1420073ljp; Thu, 25 Oct 2018 07:34:24 -0700 (PDT) X-Google-Smtp-Source: AJdET5cYziNxvE2KWATppU+5DYsYQL+vAPgqioLel0SbYHbmrVBA1cbmG+VKsbnus1pPaDMJ8nHY X-Received: by 2002:a62:9c8c:: with SMTP id u12-v6mr1808951pfk.162.1540478064376; Thu, 25 Oct 2018 07:34:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540478064; cv=none; d=google.com; s=arc-20160816; b=E50GamIkBsvrheWCCKEB9GOY3ymktluCohSbyUtENJmItyckEsTmpAmUpvPv0/2FF2 TO3uKCd0ebjkg4CxKlwLIWpTQys9RCo0vmhVgCtEn5jjC+ocXvtm9G8enfs8XGNtPrSY RIPkOUz6rOnoy2piXN1ADV0UJPeVhQ6bt0uMtHyCQMtnslHrBsyWANwI6ptRTc0jW92F kHHxuskfuJMzJ3JJbKVb/PQyA/03jM3Rz849kC0suKsbl/qVQMdjM4TuQrKVRV+JdBqL FCLoS23Au6BYiWdNykXFIAl7UfodOkyGhR6n12ic0poij8R5lA4beI7diRWJl5w4D9yS Yyvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=A0IySBGyqOfun0Ib8g24MS3A7JNcsiERhhKom1awTA0=; b=VdfyQD4rkXOVTLB38X3ssWHm8zHhYs0aFD5ATlidE0jM9Rd1bpf/eo0cfJ+YLom3ZY WZL/oWHii54hyrqewJx3w+tASeTxLQkQABmpbjNP9D2ddFLBx3+zipmWeqgulqLOJLCq OlGVrMBQMBWDbtUqIomYZ1nlPlFV8eFRpHowiZso8MguXQ37Ya0hFWXlOgMRnXsx3tIS 95MGDd31XUfjiEC5XJfu+C/moqVSTaAHPKjDqj87ItjV/mmo7hXkOl12OcHufXOlR7mz uLZkwt2E+KZKugWsJ+akb4iWfNMSgPbidUNA8qG5LYa06BRdCn+2FIh2rvf4OGK+XoCw qewQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=oZB8VX8x; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i25-v6si8347639pgi.426.2018.10.25.07.34.23; Thu, 25 Oct 2018 07:34:24 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=oZB8VX8x; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727589AbeJYXHY (ORCPT + 32 others); Thu, 25 Oct 2018 19:07:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:60490 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729798AbeJYWuu (ORCPT ); Thu, 25 Oct 2018 18:50:50 -0400 Received: from sasha-vm.mshome.net (unknown [167.98.65.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C281B20834; Thu, 25 Oct 2018 14:17:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1540477072; bh=thc59NMAMwXEsx9J8JNhHe9ww4h2Y09XGKraxAOjITU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oZB8VX8xt9DJPyI13c/18OE3KIZm1kwVR1ZI545JKJcSMKhBT42av/eJamY3MKGcy UeCpgB5zaIPjOOxAUVtDYW9mTBv68S9UcsfF8saApgkgrZQa7SgQzzJEb1x2I1uEKR RliYyxPj9yq52oAJOXeCltrvrw3UgJ/lC5Ttx7b8= From: Sasha Levin To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH AUTOSEL 4.4 27/65] arm64: Fix potential race with hardware DBM in ptep_set_access_flags() Date: Thu, 25 Oct 2018 10:16:27 -0400 Message-Id: <20181025141705.213937-27-sashal@kernel.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181025141705.213937-1-sashal@kernel.org> References: <20181025141705.213937-1-sashal@kernel.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Catalin Marinas [ Upstream commit 6d332747fa5f0a6843b56b5b129168ba909336d1 ] In a system with DBM (dirty bit management) capable agents there is a possible race between a CPU executing ptep_set_access_flags() (maybe non-DBM capable) and a hardware update of the dirty state (clearing of PTE_RDONLY). The scenario: a) the pte is writable (PTE_WRITE set), clean (PTE_RDONLY set) and old (PTE_AF clear) b) ptep_set_access_flags() is called as a result of a read access and it needs to set the pte to writable, clean and young (PTE_AF set) c) a DBM-capable agent, as a result of a different write access, is marking the entry as young (setting PTE_AF) and dirty (clearing PTE_RDONLY) The current ptep_set_access_flags() implementation would set the PTE_RDONLY bit in the resulting value overriding the DBM update and losing the dirty state. This patch fixes such race by setting PTE_RDONLY to the most permissive (lowest value) of the current entry and the new one. Fixes: 66dbd6e61a52 ("arm64: Implement ptep_set_access_flags() for hardware AF/DBM") Cc: Will Deacon Acked-by: Mark Rutland Acked-by: Steve Capper Signed-off-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Sasha Levin --- arch/arm64/mm/fault.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) -- 2.17.1 diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 86485415c5f0..be7f8416809f 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -107,26 +107,27 @@ int ptep_set_access_flags(struct vm_area_struct *vma, /* only preserve the access flags and write permission */ pte_val(entry) &= PTE_AF | PTE_WRITE | PTE_DIRTY; - /* - * PTE_RDONLY is cleared by default in the asm below, so set it in - * back if necessary (read-only or clean PTE). - */ + /* set PTE_RDONLY if actual read-only or clean PTE */ if (!pte_write(entry) || !pte_sw_dirty(entry)) pte_val(entry) |= PTE_RDONLY; /* * Setting the flags must be done atomically to avoid racing with the - * hardware update of the access/dirty state. + * hardware update of the access/dirty state. The PTE_RDONLY bit must + * be set to the most permissive (lowest value) of *ptep and entry + * (calculated as: a & b == ~(~a | ~b)). */ + pte_val(entry) ^= PTE_RDONLY; asm volatile("// ptep_set_access_flags\n" " prfm pstl1strm, %2\n" "1: ldxr %0, %2\n" - " and %0, %0, %3 // clear PTE_RDONLY\n" + " eor %0, %0, %3 // negate PTE_RDONLY in *ptep\n" " orr %0, %0, %4 // set flags\n" + " eor %0, %0, %3 // negate final PTE_RDONLY\n" " stxr %w1, %0, %2\n" " cbnz %w1, 1b\n" : "=&r" (old_pteval), "=&r" (tmp), "+Q" (pte_val(*ptep)) - : "L" (~PTE_RDONLY), "r" (pte_val(entry))); + : "L" (PTE_RDONLY), "r" (pte_val(entry))); flush_tlb_fix_spurious_fault(vma, address); return 1;