Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bbm #36

Merged
merged 6 commits into from Oct 24, 2023
Merged

Bbm #36

merged 6 commits into from Oct 24, 2023

Conversation

ardbiesheuvel
Copy link
Collaborator

Implement some checks to ensure that map_range / modify_range do not violate BBM constraints

src/paging.rs Show resolved Hide resolved
src/lib.rs Show resolved Hide resolved
walk_range() will be used internally for BBM checks, and this requires
that the region passed into the callback represents that actual passed
region, without rounding.
src/idmap.rs Outdated Show resolved Hide resolved
src/idmap.rs Show resolved Hide resolved
src/paging.rs Outdated Show resolved Hide resolved
src/paging.rs Outdated
/// Block mappings are not permitted, only page mappings
const NO_BLOCK_MAPPINGS = 1 << 0;
/// Use of the contiguous bit is not permitted
const NO_CONTIGUOUS_MAPPINGS = 1 << 1;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where is this used?

src/lib.rs Outdated Show resolved Hide resolved
Expose the mapping activate/deactive methods for all target
architectures, and just mock it up for non-aarch64 by storing some
arbitrary value in previous_ttbr.

This will allow us to create test cases for page table updates that are
not permitted while the translation is live.
Currently, map_range() accepts the TABLE_OR_PAGE attribute as a flag,
and happily sets it on what it assumes to be block mappings, even though
setting the bit results in the descriptors in question to be interpreted
as table descriptors, turning the output address into a dangling
pointer.

So reject this attribute.
Copy link
Collaborator

@qwandor qwandor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good apart from a minor issue with the examples.

src/idmap.rs Outdated
/// use aarch64_paging::{
/// idmap::IdMap,
/// paging::{Attributes, MemoryRegion},
/// paging::{Attributes, Constraints, MemoryRegion},
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like Constraints is unused in this example now.

src/lib.rs Outdated
//! # #[cfg(feature = "alloc")] {
//! use aarch64_paging::{
//! idmap::IdMap,
//! paging::{Attributes, MemoryRegion},
//! paging::{Attributes, Constraints, MemoryRegion},
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto, the example doesn't use Constraints.

Add a constraints argument to the map_range() API and use it to
implement a NO_BLOCK_MAPPINGS constraint which ensures that all created
mappings are mapped down to pages.

Also add a NO_CONTIGUOUS_HINT flag for future use - we don't actually
ever set that bit so currently there is no need to test for it yet.
The AArch64 architecture is finicky when it comes to changing live page
tables, and there are elaborate rules to follow wrt whether an update
needs to go via an invalid mapping (break) before creating the new valid
mapping (make)

Let's add some checks for this:
- refuse to split live block entries into table entries
- refuse to change the output address
- refuse changes to the memory type or clearing the non-global bit
@ardbiesheuvel ardbiesheuvel merged commit 4839fcc into google:main Oct 24, 2023
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants