@@ -27,6 +27,13 @@ config HAVE_IMA_KEXEC
config SET_FS
bool
+config ARCH_HAS_SUBPAGE_FAULTS
+ bool
+ help
+ Select if the architecture can check permissions at sub-page
+ granularity (e.g. arm64 MTE). The probe_user_*() functions
+ must be implemented.
+
config HOTPLUG_SMT
bool
@@ -910,6 +910,7 @@ void folio_add_wait_queue(struct folio *folio, wait_queue_entry_t *waiter);
* Fault in userspace address range.
*/
size_t fault_in_writeable(char __user *uaddr, size_t size);
+size_t fault_in_exact_writeable(char __user *uaddr, size_t size);
size_t fault_in_safe_writeable(const char __user *uaddr, size_t size);
size_t fault_in_readable(const char __user *uaddr, size_t size);
@@ -271,6 +271,27 @@ static inline bool pagefault_disabled(void)
*/
#define faulthandler_disabled() (pagefault_disabled() || in_atomic())
+#ifndef CONFIG_ARCH_HAS_SUBPAGE_FAULTS
+/**
+ * probe_user_writable: probe for sub-page faults in the user range
+ * @uaddr: start of address range
+ * @size: size of address range
+ *
+ * Returns the number of bytes not accessible (like copy_to_user() and
+ * copy_from_user()).
+ *
+ * Architectures that can generate sub-page faults (e.g. arm64 MTE) should
+ * implement this function. It is expected that the caller checked for the
+ * write permission of each page in the range either by put_user() or GUP.
+ * The architecture port can implement a more efficient get_user() probing of
+ * the range if sub-page faults are triggered by either a load or store.
+ */
+static inline size_t probe_user_writable(void __user *uaddr, size_t size)
+{
+ return 0;
+}
+#endif
+
#ifndef ARCH_HAS_NOCACHE_UACCESS
static inline __must_check unsigned long
@@ -1693,6 +1693,25 @@ size_t fault_in_writeable(char __user *uaddr, size_t size)
}
EXPORT_SYMBOL(fault_in_writeable);
+/**
+ * fault_in_exact_writeable - fault in userspace address range for writing,
+ * potentially checking for sub-page faults
+ * @uaddr: start of address range
+ * @size: size of address range
+ *
+ * Returns the number of bytes not faulted in (like copy_to_user() and
+ * copy_from_user()).
+ */
+size_t fault_in_exact_writeable(char __user *uaddr, size_t size)
+{
+ size_t accessible = size - fault_in_writeable(uaddr, size);
+
+ if (accessible)
+ accessible -= probe_user_writable(uaddr, accessible);
+ return size - accessible;
+}
+EXPORT_SYMBOL(fault_in_exact_writeable);
+
/*
* fault_in_safe_writeable - fault in an address range for writing
* @uaddr: start of address range
On hardware with features like arm64 MTE or SPARC ADI, an access fault can be triggered at sub-page granularity. Depending on how the fault_in_*() functions are used, the caller can get into a live-lock by continuously retrying the fault-in on an address different from the one where the uaccess failed. In the majority of cases progress is ensured by the following conditions: 1. copy_{to,from}_user() guarantees at least one byte access if the user address is not faulting; 2. The fault_in_*() is attempted on the next address that could not be accessed by copy_*_user(). In the places where the above conditions are not met or the fault-in/uaccess loop does not have a mechanism to bail out, the fault_in_exact_writeable() ensures that the arch code will probe the range in question at a sub-page fault granularity (e.g. 16 bytes for arm64 MTE). For large ranges, this is significantly more expensive than the non-exact versions which probe a single byte in each page or use GUP. The architecture code has to select ARCH_HAS_SUBPAGE_FAULTS and implement probe_user_writeable(). Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> --- arch/Kconfig | 7 +++++++ include/linux/pagemap.h | 1 + include/linux/uaccess.h | 21 +++++++++++++++++++++ mm/gup.c | 19 +++++++++++++++++++ 4 files changed, 48 insertions(+)