Prevent overmapping on aarch32, aarch64, x86 #1526

Kswin01 · 2025-10-20T04:55:51Z

This is continuing the work as outlined in PR #967. The original branch has been rebased, and merge issues resolved related to the aarch64 page tables refactor.

Test with: seL4/sel4test#148

Signed-off-by: Alwin Joshy <[email protected]>

Signed-off-by: Krishnan Winter <[email protected]>

Indanz

I'm not convinced that we need is_remap and think it should be enough to check the page table entry we want to update for an existing valid mapping. Removing is_remap would reduce the diff a fair bit. The whole point of this is to prevent remapping, so when would is_remap be true and allowed?

Conceptually, all that is needed to prevent overmapping is one extra check on the destination PTE to see if the slot is free or already used.

lsf37 · 2025-10-20T21:16:01Z

This still needs at least a TSC discussion if not an RFC. It breaks the API for systems that currently use overmapping.

Just because the RISC-V implementation follows the manual does not mean that the manual was correct. The ARM and x86 implementations both predate RISC-V and we have fixed so many misunderstandings in both the RISC-V implementation and in the manual over the years that it is absolutely open what the actual intention should be. Currently, it's just inconsistent and we should consciously decide what we want.

There is also still the question of whether anything should be done at all to the code. The manual can just state what the correct behaviour is for each architecture. There is no actual requirement for them to be the same even if consistency is generally preferable -- the question is who is going to come up with the funding for the verification of this change, it's too large to just do on the side.

Kswin01 · 2025-10-21T02:36:42Z

This still needs at least a TSC discussion if not an RFC. It breaks the API for systems that currently use overmapping.

I'm in the process of writing an RFC up for this change, and will make a PR to the rfc repo for that soon.

I'm not convinced that we need is_remap

~~I agree, I removed that on aarch64. The is_remap is a remnant of the original PR that this is based on, and I'll remove this for other platforms.~~ Nevermind, is_remap seems to be necessary on other platforms due to the the structure of creating mappings (having different functions for different size pages).

The whole point of this is to prevent remapping, so when would is_remap be true and allowed?

My understanding of remap is that it essentially allows a permissions update, so if the supplied frame cap is mapped into the current address space, and doesn't exist in a different mapping within it, then we allow a remap of it (with potentially new permissions). This PR prevents overmapping, which is when we are attempting to over-write an existing mapping with an unmapped frame. So if re-map is true, then the check for over-mapping should be ignored (I believe that was the original intention behind Alwin's original PR).

Indanz

So really, the changes can be limited to just an extra check per mapping invocation that checks the info in the current page table entry for presence and current physical address. It's just unfortunate that on some archs this requires a check per page type.

Indanz · 2025-10-21T10:23:24Z

src/arch/arm/32/kernel/vspace.c

+#ifndef CONFIG_ARM_HYPERVISOR_SUPPORT
+        if (pte_ptr_get_pteType(ret.pte_entries.base) == pte_pte_large) {
+#else
+        if (pte_ptr_get_pteType(ret.pte_entries.base) == pte_pte_small) {


is this missing && pte_pte_small_ptr_get_contiguous_hint(ret.pte_entries.base)))?

Indanz · 2025-10-21T10:24:37Z

src/arch/arm/32/kernel/vspace.c

+            if (!is_remap) {
+                userError("Virtual address (0x%"SEL4_PRIx_word") already mapped", vaddr);
+                current_syscall_error.type = seL4_DeleteFirst;
+                ret.status = EXCEPTION_SYSCALL_ERROR;


This is repeated so often, what about putting it in a separate function?

Indanz · 2025-10-21T10:26:35Z

src/arch/arm/32/kernel/vspace.c

+        frame_asid = generic_frame_cap_get_capFMappedASID(cap);

        if (generic_frame_cap_get_capFIsMapped(cap)) {
-            if (generic_frame_cap_get_capFMappedASID(cap) != asid) {
+            if (frame_asid != asid) {


Perhaps nicer, but you're not re-using frame_asid, so this change is unnecessary.

Indanz · 2025-10-21T10:29:10Z

src/arch/arm/32/kernel/vspace.c

                return EXCEPTION_SYSCALL_ERROR;
            }
+
+            is_remap = false;


You only need to set this once at the start of the if (generic_frame_cap_get_capFIsMapped(cap)) block.

Indanz · 2025-10-21T10:30:27Z

src/arch/arm/64/kernel/vspace.c

-            } else if (cap_frame_cap_get_capFMappedAddress(cap) != vaddr) {
+            }
+
+            /* The invoked frame cap is already mapped to a different address in this vspace  */
+            if (cap_frame_cap_get_capFMappedAddress(cap) != vaddr) {


No actual logical change here, just looks like it because the comment was wedged in.

Indanz · 2025-10-21T10:37:13Z

src/arch/x86/64/kernel/vspace.c


 exception_t decodeX86ModeMapPage(word_t label, vm_page_size_t page_size, cte_t *cte, cap_t cap,
-                                 vspace_root_t *vroot, vptr_t vaddr, paddr_t paddr, vm_rights_t vm_rights, vm_attributes_t vm_attr)
+                                 vspace_root_t *vroot, vptr_t vaddr, paddr_t paddr, vm_rights_t vm_rights, vm_attributes_t vm_attr, asid_t frame_asid)


Isn't that supposed to be an is_remap? Where did frame_asid come from?

Indanz · 2025-10-21T10:38:08Z

src/arch/x86/64/kernel/vspace.c

 static create_mapping_pdpte_return_t createSafeMappingEntries_PDPTE(paddr_t base, word_t vaddr, vm_rights_t vmRights,
                                                                    vm_attributes_t attr,
-                                                                    vspace_root_t *vspace)
+                                                                    vspace_root_t *vspace, asid_t frame_asid)


This seems to be actually is_remap, see other comment.

Indanz · 2025-10-21T10:39:45Z

src/arch/x86/64/kernel/vspace.c


+    /* Check that we are not overwriting an existing mapping */
+    if (pdpte_ptr_get_page_size(ret.pdptSlot) == pdpte_pdpte_1g) {
+        if (pdpte_pdpte_1g_ptr_get_present(ret.pdptSlot) && frame_asid == asidInvalid) {


Probably:

Suggested change

if (pdpte_pdpte_1g_ptr_get_present(ret.pdptSlot) && frame_asid == asidInvalid) {

if (pdpte_pdpte_1g_ptr_get_present(ret.pdptSlot) && !is_remap) {

alwin-joshy added 2 commits October 20, 2025 12:11

Prevent overmapping on aarch32, aarch64, x86

5e0ac72

Signed-off-by: Alwin Joshy <[email protected]>

Improved clarity of existing mapping checks

c312c60

Signed-off-by: Alwin Joshy <[email protected]>

Kswin01 force-pushed the prevent_overmap branch from a5d907e to 70bcc54 Compare October 20, 2025 05:02

Kswin01 added 2 commits October 20, 2025 16:05

vspace: fix old PT references before refactor

1f157dc

Signed-off-by: Krishnan Winter <[email protected]>

vspace: update error printing for overmap

4a31f6a

Signed-off-by: Krishnan Winter <[email protected]>

Kswin01 force-pushed the prevent_overmap branch from 70bcc54 to 4a31f6a Compare October 20, 2025 05:06

midnightveil added hw-test sel4test hardware builds + runs for this PR and removed hw-test sel4test hardware builds + runs for this PR labels Oct 20, 2025

Indanz reviewed Oct 20, 2025

View reviewed changes

lsf37 added the verification Needs formal verification input/change, or is motivated by verification label Oct 20, 2025

This was referenced Oct 21, 2025

RFC-21: Unify behaviour of the Page Map invocation seL4/rfcs#34

Open

Tests for overmapping, and fixes for aarch32 PT tests seL4/sel4test#148

Draft

Indanz reviewed Oct 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Prevent overmapping on aarch32, aarch64, x86 #1526

Prevent overmapping on aarch32, aarch64, x86 #1526

Kswin01 commented Oct 20, 2025 •

edited

Loading

Uh oh!

Indanz left a comment

Uh oh!

lsf37 commented Oct 20, 2025

Uh oh!

Kswin01 commented Oct 21, 2025 •

edited

Loading

Uh oh!

Indanz left a comment

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Indanz Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	if (pdpte_pdpte_1g_ptr_get_present(ret.pdptSlot) && frame_asid == asidInvalid) {
	if (pdpte_pdpte_1g_ptr_get_present(ret.pdptSlot) && !is_remap) {

Prevent overmapping on aarch32, aarch64, x86 #1526

Are you sure you want to change the base?

Prevent overmapping on aarch32, aarch64, x86 #1526

Conversation

Kswin01 commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Indanz left a comment

Choose a reason for hiding this comment

Uh oh!

lsf37 commented Oct 20, 2025

Uh oh!

Kswin01 commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Indanz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Kswin01 commented Oct 20, 2025 •

edited

Loading

Kswin01 commented Oct 21, 2025 •

edited

Loading