Re: [PATCH v9 05/10] arm64: can_set_direct_map() if BBML3

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] can_set_direct_map() incorrectly evaluates to false during early boot on BBML3 systems due to unfinalized capabilities, permanently disabling runtime direct map splitting.
--

commit 145c29bbbc659d3113b49c46e076c4a0f62f5e20
Author: Vincent Donnefort <vdonnefort@google.com>

arm64: can_set_direct_map() if BBML3

Systems supporting BBML3 can split blocks without risking unhandled
page-faults. This commit allows setting the direct map unconditionally
for these systems.

> diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
> index bbe98ac9ad8c6..58898ae53f5d1 100644
> --- a/arch/arm64/mm/pageattr.c
> +++ b/arch/arm64/mm/pageattr.c
> @@ -99,7 +99,8 @@ bool can_set_direct_map(void)
>  	 * Realms need to make pages shared/protected at page granularity.
>  	 */
>  	return rodata_full || debug_pagealloc_enabled() ||
> -		arm64_kfence_can_set_direct_map() || is_realm_world();
> +		arm64_kfence_can_set_direct_map() || is_realm_world() ||
> +		system_supports_bbml3();
>  }

[Severity: High]
Does system_supports_bbml3() evaluate to false unconditionally during early
boot when CPU alternatives are not yet finalized?

If so, does this break direct map splitting at runtime? When map_mem() in
arch/arm64/mm/mmu.c is called during boot, it statically initializes
linear_map_requires_bbml3 based on can_set_direct_map(). Since CPU
alternatives are unpatched early on, linear_map_requires_bbml3 is permanently
cached as false.

Later, when direct map modifications are requested at runtime (e.g. by
secretmem), split_kernel_leaf_mapping() in arch/arm64/mm/mmu.c bypasses
block splitting because the static flag was evaluated early and cached as
false.

This leads update_range_prot() to attempt a lockless walk and modify the
block mapping, causing a block size mismatch warning and failing with
-EINVAL. Is there a way to evaluate this dynamically or ensure capabilities
are finalized before caching?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902104712.2399797-1-vdonnefort@google.com?part=5