[PATCH v1 4/4] arm64: mm: Allow can_set_direct_map() on BBML3 systems

From: Vincent Donnefort

Date: Fri Sep 18 2026 - 09:28:41 EST


On BBML3 systems, block mappings in the linear map can be split
dynamically at runtime without break-before-make faults. In such
systems, allow can_set_direct_map() to enable set_direct_map_* users.

split_kernel_leaf_mapping() must now allow splitting for BBML3 systems
where no feature requires a split (i.e. !linear_map_needs_set()). As a
consequence, it can't solely rely on linear_map_requires_bbml3 anymore.
Instead, deduce force_pte_mapping() value and filter out non-lm
addresses.

Signed-off-by: Vincent Donnefort <vdonnefort@xxxxxxxxxx>
---
arch/arm64/mm/mmu.c | 24 +++++++++++++++---------
arch/arm64/mm/pageattr.c | 2 +-
2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index c18ed601f0a8..4c345065d33f 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -811,24 +811,30 @@ static bool linear_map_requires_bbml3;

int split_kernel_leaf_mapping(unsigned long start, unsigned long end)
{
+ bool force_pte;
int ret;

/*
* If the region is within a pte-mapped area, there is no need to try to
- * split. Additionally, CONFIG_DEBUG_PAGEALLOC and CONFIG_KFENCE may
- * change permissions from atomic context so for those cases (which are
- * always pte-mapped), we must not go any further because taking the
- * mutex below may sleep. Do not call force_pte_mapping() here because
- * it could return a confusing result if called from a secondary cpu
- * prior to finalizing caps. Instead, linear_map_requires_bbml3 gives us
- * what we need.
+ * split:
+ *
+ * Do not call force_pte_mapping() here because it could return a
+ * confusing result if called from a secondary cpu prior to finalizing
+ * caps. Instead, retrieve that value with linear_map_requires_bbml3.
+ *
+ * Additionally, CONFIG_KFENCE may change permissions from atomic
+ * context so for this case (which is always pte-mapped), we must not go
+ * any further because taking the mutex below may sleep.
+ *
+ * Finally, set_memory_* can be called on PTE-mapped vmalloc mappings.
*/
- if (!linear_map_requires_bbml3 || is_kfence_address((void *)start))
+ force_pte = !linear_map_requires_bbml3 && linear_map_needs_set();
+ if (force_pte || is_kfence_address((void *)start) || !__is_lm_address(__tag_reset(start)))
return 0;

if (!system_supports_bbml3()) {
/*
- * BBML3 systems should not be trying to change
+ * Non-BBML3 systems should not be trying to change
* permissions on anything that is not pte-mapped in the first
* place. Just return early and let the permission change code
* raise a warning if not already pte-mapped.
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index c1ba74eb602f..f952cc125705 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -89,7 +89,7 @@ bool rodata_full __ro_after_init = true;

bool can_set_direct_map(void)
{
- return linear_map_needs_set();
+ return linear_map_needs_set() || system_supports_bbml3();
}

static int update_range_prot(unsigned long start, unsigned long size,
--
2.55.0.1082.g2b9226bbc0-goog