linux-kernel - Improper TTBCR for arm 32bit kernel decompression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 09 Sep 2016 22:04:05 +0530
From:   Srinivas Ramana <sramana@...eaurora.org>
To:     linux@...linux.org.uk, will.deacon@....com,
        nicolas.pitre@...aro.org
CC:     linux-arm-msm@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Improper TTBCR for arm 32bit kernel decompression

Hello,

While trying to boot arm-32 bit kernel, I came across a problem where 
TTBCR is in improper state. If the bootloader uses the long descriptor 
format and jumps to kernel decompressor code, TTBCR may not be in the 
right state. So, as soon as the MMU is enabled, execution can not 
proceed further.

Before enabling the MMU, it is required to clear the TTBCR.PD0 field to 
use TTBR0 for translation table walks. Also, TTBCR.N should be reset to 
'0' to indicate the correct base address width. The 'commit 
dbece45894d3a ("ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 
cores")' does the reset of TTBCR.N, but doesn't consider all the bits 
for the size of TTBCR.N.

when i tried the below change where i explicitly clear TTBCR.PD0 and use 
correct mask for TTBCR.N, I see proper memory after MMU is enabled and 
decompression succeeds.

Request your comments on the change below. If it looks good, I can 
submit a patch for inclusion.

---------------------8<----------------------------------
diff --git a/arch/arm/boot/compressed/head.S 
b/arch/arm/boot/compressed/head.S
index af11c2f..5769f1f 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -779,7 +779,8 @@ __armv7_mmu_cache_on:
                 orrne   r0, r0, #1              @ MMU enabled
                 movne   r1, #0xfffffffd         @ domain 0 = client
                 bic     r6, r6, #1 << 31        @ 32-bit translation system
-               bic     r6, r6, #3 << 0         @ use only ttbr0
+               bic     r6, r6, #7 << 0         @ width of base address 
field
+               bic     r6, r6, #1 << 4         @ use only ttbr0
                 mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
                 mcrne   p15, 0, r1, c3, c0, 0   @ load domain access 
control
                 mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
---------------------8<----------------------------------

Thanks,
-- Srinivas R

-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, 
Inc., is a member of Code Aurora Forum, a Linux Foundation Collaborative 
Project.