linux-kernel - Re: [PATCH v3 11/20] arm64: mm: Map entry trampoline into trampoline and kernel page tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 23 Jan 2018 18:43:49 +0800
From:   Yisheng Xie <xieyisheng1@...wei.com>
To:     Will Deacon <will.deacon@....com>
CC:     <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>, <catalin.marinas@....com>,
        <mark.rutland@....com>, <ard.biesheuvel@...aro.org>,
        <sboyd@...eaurora.org>, <dave.hansen@...ux.intel.com>,
        <keescook@...omium.org>, <msalter@...hat.com>,
        <labbott@...hat.com>, <tglx@...utronix.de>
Subject: Re: [PATCH v3 11/20] arm64: mm: Map entry trampoline into trampoline
 and kernel page tables

Hi Will,

On 2018/1/23 18:04, Will Deacon wrote:
> On Tue, Jan 23, 2018 at 04:28:45PM +0800, Yisheng Xie wrote:
>> On 2017/12/6 20:35, Will Deacon wrote:
>>> +#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
>>> +static int __init map_entry_trampoline(void)
>>> +{
>>> +	extern char __entry_tramp_text_start[];
>>> +
>>> +	pgprot_t prot = rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC;
>>> +	phys_addr_t pa_start = __pa_symbol(__entry_tramp_text_start);
>>> +
>>> +	/* The trampoline is always mapped and can therefore be global */
>>> +	pgprot_val(prot) &= ~PTE_NG;
>>> +
>>> +	/* Map only the text into the trampoline page table */
>>> +	memset(tramp_pg_dir, 0, PGD_SIZE);
>>> +	__create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,
>>> +			     prot, pgd_pgtable_alloc, 0);
>>
>> How the tramp_pg_dir is used, should it be set to ttbr1 when exit kernel? Sorry
>> for I do not find where it is used.
> 
> Yes, that's what happens when we return to userspace. The code is a little
> convoluted, but the tramp_pg_dir is placed at a fixed offset from swapper
> (see the linker script) so the sub instruction in tramp_unmap_kernel is what
> gives us the ttbr1 value we need.

oh, I missed that. Maybe a comment inline is better to understand. Thanks once
more for your help and explain :)

Thanks
Yisheng
> 
> Will
> 
> .
>