linux-kernel - [Provisional Page Table] Why the linear address ranges starting both from 0 and PAGE_OFFSET are mapped to the same physical address range in the provisional page table?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 3 Dec 2011 00:35:31 +0800
From:	zhihua che <zhihua.che@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: [Provisional Page Table] Why the linear address ranges starting both
 from 0 and PAGE_OFFSET are mapped to the same physical address range in the
 provisional page table?

Hi, everyone
        I know that the kernel constructs a provisional page table in
head_32.S which maps the linear address ranges starting both from 0
and PAGE_OFFSET to the same physical address range.  My question is
why the linear address range starting from 0 needs to be mapped to the
same physical address range as the leaner address range starting from
PAGE_OFFSET does. I thought it's not necessary because the whole
kernel (the protected mode part) is linked to the VMA PAGE_OFFSET.
        But I found I was wrong. I'm writing a toy os which is also
linked to VMA PAGE_OFFSET and constructs a provisional page table as
the linux kernel does, and it works well with it. I mean it can enable
paging successfully and continue to execute as I expect after that
far-jump instruction. However, if I mapped only the linear address
starting from 0xc0000000, the far-jump instructions would load random
values to cs and eip respectfully and my os went crazy.
        Here are the relating codes which are actually the same as the
linux kernel (32bit and disable the PAE)

page_pde_offset = (__PAGE_OFFSET >> 20);

         movl $pa(__brk_base), %edi
         movl $pa(initial_page_table), %edx
         movl $PTE_IDENT_ATTR, %eax
1:
         leal PDE_IDENT_ATTR(%edi),%ecx
         movl %ecx,(%edx)                                        /*
Here, here */
         movl %ecx,page_pde_offset(%edx)
         addl $4,%edx
         movl $1024, %ecx
2:
         stosl
         addl $0x1000,%eax
         loop 2b

         . . .

         ljmp $__BOOT_CS, $1f
1:

Precisely, my kernel goes well if the labeled line is kept while it
jumps to a nowhere place if the line is commented.
I can't figure out why because my kernel and linux kernel are both
linked with virtual address greater than PAGE_OFFSET.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/