linux-kernel - [Provisional Page Table] Why the linear address ranges starting both from 0 and PAGE_OFFSET are mapped to a same physical address range in provisional page table?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 3 Dec 2011 01:14:55 +0800
From:	zhihua che <zhihua.che@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: [Provisional Page Table] Why the linear address ranges starting both
 from 0 and PAGE_OFFSET are mapped to a same physical address range in
 provisional page table?

Hi everyone
        I know that the linux kernel constructs a provisional page
table to map the linear address ranges starting both from 0 and
PAGE_OFFSET to a same physical address range. I thought it's not
necessary because the kernel, precisely the protected mode part, is
linked to the VMA PAGE_OFFSET.
        But i found I was wrong. I'm writing a toy os which is similar
with the linux kernel. it also constructs a provisional page table as
the linux kernel does. In the first place it works well with it. I
mean it can enable the paging successfully and execute as I expect
after that far-jump instruction. However, if the provisional page
table maps only the linear address range starting from PAGE_OFFSET, my
kernel would load the cs and eip with random values right after that
far-jump instruction and went crazy. By the way, my kernel is also
linked to VMA PAGE_OFFSET.
        Here are the relating codes. Obviously the are the same with
the linux kernel (32-bit and disable PAE)

page_pde_offset = (__PAGE_OFFSET >> 20);

        movl $pa(__brk_base), %edi
        movl $pa(initial_page_table), %edx
        movl $PTE_IDENT_ATTR, %eax
1:
        leal PDE_IDENT_ATTR(%edi),%ecx
        movl %ecx,(%edx)                                   /* this
special line */
        movl %ecx,page_pde_offset(%edx)
        addl $4,%edx
        movl $1024, %ecx
2:
        stosl
        addl $0x1000,%eax
        loop 2b

        . . .

        ljmp __BOOT_CS, 1f
1:

        Precisely,  my kernel goes well if the special line above is
kept while it could go crazy if the line is commented.
        I can't figure out why because my kernel and the linux are
both linked to a VMA equal with or greater than PAGE_OFFSET. The lower
linear addresses are not accessed at all.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/