linux-kernel - Re: [PATCH] arm/xen: Enable user access to the kernel before issuing a privcmd call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150911152034.GT21084@n2100.arm.linux.org.uk>
Date:	Fri, 11 Sep 2015 16:20:34 +0100
From:	Russell King - ARM Linux <linux@....linux.org.uk>
To:	Julien Grall <julien.grall@...rix.com>
Cc:	Ian Campbell <ian.campbell@...rix.com>,
	xen-devel@...ts.xenproject.org,
	linux-arm-kernel@...ts.infradead.org,
	stefano.stabellini@...citrix.com, linux-kernel@...r.kernel.org,
	Riku Voipio <riku.voipio@...aro.org>
Subject: Re: [PATCH] arm/xen: Enable user access to the kernel before issuing
 a privcmd call

On Fri, Sep 11, 2015 at 03:45:29PM +0100, Julien Grall wrote:
> Looking to the uaccess_save macro:
> 
>         .macro  uaccess_save, tmp
> #ifdef CONFIG_CPU_SW_DOMAIN_PAN
>         mrc     p15, 0, \tmp, c3, c0, 0
>         str     \tmp, [sp, #S_FRAME_SIZE]
> #endif
>         .endm
> 
> 
> It's saving the register on the Stack with an offset S_FRAME_SIZE.
> AFAICT, S_FRAME_SIZE is the size of the pt_regs structure.

While in the kernel, the uaccess state will be disabled except for the
specific sites reading or writing userspace.  That means the user-access
part of the DACR is well known.

What isn't known is whether we're executing here in the kernel segment
(set_fs(get_ds())) or not - which allows the kernel to use the userspace
accessors to safely read from its own memory space.

If we can assume that's not in effect, then the DACR value is fully
known at this point, and you can just do a:

	uaccess_enable rtmp
	HVC call
	uaccess_disable rtmp

where rtmp is a register you can afford to be changed by the macro.
I suspect 'ip' would be a good choice there.

Please put the macros as close to __HVC(XEN_IMM) as possible.

Thanks.

-- 
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/