linux-kernel - [PATCH] arm: LPAE: kexec: clear TTBCR.T1SZ explicitly when PHYS_OFFSET > PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1496654569-4749-1-git-send-email-hoeun.ryu@gmail.com>
Date:   Mon,  5 Jun 2017 18:22:20 +0900
From:   Hoeun Ryu <hoeun.ryu@...il.com>
To:     Russell King <linux@...linux.org.uk>
Cc:     Hoeun Ryu <hoeun.ryu@...il.com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH] arm: LPAE: kexec: clear TTBCR.T1SZ explicitly when PHYS_OFFSET > PAGE_OFFSET

 Clearing TTBCR.T1SZ explicitly when kernel runs on a configuration of
PHYS_OFFSET > PAGE_OFFSET.
 Reading TTBCR in early boot stage might returns the value of the
previous kernel's configuration, especially in case of kexec. For
example, if normal kernel (first kernel) had run on a configuration
of PHYS_OFFSET <= PAGE_OFFSET and crash kernel (second kernel) is
running on a configuration PHYS_OFFSET > PAGE_OFFSET, which can happen
because it depends on the reserved area for crash kernel, reading
TTBCR and using the value without clearing TTBCR.T1SZ might risky
because the value doesn't have a reset value for TTBCR.T1SZ.

Signed-off-by: Hoeun Ryu <hoeun.ryu@...il.com>
---
 arch/arm/mm/proc-v7-3level.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index 5e5720e..9ac2bec 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -140,6 +140,7 @@ ENDPROC(cpu_v7_set_pte_ext)
 	 * otherwise booting secondary CPUs would end up using TTBR1 for the
 	 * identity mapping set up in TTBR0.
 	 */
+	bichi	\tmp, \tmp, #(1 << 16)				@ clear TTBCR.T1SZ
 	orrls	\tmp, \tmp, #TTBR1_SIZE				@ TTBCR.T1SZ
 	mcr	p15, 0, \tmp, c2, c0, 2				@ TTBCR
 	mov	\tmp, \ttbr1, lsr #20
-- 
2.7.4