Hi Mark,
On Mon, Sep 24, 2018 at 06:19:36PM +0100, Mark Rutland wrote:
> Hi,
>
> On Mon, Sep 17, 2018 at 12:43:27PM +0800, Jun Yao wrote:
> > Version 5 changes:
> > 1. Correct spelling and indentation errors[1].
> > 2. Update init_mm.pgd by assembly[2].
>
Hi James,
On Fri, Sep 21, 2018 at 11:26:39PM +0100, James Morse wrote:
> Hi Jun,
>
> On 09/17/2018 05:43 AM, Jun Yao wrote:
> > Version 5 changes:
> > 1. Correct spelling and indentation errors[1].
> > 2. Update init_mm.pgd by assembly[2].
> > 3.
Move the idmap_pg_dir/tramp_pg_dir/reserved_ttbr0/swapper_pg_dir to
the rodata section. When the kernel is initialized, the
idmap_pg_dir, tramp_pg_dir and reserved_ttbr0 will not change. And
it's safe to move them to rodata section.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.
As the initial page table is created in the init_pg_dir, we can set
up the final page table directly in the swapper_pg_dir. And it only
contains the top level page table, so we can reduce it to a page
size.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 2 +-
arch/arm64/mm/mmu.c
init_pg_dir to vmlinux.lds.S and
boiler-plate clearing/cleaning/invalidating it in head.S.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/assembler.h | 29 +
arch/arm64/kernel/head.S | 22 +++---
arch/arm64/kernel/vmlinux.lds.S| 8
The kernel will set up the initial page table in the init_pg_dir.
However, it will create the final page table in the swapper_pg_dir
during the initialization process. We need to let __enable_mmu()
know which page table to use.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/head.S | 19
://www.spinics.net/lists/arm-kernel/msg675193.html
[3] https://www.spinics.net/lists/arm-kernel/msg675196.html
Jun Yao (6):
arm64/mm: Introduce the init_pg_dir.
arm64/mm: Pass ttbr1 as a parameter to __enable_mmu().
arm64/mm: Create the initial page table in the init_pg_dir.
arm64/mm: Create the final page
Attack).
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 38 ++--
arch/arm64/mm/mmu.c | 25 +++--
2 files changed, 54 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
Create the initial page table in the init_pg_dir. And update the
init_mm.pgd to make sure that pgd_offset_k() works correctly. When
the final page table is created, we redirect the init_mm.pgd to the
swapper_pg_dir.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 2 ++
arch/arm64
Hi James,
On Fri, Sep 07, 2018 at 10:58:22AM +0100, James Morse wrote:
> On 22/08/18 10:54, Jun Yao wrote:
> > WRITE_ONCE(*pmdp, pmd);
> > dsb(ishst);
> > }
> > @@ -480,6 +511,19 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
> >
> >
Hi James,
On Fri, Sep 07, 2018 at 10:58:22AM +0100, James Morse wrote:
> On 22/08/18 10:54, Jun Yao wrote:
> > WRITE_ONCE(*pmdp, pmd);
> > dsb(ishst);
> > }
> > @@ -480,6 +511,19 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
> >
> >
Attack).
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 68 ++--
arch/arm64/mm/mmu.c | 2 +
2 files changed, 59 insertions(+), 11 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 46ef21ebfe47
Move the idmap_pg_dir/tramp_pg_dir/reserved_ttbr0/swapper_pg_dir to
the rodata section. When the kernel is initialized, the
idmap_pg_dir, tramp_pg_dir and reserved_ttbr0 will not change. And
it's safe to move them to rodata section.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.
As the initial page table is created in the init_pg_dir, we can set
up the final page table directly in the swapper_pg_dir. And it only
contains the top level page table, so we can reduce it to a page
size.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 2 +-
arch/arm64/mm/mmu.c
.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 2 ++
arch/arm64/kernel/head.S | 9 ++---
arch/arm64/mm/mmu.c | 14 ++
3 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
The kernel sets up the initial page table in the init_pg_dir.
However, it will create the final page table in the swapper_pg_dir
during the initialization process. We need to let __enable_mmu()
know which page table to use.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/head.S | 21
To make the swapper_pg_dir read only, we will move it to the rodata
section. And force the kernel to set up the initial page table in
the init_pg_dir. After generating all levels page table, we copy
only the top level into the swapper_pg_dir during paging_init().
Signed-off-by: Jun Yao
---
arch
2. CONFIG_ARM64_4K_PAGES/CONFIG_ARM64_VA_BITS_39
3. CONFIG_ARM64_64K_PAGES/CONFIG_ARM64_VA_BITS_48
4. CONFIG_ARM64_64K_PAGES/CONFIG_ARM64_VA_BITS_42
Jun Yao (6):
arm64/mm: Introduce the init_pg_dir.
arm64/mm: Pass ttbr1 as a parameter to __enable_mmu().
arm64/mm: Create
Hi James,
On Fri, Jul 06, 2018 at 03:41:07PM +0100, James Morse wrote:
> I missed one: head.S has a call to kasan_early_init() before start_kernel(),
> this goes messing with the page tables, and calls pgd_offset_k(), which pulls
> in
> swapper_pg_dir. This one is enabled by CONFIG_KASAN.
>
> So
Create initial page tables in init_pg_dir and then create final
page tables in swapper_pg_dir directly.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 2 ++
arch/arm64/kernel/head.S | 9 ++---
arch/arm64/mm/mmu.c | 27 ---
3
To move swapper_pg_dir to .rodata section, we populate it by
fixmap.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 68 ++--
arch/arm64/mm/mmu.c | 2 +
2 files changed, 59 insertions(+), 11 deletions(-)
diff --git a/arch/arm64/include
Move {idmap_pg_dir, tramp_pg_dir, reserved_ttbr0, swapper_pg_dir}
to .rodata section.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 39 -
1 file changed, 24 insertions(+), 15 deletions(-)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64
We setup final page tables in swapper_pg_dir, which just contains
PGD. And the PUD/PMD are allocated dynamically. So we can make it
smaller.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 2 +-
arch/arm64/mm/mmu.c | 8
2 files changed, 1 insertion(+), 9
Add init_pg_dir to vmlinux.lds.S and boiler-plate
clearing/cleaning/invalidating it in head.S.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/assembler.h | 29 +
arch/arm64/kernel/head.S | 22 +++---
arch/arm64/kernel/vmlinux.lds.S
[4] https://lkml.org/lkml/2018/7/11/782
Jun Yao (6):
arm64/mm: Introduce init_pg_dir
arm64/mm: Make __enable_mmu() take the ttbr1 page as an argument
arm64/mm: Create initial page tables in init_pg_dir
arm64/mm: Make swapper_pg_dir smaller
arm64/mm: Populate swapper_pg_dir by fix
Make __enable_mmu() take the physical address of the ttbr1 page as
an argument.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/head.S | 21 -
arch/arm64/kernel/sleep.S | 1 +
2 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/kernel/head.S b/arch
Create initial page tables in init_pg_dir and then create final
page tables in swapper_pg_dir directly.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 2 ++
arch/arm64/kernel/head.S | 4 ++--
arch/arm64/kernel/setup.c| 1 +
arch/arm64/mm/mmu.c | 24
Add init_pg_dir to vmlinux.lds.S and boiler-plate
clearing/cleaning/invalidating it in head.S.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/assembler.h | 29 +
arch/arm64/kernel/head.S | 22 +++---
arch/arm64/kernel/vmlinux.lds.S
Move {idmap_pg_dir, tramp_pg_dir, reserved_ttbr0, swapper_pg_dir}
to .rodata section.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 39 -
1 file changed, 24 insertions(+), 15 deletions(-)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64
To move swapper_pg_dir to .rodata section, we populate it by
fixmap.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 68 ++--
arch/arm64/mm/mmu.c | 2 +
2 files changed, 59 insertions(+), 11 deletions(-)
diff --git a/arch/arm64/include
10476595/
[1] https://lkml.org/lkml/2018/7/6/238
[2] https://lkml.org/lkml/2018/7/6/239
[3] https://lkml.org/lkml/2018/7/6/243
[4] https://lkml.org/lkml/2018/7/11/782
Jun Yao (6):
arm64/mm: Introduce init_pg_dir
arm64/mm: Make __enable_mmu() take the ttbr1 page as an argument
arm64/mm: Create in
Make __enable_mmu() take the physical address of the ttbr1 page as
an argument.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/head.S | 21 -
arch/arm64/kernel/sleep.S | 1 +
2 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/kernel/head.S b/arch
We setup final page tables in swapper_pg_dir, which just contains
PGD. And the PUD/PMD are allocated dynamically. So we can make it
smaller.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 2 +-
arch/arm64/mm/mmu.c | 8
2 files changed, 1 insertion(+), 9
Make __enable_mmu() take the physical address of the ttbr1 page as
an argument.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/head.S | 5 -
arch/arm64/kernel/sleep.S | 1 +
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
Move {idmap_pg_dir, swapper_pg_dir} to .rodata section and
populate swapper_pg_dir by fixmap.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgalloc.h | 48
arch/arm64/include/asm/pgtable.h | 15 +-
arch/arm64/kernel/vmlinux.lds.S | 22
Make swapper_pg_dir smaller so we don't need to memblock_free() it.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/vmlinux.lds.S | 2 +-
arch/arm64/mm/mmu.c | 8
2 files changed, 1 insertion(+), 9 deletions(-)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/k
these patches.
v2: https://patchwork.kernel.org/patch/10485641/
v1: https://patchwork.kernel.org/patch/10476595/
[1] https://patchwork.kernel.org/patch/10485641/
[2] https://patchwork.kernel.org/patch/10485643/
Jun Yao (5):
arm64/mm: Introduce init_pg_dir
arm64/mm: Make __enable_mmu() take the
Add init_pg_dir to vmlinux.lds.S and boiler-plate
clearing/cleaning/invalidating it in head.S.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/assembler.h | 23 +++
arch/arm64/kernel/head.S | 24 ++--
arch/arm64/kernel/vmlinux.lds.S| 7
Create initial page tables in init_pg_dir and then create final
page tables in swapper_pg_dir directly.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 2 ++
arch/arm64/kernel/head.S | 4 ++--
arch/arm64/kernel/setup.c| 1 +
arch/arm64/mm/mmu.c | 24
by fixmap.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/fixmap.h | 1 +
arch/arm64/include/asm/pgalloc.h | 33
arch/arm64/include/asm/pgtable.h | 5 +
arch/arm64/kernel/head.S | 6 +++---
arch/arm64/kernel/vmlinux.lds.S | 23 ++
32MB block)
CONFIG_ARM64_VA_BITS_42(64KB granule, 512MB block)
If these configurations are selected, we move {tramp_pg_dir,
swapper_pg_dir} to .rodata section. And we update
swapper_pg_dir by fixmap.
[1] https://patchwork.kernel.org/patch/10476597/
Jun Yao (2):
We setup initial page tables in init_pg_dir, which is a reserved
area of the __initdata section. And in paging_init(), we no
longer need a temporary top-level and we can setup final page
tables in swapper_pg_dir directly.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/fixmap.h | 1 -
arch
gt; >>>> On 21 June 2018 at 04:51, Jun Yao wrote:
> >>>>> On Wed, Jun 20, 2018 at 12:09:49PM +0200, Ard Biesheuvel wrote:
> >>>>>> As for swapper_pg_dir, it would indeed be nice if we could keep those
> >>>>>> mappings read-
On Thu, Jun 21, 2018 at 11:29:52AM +0200, Ard Biesheuvel wrote:
> On 21 June 2018 at 10:59, James Morse wrote:
> > On 21/06/18 07:39, Ard Biesheuvel wrote:
> >> On 21 June 2018 at 04:51, Jun Yao wrote:
> >>> On Wed, Jun 20, 2018 at 12:09:49PM +0200, Ard Biesheuvel
Hi Ard,
On Wed, Jun 20, 2018 at 12:09:49PM +0200, Ard Biesheuvel wrote:
> On 20 June 2018 at 10:57, Jun Yao wrote:
> > Move {idmap_pg_dir,tramp_pg_dir,swapper_pg_dir} to .rodata
> > section. And update the swapper_pg_dir by fixmap.
> >
>
> I think we may be able t
Move {idmap_pg_dir,tramp_pg_dir,swapper_pg_dir} to .rodata
section. And update the swapper_pg_dir by fixmap.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgalloc.h | 19 +++
arch/arm64/kernel/vmlinux.lds.S | 32 ++--
arch/arm64/mm/mmu.c
://www.openwall.com/lists/kernel-hardening/2018/05/31/1
[2] https://patchwork.kernel.org/patch/10449589/
Jun Yao (1):
arm64/mm: move {idmap_pg_dir,tramp_pg_dir,swapper_pg_dir} to .rodata
section
arch/arm64/include/asm/pgalloc.h | 19 +++
arch/arm64/kernel/vmlinux.lds.S | 32
Introduce __pa_swapper_pg_dir to save physical address of
swapper_pg_dir. And pass it as an argument to __enable_mmu().
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/mmu_context.h | 4 +---
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch
Migrate swapper_pg_dir and tramp_pg_dir. And their virtual addresses
do not correlate with kernel's address.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/mm/mmu.c | 79 +---
2 files changed, 52 insertions(+
Prepare for migrating swapper_pg_dir, introduce new_swapper_pg_dir
to save virtual address of swapper_pg_dir.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/mmu_context.h | 2 +-
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/mm/kasan_init.c | 2 +-
arch/arm64/mm/mmu.c
.html
[v1] https://www.spinics.net/lists/kernel/msg2819351.html
Jun Yao (3):
arm64/mm: pass swapper_pg_dir as an argument to __enable_mmu()
arm64/mm: introduce variable to save new swapper_pg_dir address
arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
arch/arm64/include/asm/mmu_context.h
Prepare for migrating swapper_pg_dir, introduce new_swapper_pg_dir
to save virtual address of swapper_pg_dir.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/mmu_context.h | 2 +-
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/mm/kasan_init.c | 2 +-
arch/arm64/mm/mmu.c
Introduce __pa_swapper_pg_dir to save physical address of
swapper_pg_dir. And pass it as an argument to __enable_mmu().
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/mmu_context.h | 4 +---
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch
Migrate swapper_pg_dir and tramp_pg_dir. And their virtual addresses
do not correlate with kernel's address.
Signed-off-by: Jun Yao
---
arch/arm64/mm/mmu.c | 75 -
1 file changed, 47 insertions(+), 28 deletions(-)
diff --git a/arch/arm64/mm/mm
.html
[2] https://www.spinics.net/lists/kernel/msg2819455.html
Jun Yao (3):
arm64/mm: pass swapper_pg_dir as an argument to __enable_mmu()
arm64/mm: introduce variable to save new swapper_pg_dir address
arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
arch/arm64/include/asm/mmu_context.h
On 1 Jun 2018 at 10:42:10, Robin Murphy wrote:
>> Currently, The offset between swapper_pg_dir and _text is
>> fixed. When attackers know the address of _text(no KASLR or
>> breaking KASLR), they can caculate the address of
>> swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can
>> be appl
Migrate swapper_pg_dir and tramp_pg_dir. And their virtual addresses
do not correlate with kernel's address.
Signed-off-by: Jun Yao
---
arch/arm64/mm/mmu.c | 70 +++--
1 file changed, 42 insertions(+), 28 deletions(-)
diff --git a/arch/arm64/mm/mm
To defense KSMA, we need to migrate tramp_pg_dir and swapper_pg_dir
together. Make them adjacent to avoid modifying tramp_(un)map_kernel.
Signed-off-by: Jun Yao
---
arch/arm64/kernel/entry.S | 4 ++--
arch/arm64/kernel/vmlinux.lds.S | 9 +
2 files changed, 7 insertions(+), 6
Prepare for migrating swapper_pg_dir, introduce new_swapper_pg_dir
to save virtual address of swapper_pg_dir.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/mmu_context.h | 2 +-
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/mm/kasan_init.c | 2 +-
arch/arm64/mm/mmu.c
Introduce __pa_swapper_pg_dir to save physical address of
swapper_pg_dir. And pass it as an argument to __enable_mmu().
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/mmu_context.h | 4 +---
arch/arm64/include/asm/pgtable.h | 1 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch
is dynamically allocated. Since it is
allocated during the kernel boot process and the address is
relatively fixed, further randomization may be required.
Jun Yao (4):
arm64/mm: pass swapper_pg_dir as an argument to __enable_mmu()
arm64/mm: introduce variable to save new swapper_pg_dir address
In order to make tramp_pg_dir read-only, split it off from the data
segment and create a dedicated pgdir segment for it.
Signed-off-by: Jun Yao
---
arch/arm64/include/asm/sections.h | 1 +
arch/arm64/kernel/vmlinux.lds.S | 3 +++
arch/arm64/mm/mmu.c | 13 +
3 files
Make tramp_pg_dir read-only.
Signed-off-by: Jun Yao
---
arch/arm64/mm/mmu.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index a675fb88914e..2c6e6433090c 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -542,6 +542,7 @@ static
Version 2 changes:
split tramp_pg_dir off from the data segment and create
a dedicated pgdir segment for it.
Jun Yao (2):
arm64/mm: split tramp_pg_dir off from the data segment
arm64/mm: make tramp_pg_dir read-only
arch/arm64/include/asm/sections.h | 1 +
arch/arm64/kernel
64 matches
Mail list logo