Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cve 2017 5754 #2048

Merged
merged 13 commits into from
Jan 10, 2018
Merged

Cve 2017 5754 #2048

merged 13 commits into from
Jan 10, 2018

Commits on Jan 10, 2018

  1. core: make core_mmu.h asm friendly 

    Makes core_mmu.h assembly friendly by excluding C code with #ifndef ASM

Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    d3a558d View commit details
    Browse the repository at this point in the history

  2. core: refactor ASID management 

    Refactors Address Space Identifier management. The field in struct
user_ta_ctx is moved into struct tee_mmu_info and renamed to asid.

Allocation refactored internally with asid_alloc() and asid_free()
functions, based on bitstring.h macros.

ASIDs starts at 2, and is always an even number.

ASIDs with the lowest bit set is reserved for as the second ASID when
using ASIDs in pairs.

Reviewed-by: Etienne Carriere <[email protected]>
Acked-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    572ca16 View commit details
    Browse the repository at this point in the history

  3. core: tlbi_asid() handle kernel mode ASID too 

    When invalidating an ASID (lowest bit 0), clear the paired ASID (lowest
bit 1)too.

Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    48c0fa2 View commit details
    Browse the repository at this point in the history

  4. core: add mobj_tee_ram 

    Adds mobj_tee_ram to describe TEE RAM mapping inside a user mapping.

Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    3b25bf7 View commit details
    Browse the repository at this point in the history

  5. core: thread: add thread_get_user_kcode() 

    Adds thread_get_user_kcode() to report required kernel mapping
(exception vector and some associated code in the same section as the
vector) inside a user mapping.

Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    4361f46 View commit details
    Browse the repository at this point in the history

  6. core: mm: add kernel mapping to user map 

    Adds a minimal kernel mapping needed when user mapping is active.

Reviewed-by: Etienne Carriere <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    1715dcd View commit details
    Browse the repository at this point in the history

  7. core: user mode translation table 

    Adds a second translation table to be used while in user mode containing
user mode mapping and a minimal kernel mapping.

Reviewed-by: Etienne Carriere <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    cc5d25d View commit details
    Browse the repository at this point in the history

  8. core: arm32: exception handlers in one section 

    Moves all exception handlers into the section of the vector,
.text.thread_vect_table. This makes it possible to later map just the
exception vector and the closest associated code while in user mode.

Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    c660cd8 View commit details
    Browse the repository at this point in the history

  9. core: thread_a32.S: move intr handler macros 

    Moves the interrupt handler macros closer to the vector.

Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    bae9f82 View commit details
    Browse the repository at this point in the history

  10. core: use minimal kernel map in user space 

    Adds a trampoline in the exception vector to switch to a minimal kernel
map when in user mode. When returning to kernel mode the full kernel
mode map is restored.

Arm32 tries to mimic the arm64 exception model somewhat by letting each
exception handler run with disabled asynchronous aborts, irq and fiq.

Form arm32 accesses to the cpus thread_core_local is only done via the
stack pointer in abort mode. Entry of user mode is only done via abort
mode, that means that the abort mode spsr register carries the new cpsr.
Care is taken to have all exceptions disabled while using abort mode.

ASIDs are paired with a user mode ASID with lowest bit sset and a
kernel mode ASID with the lowest bit cleared.

ASID 0 is reserved for kernel mode use when there's no user mode mapping
active.

With this change an active used mode mapping while in kernel mode uses
(asid | 0), and while in user mode (asid | 1). The switch is done via
the trampoline in the vector.

Acked-by: Etienne Carriere <[email protected]>
Acked-by: Jerome Forissier <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    f0d6133 View commit details
    Browse the repository at this point in the history

  11. core: make all mapping non-global 

    Makes all mapping non-global to avoid the otherwise required tlb
invalidation when switching to user mode.

This change makes the fix for CVE-2017-5754 complete.

Reviewed-by: Etienne Carriere <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    4ae953b View commit details
    Browse the repository at this point in the history

  12. core: rename mattr_uflags_to_str() 

    Renames mattr_uflags_to_str() to mattr_perm_to_str() and report all
permission bits using a 7 bytes long string instead.

This allows observing the permissions of the minimal kernel mapping
added to the user space context.

Reviewed-by: Etienne Carriere <[email protected]>
Acked-by: Andrew Davis <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    eb3d85c View commit details
    Browse the repository at this point in the history

  13. documentation: mmu and switch to/from user space 

    This only describes the already documented legacy ARMv7 (short) table
format.

Acked-by: Jerome Forissier <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
    @jenswi-linaro
    jenswi-linaro committed Jan 10, 2018
    Configuration menu
    Copy the full SHA
    c4503a5 View commit details
    Browse the repository at this point in the history