Messages in this thread | | | Subject | Re: [kernel-hardening] [PATCH v5 04/10] arm64: Add __flush_tlb_one() | From | Juerg Haefliger <> | Date | Wed, 30 Aug 2017 07:31:25 +0200 |
| |
On 08/23/2017 07:04 PM, Mark Rutland wrote: > On Wed, Aug 23, 2017 at 10:58:42AM -0600, Tycho Andersen wrote: >> Hi Mark, >> >> On Mon, Aug 14, 2017 at 05:50:47PM +0100, Mark Rutland wrote: >>> That said, is there any reason not to use flush_tlb_kernel_range() >>> directly? >> >> So it turns out that there is a difference between __flush_tlb_one() and >> flush_tlb_kernel_range() on x86: flush_tlb_kernel_range() flushes all the TLBs >> via on_each_cpu(), where as __flush_tlb_one() only flushes the local TLB (which >> I think is enough here). > > That sounds suspicious; I don't think that __flush_tlb_one() is > sufficient. > > If you only do local TLB maintenance, then the page is left accessible > to other CPUs via the (stale) kernel mappings. i.e. the page isn't > exclusively mapped by userspace.
We flush all CPUs to get rid of stale entries when a new page is allocated to userspace that was previously allocated to the kernel. Is that the scenario you were thinking of?
...Juerg
> Thanks, > Mark. >
[unhandled content-type:application/pgp-signature]
| |