| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 15 Nov 2014 01:43:32 -0800
From: Yinghai Lu <yinghai@...nel.org>
To: Kees Cook <keescook@...omium.org>
Cc: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>,
"H. Peter Anvin" <hpa@...or.com>,
"the arch/x86 maintainers" <x86@...nel.org>,
Andrew Morton <akpm@...ux-foundation.org>,
Andy Lutomirski <luto@...capital.net>,
Yasuaki Ishimatsu <isimatu.yasuaki@...fujitsu.com>,
Wang Nan <wangnan0@...wei.com>,
David Vrabel <david.vrabel@...rix.com>
Subject: Re: [PATCH v2] x86, mm: set NX across entire PMD at boot
On Fri, Nov 14, 2014 at 7:38 PM, Yinghai Lu <yinghai@...nel.org> wrote:
> On Fri, Nov 14, 2014 at 6:46 PM, Kees Cook <keescook@...omium.org> wrote:
>> Is this correct? It sounded like tglx wanted the pmd split, like this:
>>
>> 0xffffffff82200000-0xffffffff82c00000 10M RW PSE GLB NX pmd
>> 0xffffffff82c00000-0xffffffff82df5000 2004K RW GLB NX pte
>> 0xffffffff82df5000-0xffffffff82e00000 44K RW NX pte
>> 0xffffffff82e00000-0xffffffffc0000000 978M pmd
>
> Need to remove GLB ?
Please check attached one that clean up the highmap tail...
Subject: [RFC PATCH] x86, 64bit: cleanup highmap tail near partial 2M range
1. should use _brk_end instead of &end, as we only use partial of
brk.
2. [_brk_end, pm_end) page range is already converted mem. and
is not wasted.
3. add cleanup_highmap_tail for [_brk_end, pm_end).
Kernel Layout:
[ 0.000000] .text: [0x01000000-0x0200d5c8]
[ 0.000000] .rodata: [0x02200000-0x02a1cfff]
[ 0.000000] .data: [0x02c00000-0x02e50e7f]
[ 0.000000] .init: [0x02e52000-0x03212fff]
[ 0.000000] .bss: [0x03221000-0x0437bfff]
[ 0.000000] .brk: [0x0437c000-0x043a1fff]
Actually used brk:
[ 0.272959] memblock_reserve: [0x0000000437c000-0x00000004382fff]
flags 0x0 BRK
Before patch:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd
0xffffffff81000000-0xffffffff82200000 18M ro PSE GLB x pmd
0xffffffff82200000-0xffffffff82c00000 10M ro PSE GLB NX pmd
0xffffffff82c00000-0xffffffff82e00000 2M RW PSE GLB NX pmd
0xffffffff82e00000-0xffffffff83000000 2M RW GLB NX pte
0xffffffff83000000-0xffffffff83200000 2M RW PSE GLB NX pmd
0xffffffff83200000-0xffffffff83400000 2M RW GLB NX pte
0xffffffff83400000-0xffffffff84200000 14M RW PSE GLB NX pmd
0xffffffff84200000-0xffffffff843a2000 1672K RW GLB NX pte
0xffffffff843a2000-0xffffffff84400000 376K RW GLB x pte
0xffffffff84400000-0xffffffffa0000000 444M pmd
After patch:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd
0xffffffff81000000-0xffffffff82200000 18M ro PSE GLB x pmd
0xffffffff82200000-0xffffffff82c00000 10M ro PSE GLB NX pmd
0xffffffff82c00000-0xffffffff82e00000 2M RW PSE GLB NX pmd
0xffffffff82e00000-0xffffffff83000000 2M RW GLB NX pte
0xffffffff83000000-0xffffffff83200000 2M RW PSE GLB NX pmd
0xffffffff83200000-0xffffffff83400000 2M RW GLB NX pte
0xffffffff83400000-0xffffffff84200000 14M RW PSE GLB NX pmd
0xffffffff84200000-0xffffffff84383000 1548K RW GLB NX pte
0xffffffff84383000-0xffffffff84400000 500K pte
0xffffffff84400000-0xffffffffa0000000 444M pmd
Signed-off-by: Yinghai Lu <yinghai@...nel.org>
---
arch/x86/mm/init_64.c | 23 ++++++++++++++++++++++-
arch/x86/mm/pageattr.c | 2 +-
2 files changed, 23 insertions(+), 2 deletions(-)
Index: linux-2.6/arch/x86/mm/init_64.c
===================================================================
--- linux-2.6.orig/arch/x86/mm/init_64.c
+++ linux-2.6/arch/x86/mm/init_64.c
@@ -375,6 +375,7 @@ void __init init_extra_mapping_uc(unsign
__init_extra_mapping(phys, size, PAGE_KERNEL_LARGE_NOCACHE);
}
+static pmd_t *last_pmd;
/*
* The head.S code sets up the kernel high mapping:
*
@@ -408,9 +409,26 @@ void __init cleanup_highmap(void)
continue;
if (vaddr < (unsigned long) _text || vaddr > end)
set_pmd(pmd, __pmd(0));
+ else
+ last_pmd = pmd;
}
}
+static void __init cleanup_highmap_tail(unsigned long addr)
+{
+ int i;
+ pte_t *pte;
+
+ if (!last_pmd || pmd_none(*last_pmd))
+ return;
+
+ pte = (pte_t *)pmd_page_vaddr(*last_pmd);
+ pte += pte_index(addr);
+
+ for (i = pte_index(addr); i < PTRS_PER_PTE; i++, pte++)
+ set_pte(pte, __pte(0));
+}
+
static unsigned long __meminit
phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end,
pgprot_t prot)
@@ -1124,7 +1142,8 @@ void mark_rodata_ro(void)
unsigned long end = (unsigned long) &__end_rodata_hpage_align;
unsigned long text_end = PFN_ALIGN(&__stop___ex_table);
unsigned long rodata_end = PFN_ALIGN(&__end_rodata);
- unsigned long all_end = PFN_ALIGN(&_end);
+ unsigned long all_end = PFN_ALIGN(_brk_end);
+ unsigned long pmd_end = roundup(all_end, PMD_SIZE);
printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
(end - start) >> 10);
@@ -1137,6 +1156,8 @@ void mark_rodata_ro(void)
* should also be not-executable.
*/
set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
+ if (all_end < pmd_end)
+ cleanup_highmap_tail(all_end);
rodata_test();
Index: linux-2.6/arch/x86/mm/pageattr.c
===================================================================
--- linux-2.6.orig/arch/x86/mm/pageattr.c
+++ linux-2.6/arch/x86/mm/pageattr.c
@@ -100,7 +100,7 @@ static inline unsigned long highmap_star
static inline unsigned long highmap_end_pfn(void)
{
- return __pa_symbol(roundup(_brk_end, PMD_SIZE)) >> PAGE_SHIFT;
+ return __pa_symbol(PFN_ALIGN(_brk_end)) >> PAGE_SHIFT;
}
#endif
View attachment "nx_after_end.patch" of type "text/x-patch" (4928 bytes)
Powered by blists - more mailing lists