mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Yinghai Lu <yinghai@kernel.org>
To: Kees Cook <keescook@chromium.org>,
	"H. Peter Anvin" <hpa@zytor.com>, Baoquan He <bhe@redhat.com>
Cc: linux-kernel@vger.kernel.org, Yinghai Lu <yinghai@kernel.org>
Subject: [PATCH 40/42] x86, 64bit: remove highmap for not needed ranges
Date: Tue,  7 Jul 2015 13:20:26 -0700	[thread overview]
Message-ID: <1436300428-21163-41-git-send-email-yinghai@kernel.org> (raw)
In-Reply-To: <1436300428-21163-1-git-send-email-yinghai@kernel.org>

add cleanup_highmap_late to remove highmap for initmem, around rodata, and
[_brk_end, all_end).

Kernel Layout:

[    0.000000]   .text: [0x01000000-0x0200df88]
[    0.000000] .rodata: [0x02200000-0x02a1dfff]
[    0.000000]   .data: [0x02c00000-0x02e510ff]
[    0.000000]   .init: [0x02e53000-0x03213fff]
[    0.000000]    .bss: [0x03222000-0x0437cfff]
[    0.000000]    .brk: [0x0437d000-0x043a2fff]

Actually used brk:
[    0.270365] memblock_reserve: [0x0000000437d000-0x00000004383fff] flags 0x0 BRK

Before patch:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000          16M                           pmd
0xffffffff81000000-0xffffffff82000000          16M     ro         PSE GLB x  pmd
0xffffffff82000000-0xffffffff82011000          68K     ro             GLB x  pte
0xffffffff82011000-0xffffffff82200000        1980K     RW             GLB x  pte
0xffffffff82200000-0xffffffff82a00000           8M     ro         PSE GLB NX pmd
0xffffffff82a00000-0xffffffff82a1e000         120K     ro             GLB NX pte
0xffffffff82a1e000-0xffffffff82c00000        1928K     RW             GLB NX pte
0xffffffff82c00000-0xffffffff82e00000           2M     RW         PSE GLB NX pmd
0xffffffff82e00000-0xffffffff83000000           2M     RW             GLB NX pte
0xffffffff83000000-0xffffffff83200000           2M     RW         PSE GLB NX pmd
0xffffffff83200000-0xffffffff83400000           2M     RW             GLB NX pte
0xffffffff83400000-0xffffffff84400000          16M     RW         PSE GLB NX pmd
0xffffffff84400000-0xffffffffa0000000         444M                           pmd

After patch:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000          16M                           pmd
0xffffffff81000000-0xffffffff82000000          16M     ro         PSE GLB x  pmd
0xffffffff82000000-0xffffffff82012000          72K     ro             GLB x  pte
0xffffffff82012000-0xffffffff82200000        1976K                           pte
0xffffffff82200000-0xffffffff82a00000           8M     ro         PSE GLB NX pmd
0xffffffff82a00000-0xffffffff82a1e000         120K     ro             GLB NX pte
0xffffffff82a1e000-0xffffffff82c00000        1928K                           pte
0xffffffff82c00000-0xffffffff82e00000           2M     RW         PSE GLB NX pmd
0xffffffff82e00000-0xffffffff82e53000         332K     RW             GLB NX pte
0xffffffff82e53000-0xffffffff83000000        1716K                           pte
0xffffffff83000000-0xffffffff83200000           2M                           pmd
0xffffffff83200000-0xffffffff83214000          80K                           pte
0xffffffff83214000-0xffffffff83400000        1968K     RW             GLB NX pte
0xffffffff83400000-0xffffffff84200000          14M     RW         PSE GLB NX pmd
0xffffffff84200000-0xffffffff84384000        1552K     RW             GLB NX pte
0xffffffff84384000-0xffffffff84400000         496K                           pte
0xffffffff84400000-0xffffffffa0000000         444M                           pmd

So remove some range around rodata.

-v4: adapt it to all_end change.

Signed-off-by: Yinghai Lu <yinghai@kernel.org>
---
 arch/x86/mm/init_64.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 2507b98..38aa59c 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1010,6 +1010,61 @@ void __init mem_init(void)
 }
 
 #ifdef CONFIG_DEBUG_RODATA
+static void remove_highmap_2m(unsigned long addr)
+{
+	pgd_t *pgd = pgd_offset_k(addr);
+	pud_t *pud = (pud_t *)pgd_page_vaddr(*pgd) + pud_index(addr);
+	pmd_t *pmd = (pmd_t *)pud_page_vaddr(*pud) + pmd_index(addr);
+
+	set_pmd(pmd, __pmd(0));
+}
+
+static void remove_highmap_2m_partial(unsigned long addr, unsigned long end)
+{
+	int i;
+	pgd_t *pgd = pgd_offset_k(addr);
+	pud_t *pud = (pud_t *)pgd_page_vaddr(*pgd) + pud_index(addr);
+	pmd_t *pmd = (pmd_t *)pud_page_vaddr(*pud) + pmd_index(addr);
+	pte_t *pte = (pte_t *)pmd_page_vaddr(*pmd) + pte_index(addr);
+
+	for (i = pte_index(addr); i < pte_index(end - 1) + 1; i++, pte++)
+		set_pte(pte, __pte(0));
+}
+
+static void cleanup_highmap_late(unsigned long start, unsigned long end)
+{
+	unsigned long addr;
+	unsigned long start_2m_aligned = roundup(start, PMD_SIZE);
+	unsigned long end_2m_aligned = rounddown(end, PMD_SIZE);
+
+	start = PFN_ALIGN(start);
+	end &= PAGE_MASK;
+
+	if (start >= end)
+		return;
+
+	if (start < start_2m_aligned) {
+		unsigned long tmp = min(start_2m_aligned, end);
+
+		set_memory_4k(start, (tmp - start) >> PAGE_SHIFT);
+		remove_highmap_2m_partial(start, tmp);
+	}
+
+	for (addr = start_2m_aligned; addr < end_2m_aligned; addr += PMD_SIZE)
+		remove_highmap_2m(addr);
+
+	if (start <= end_2m_aligned && end_2m_aligned < end) {
+		set_memory_4k(end_2m_aligned,
+				(end - end_2m_aligned) >> PAGE_SHIFT);
+		remove_highmap_2m_partial(end_2m_aligned, end);
+	}
+
+	subtract_range(pfn_highmapped, NR_RANGE,
+			__pa_symbol(start) >> PAGE_SHIFT,
+			__pa_symbol(end) >> PAGE_SHIFT);
+	nr_pfn_highmapped = clean_sort_range(pfn_highmapped, NR_RANGE);
+}
+
 const int rodata_test_data = 0xC3;
 EXPORT_SYMBOL_GPL(rodata_test_data);
 
@@ -1058,6 +1113,7 @@ void mark_rodata_ro(void)
 	unsigned long end = (unsigned long) &__end_rodata_hpage_align;
 	unsigned long text_end = PFN_ALIGN(&__stop___ex_table);
 	unsigned long rodata_end = PFN_ALIGN(&__end_rodata);
+	unsigned long data_start = PFN_ALIGN(&_sdata);
 	unsigned long all_end;
 
 	printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
@@ -1081,6 +1137,12 @@ void mark_rodata_ro(void)
 	all_end = roundup(_brk_end, PMD_SIZE);
 	set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
 
+	cleanup_highmap_late(text_end, rodata_start);
+	cleanup_highmap_late(rodata_end, data_start);
+	cleanup_highmap_late(PFN_ALIGN(_brk_end), all_end);
+	cleanup_highmap_late((unsigned long)(&__init_begin),
+				(unsigned long)(&__init_end));
+
 	rodata_test();
 
 #ifdef CONFIG_CPA_DEBUG
-- 
1.8.4.5


  parent reply	other threads:[~2015-07-07 20:25 UTC|newest]

Thread overview: 74+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-07-07 20:19 [PATCH 00/42] x86: updated patches for kaslr and setup_data etc for v4.3 Yinghai Lu
2015-07-07 20:19 ` [PATCH 01/42] x86, kasl: Remove not needed parameter for choose_kernel_location Yinghai Lu
2015-07-07 20:57   ` Kees Cook
2015-07-07 20:19 ` [PATCH 02/42] x86, boot: Move compressed kernel to end of buffer before decompressing Yinghai Lu
2015-07-07 21:22   ` Kees Cook
2015-07-07 20:19 ` [PATCH 03/42] x86, boot: Fix run_size calculation Yinghai Lu
2015-07-07 22:15   ` Kees Cook
2015-07-07 20:19 ` [PATCH 04/42] x86, kaslr: Kill not needed and wrong run_size calculation code Yinghai Lu
2015-07-07 22:18   ` Kees Cook
2015-07-07 20:19 ` [PATCH 05/42] x86, kaslr: rename output_size to output_run_size Yinghai Lu
2015-07-07 20:19 ` [PATCH 06/42] x86, kaslr: Consolidate mem_avoid array filling Yinghai Lu
2015-07-07 22:36   ` Kees Cook
2015-07-07 20:19 ` [PATCH 07/42] x86, boot: Move z_extract_offset calculation to header.S Yinghai Lu
2015-07-07 20:19 ` [PATCH 08/42] x86, kaslr: Get correct max_addr for relocs pointer Yinghai Lu
2015-07-07 22:40   ` Kees Cook
2015-07-07 20:19 ` [PATCH 09/42] x86, boot: Split kernel_ident_mapping_init to another file Yinghai Lu
2015-07-07 20:19 ` [PATCH 10/42] x86, 64bit: Set ident_mapping for kaslr Yinghai Lu
2015-07-07 20:19 ` [PATCH 11/42] x86, boot: Add checking for memcpy Yinghai Lu
2015-07-07 20:19 ` [PATCH 12/42] x86, kaslr: Fix a bug that relocation can not be handled when kernel is loaded above 2G Yinghai Lu
2015-07-07 22:42   ` Kees Cook
2015-07-07 20:19 ` [PATCH 13/42] x86, kaslr: Introduce struct slot_area to manage randomization slot info Yinghai Lu
2015-07-07 20:20 ` [PATCH 14/42] x86, kaslr: Add two functions which will be used later Yinghai Lu
2015-07-07 20:20 ` [PATCH 15/42] x86, kaslr: Introduce fetch_random_virt_offset to randomize the kernel text mapping address Yinghai Lu
2015-07-07 20:20 ` [PATCH 16/42] x86, kaslr: Randomize physical and virtual address of kernel separately Yinghai Lu
2015-07-07 20:20 ` [PATCH 17/42] x86, kaslr: Add support of kernel physical address randomization above 4G Yinghai Lu
2015-07-07 20:20 ` [PATCH 18/42] x86, kaslr: Remove useless codes Yinghai Lu
2015-07-07 20:20 ` [PATCH 19/42] x86, kaslr: Allow random address could be below loaded address Yinghai Lu
2015-07-07 20:20 ` [PATCH 20/42] x86, boot: Add printf support for early console in compressed/misc.c Yinghai Lu
2015-07-07 20:20 ` [PATCH 21/42] x86, boot: Add more debug printout " Yinghai Lu
2015-07-07 20:20 ` [PATCH 22/42] x86, setup: Check early serial console per string instead of one char Yinghai Lu
2015-07-07 22:59   ` Kees Cook
2015-07-07 20:20 ` [PATCH 23/42] x86, setup: Use puts() instead of printf() in edd code Yinghai Lu
2015-07-07 20:20 ` [PATCH 24/42] x86: Setup early console as early as possible in x86_start_kernel() Yinghai Lu
2015-07-07 20:20 ` [PATCH 25/42] x86, boot: print compression suffix in decompress stage Yinghai Lu
2015-07-07 23:13   ` Kees Cook
2015-07-07 20:20 ` [PATCH 26/42] x86: remove not needed clear_page calling Yinghai Lu
2015-07-07 23:14   ` Kees Cook
2015-07-07 20:20 ` [PATCH 27/42] x86: restore end_of_ram to E820_RAM Yinghai Lu
2015-07-08 17:44   ` Matt Fleming
2015-07-09  1:41     ` Dan Williams
2015-07-09  7:45     ` Christoph Hellwig
2015-07-09 11:17       ` Matt Fleming
2015-07-07 20:20 ` [PATCH 28/42] x86, boot: Allow 64bit EFI kernel to be loaded above 4G Yinghai Lu
2015-07-07 23:12   ` Kees Cook
2015-07-08 18:00     ` Matt Fleming
2015-07-07 20:20 ` [PATCH 29/42] x86: Find correct 64 bit ramdisk address for microcode early update Yinghai Lu
2015-07-07 23:08   ` Kees Cook
2015-07-07 20:20 ` [PATCH 30/42] x86: Kill E820_RESERVED_KERN Yinghai Lu
2015-07-07 20:20 ` [PATCH 31/42] x86, efi: Copy SETUP_EFI data and access directly Yinghai Lu
2015-07-22 10:58   ` Matt Fleming
2015-07-24  2:07   ` Dave Young
2015-07-07 20:20 ` [PATCH 32/42] x86, of: Let add_dtb reserve setup_data locally Yinghai Lu
2015-07-07 20:20 ` [PATCH 33/42] x86, boot: Add add_pci handler for SETUP_PCI Yinghai Lu
2015-07-14 22:30   ` Bjorn Helgaas
2015-07-07 20:20 ` [PATCH 34/42] x86: Kill not used setup_data handling code Yinghai Lu
2015-07-07 20:20 ` [PATCH 35/42] x86, boot, PCI: Convert SETUP_PCI data to list Yinghai Lu
2015-07-14 22:35   ` Bjorn Helgaas
2015-07-15  1:57     ` Yinghai Lu
2015-07-07 20:20 ` [PATCH 36/42] x86, boot, PCI: Copy SETUP_PCI rom to kernel space Yinghai Lu
2015-07-07 20:20 ` [PATCH 37/42] x86, boot, PCI: Export SETUP_PCI data via sysfs Yinghai Lu
2015-07-07 20:20 ` [PATCH 38/42] x86: Fix typo in mark_rodata_ro Yinghai Lu
2015-07-07 23:05   ` Kees Cook
2015-07-07 20:20 ` [PATCH 39/42] x86, 64bit: add pfn_range_is_highmapped() Yinghai Lu
2015-07-07 20:20 ` Yinghai Lu [this message]
2015-07-07 23:17   ` [PATCH 40/42] x86, 64bit: remove highmap for not needed ranges Kees Cook
2015-07-07 20:20 ` [PATCH 41/42] x86, 64bit: Add __pa_high/__va_high Yinghai Lu
2015-07-07 20:20 ` [PATCH 42/42] x86: fix msr print again Yinghai Lu
2015-07-07 23:21 ` [PATCH 00/42] x86: updated patches for kaslr and setup_data etc for v4.3 Kees Cook
2015-10-02 20:16   ` Kees Cook
2016-02-06 11:50     ` Baoquan He
2016-02-09  4:31       ` Kees Cook
2016-02-15  7:29         ` Baoquan He
2016-02-16 23:50           ` Kees Cook
2015-07-08 10:51 ` Ingo Molnar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1436300428-21163-41-git-send-email-yinghai@kernel.org \
    --to=yinghai@kernel.org \
    --cc=bhe@redhat.com \
    --cc=hpa@zytor.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

Powered by JetHome