| Message ID | 20181023163157.41441-2-kirill.shutemov@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix couple of issues with LDT remap for PTI | expand |
On Tue, Oct 23, 2018 at 07:31:56PM +0300, Kirill A. Shutemov wrote: > -ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory > +ffff888000000000 - ffff887fffffffff (=39 bits) LDT remap for PTI I'm a little bit cross-eyed at this point, but I think the above '888' should be '880'. > @@ -14,7 +15,6 @@ ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB) > ... unused hole ... > vaddr_end for KASLR > fffffe0000000000 - fffffe7fffffffff (=39 bits) cpu_entry_area mapping > -fffffe8000000000 - fffffeffffffffff (=39 bits) LDT remap for PTI ... and the line above this one should be adjusted to finish at fffffeffffffffff (also it's now 40 bits). Or should there be something else here? > ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks > ... unused hole ... > ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space > @@ -30,8 +30,8 @@ Virtual memory map with 5 level page tables: > 0000000000000000 - 00ffffffffffffff (=56 bits) user space, different per mm > hole caused by [56:63] sign extension > ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor > -ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory > -ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI > +ff10000000000000 - ff10ffffffffffff (=48 bits) LDT remap for PTI > +ff11000000000000 - ff90ffffffffffff (=55 bits) direct mapping of all phys. memory What's at ff910..0 to ff9f..f ? Is there any way we can generate this part of this file to prevent human error from creeping in over time? ;-)
On Wed, Oct 24, 2018 at 04:54:47AM -0700, Matthew Wilcox wrote: > On Tue, Oct 23, 2018 at 07:31:56PM +0300, Kirill A. Shutemov wrote: > > -ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory > > +ffff888000000000 - ffff887fffffffff (=39 bits) LDT remap for PTI > > I'm a little bit cross-eyed at this point, but I think the above '888' > should be '880'. > > > @@ -14,7 +15,6 @@ ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB) > > ... unused hole ... > > vaddr_end for KASLR > > fffffe0000000000 - fffffe7fffffffff (=39 bits) cpu_entry_area mapping > > -fffffe8000000000 - fffffeffffffffff (=39 bits) LDT remap for PTI > > ... and the line above this one should be adjusted to finish at > fffffeffffffffff (also it's now 40 bits). Or should there be something > else here? > > > ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks > > ... unused hole ... > > ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space > > @@ -30,8 +30,8 @@ Virtual memory map with 5 level page tables: > > 0000000000000000 - 00ffffffffffffff (=56 bits) user space, different per mm > > hole caused by [56:63] sign extension > > ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor > > -ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory > > -ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI > > +ff10000000000000 - ff10ffffffffffff (=48 bits) LDT remap for PTI > > +ff11000000000000 - ff90ffffffffffff (=55 bits) direct mapping of all phys. memory > > What's at ff910..0 to ff9f..f ? > > Is there any way we can generate this part of this file to prevent human > error from creeping in over time? ;-) In current Linus' tree this part of the documentation was re-written. I've rebased to it and rewrote the documenation for the change. I believe I've fixed all mistakes you've noticied. Please check out v2. I will post it soon.
diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt index 5432a96d31ff..463c48c26fb7 100644 --- a/Documentation/x86/x86_64/mm.txt +++ b/Documentation/x86/x86_64/mm.txt @@ -4,7 +4,8 @@ Virtual memory map with 4 level page tables: 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm hole caused by [47:63] sign extension ffff800000000000 - ffff87ffffffffff (=43 bits) guard hole, reserved for hypervisor -ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory +ffff888000000000 - ffff887fffffffff (=39 bits) LDT remap for PTI +ffff888000000000 - ffffc87fffffffff (=64 TB) direct mapping of all phys. memory ffffc80000000000 - ffffc8ffffffffff (=40 bits) hole ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole @@ -14,7 +15,6 @@ ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB) ... unused hole ... vaddr_end for KASLR fffffe0000000000 - fffffe7fffffffff (=39 bits) cpu_entry_area mapping -fffffe8000000000 - fffffeffffffffff (=39 bits) LDT remap for PTI ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks ... unused hole ... ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space @@ -30,8 +30,8 @@ Virtual memory map with 5 level page tables: 0000000000000000 - 00ffffffffffffff (=56 bits) user space, different per mm hole caused by [56:63] sign extension ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor -ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory -ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI +ff10000000000000 - ff10ffffffffffff (=48 bits) LDT remap for PTI +ff11000000000000 - ff90ffffffffffff (=55 bits) direct mapping of all phys. memory ffa0000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space (12800 TB) ffd2000000000000 - ffd3ffffffffffff (=49 bits) hole ffd4000000000000 - ffd5ffffffffffff (=49 bits) virtual memory map (512TB) diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h index 6afac386a434..b99d497e342d 100644 --- a/arch/x86/include/asm/page_64_types.h +++ b/arch/x86/include/asm/page_64_types.h @@ -33,12 +33,14 @@ /* * Set __PAGE_OFFSET to the most negative possible address + - * PGDIR_SIZE*16 (pgd slot 272). The gap is to allow a space for a - * hypervisor to fit. Choosing 16 slots here is arbitrary, but it's - * what Xen requires. + * PGDIR_SIZE*17 (pgd slot 273). + * + * The gap is to allow a space for LDT remap for PTI (1 pgd slot) and space for + * a hypervisor (16 slots). Choosing 16 slots for a hypervisor is arbitrary, + * but it's what Xen requires. */ -#define __PAGE_OFFSET_BASE_L5 _AC(0xff10000000000000, UL) -#define __PAGE_OFFSET_BASE_L4 _AC(0xffff880000000000, UL) +#define __PAGE_OFFSET_BASE_L5 _AC(0xff11000000000000, UL) +#define __PAGE_OFFSET_BASE_L4 _AC(0xffff888000000000, UL) #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT #define __PAGE_OFFSET page_offset_base diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h index 04edd2d58211..84bd9bdc1987 100644 --- a/arch/x86/include/asm/pgtable_64_types.h +++ b/arch/x86/include/asm/pgtable_64_types.h @@ -111,9 +111,7 @@ extern unsigned int ptrs_per_p4d; */ #define MAXMEM (1UL << MAX_PHYSMEM_BITS) -#define LDT_PGD_ENTRY_L4 -3UL -#define LDT_PGD_ENTRY_L5 -112UL -#define LDT_PGD_ENTRY (pgtable_l5_enabled() ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4) +#define LDT_PGD_ENTRY -240UL #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT) #define LDT_END_ADDR (LDT_BASE_ADDR + PGDIR_SIZE) diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c index dd461c0167ef..2c84c6ad8b50 100644 --- a/arch/x86/xen/mmu_pv.c +++ b/arch/x86/xen/mmu_pv.c @@ -1897,7 +1897,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) init_top_pgt[0] = __pgd(0); /* Pre-constructed entries are in pfn, so convert to mfn */ - /* L4[272] -> level3_ident_pgt */ + /* L4[273] -> level3_ident_pgt */ /* L4[511] -> level3_kernel_pgt */ convert_pfn_mfn(init_top_pgt); @@ -1917,8 +1917,8 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) addr[0] = (unsigned long)pgd; addr[1] = (unsigned long)l3; addr[2] = (unsigned long)l2; - /* Graft it onto L4[272][0]. Note that we creating an aliasing problem: - * Both L4[272][0] and L4[511][510] have entries that point to the same + /* Graft it onto L4[273][0]. Note that we creating an aliasing problem: + * Both L4[273][0] and L4[511][510] have entries that point to the same * L2 (PMD) tables. Meaning that if you modify it in __va space * it will be also modified in the __ka space! (But if you just * modify the PMD table to point to other PTE's or none, then you
On 5-level paging LDT remap area is placed in the middle of KASLR randomization region and it can overlap with direct mapping, vmalloc or vmap area. Let's move LDT just before direct mapping which makes it safe for KASLR. This also allows us to unify layout between 4- and 5-level paging. We don't touch 4 pgd slot gap just before the direct mapping reserved for a hypervisor, but move direct mapping by one slot instead. The LDT mapping is per-mm, so we cannot move it into P4D page table next to CPU_ENTRY_AREA without complicating PGD table allocation for 5-level paging. Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") --- Documentation/x86/x86_64/mm.txt | 8 ++++---- arch/x86/include/asm/page_64_types.h | 12 +++++++----- arch/x86/include/asm/pgtable_64_types.h | 4 +--- arch/x86/xen/mmu_pv.c | 6 +++--- 4 files changed, 15 insertions(+), 15 deletions(-)