Messages in this thread | | | Date | Thu, 29 Aug 2019 15:01:34 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH] x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text |
| |
On Thu, Aug 29, 2019 at 12:31:34AM +0200, Thomas Gleixner wrote: > arch/x86/mm/pageattr.c | 26 ++++++++++++++++++-------- > 1 file changed, 18 insertions(+), 8 deletions(-) > > --- a/arch/x86/mm/pageattr.c > +++ b/arch/x86/mm/pageattr.c > @@ -516,7 +516,7 @@ static inline void check_conflict(int wa > */ > static inline pgprot_t static_protections(pgprot_t prot, unsigned long start, > unsigned long pfn, unsigned long npg, > - int warnlvl) > + unsigned long lpsize, int warnlvl) > { > pgprotval_t forbidden, res; > unsigned long end; > @@ -535,9 +535,17 @@ static inline pgprot_t static_protection > check_conflict(warnlvl, prot, res, start, end, pfn, "Text NX"); > forbidden = res; > > - res = protect_kernel_text_ro(start, end); > - check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO"); > - forbidden |= res; > + /* > + * Special case to preserve a large page. If the change spawns the > + * full large page mapping then there is no point to split it > + * up. Happens with ftrace and is going to be removed once ftrace > + * switched to text_poke(). > + */ > + if (lpsize != (npg * PAGE_SIZE) || (start & (lpsize - 1))) { > + res = protect_kernel_text_ro(start, end); > + check_conflict(warnlvl, prot, res, start, end, pfn, "Text RO"); > + forbidden |= res; > + }
Right, so this allows the RW (doesn't enforce RO) and thereby doesn't force split, when it is a whole large page.
> > /* Check the PFN directly */ > res = protect_pci_bios(pfn, pfn + npg - 1); > @@ -819,7 +827,7 @@ static int __should_split_large_page(pte > * extra conditional required here. > */ > chk_prot = static_protections(old_prot, lpaddr, old_pfn, numpages, > - CPA_CONFLICT); > + psize, CPA_CONFLICT); > > if (WARN_ON_ONCE(pgprot_val(chk_prot) != pgprot_val(old_prot))) { > /* > @@ -855,7 +863,7 @@ static int __should_split_large_page(pte > * protection requirement in the large page. > */ > new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages, > - CPA_DETECT); > + psize, CPA_DETECT); > > /* > * If there is a conflict, split the large page.
And these are the callsites in __should_split_large_page(), and you provide psize, and therefore we allow RW to preserve the large pages on the kernel text.
> @@ -906,7 +914,8 @@ static void split_set_pte(struct cpa_dat > if (!cpa->force_static_prot) > goto set; > > - prot = static_protections(ref_prot, address, pfn, npg, CPA_PROTECT); > + /* Hand in lpsize = 0 to enforce the protection mechanism */ > + prot = static_protections(ref_prot, address, pfn, npg, 0, CPA_PROTECT);
This is when we've already decided to split, in which case we might as well enforce the normal rules, and .lpsize=0 does just that.
> > if (pgprot_val(prot) == pgprot_val(ref_prot)) > goto set; > @@ -1503,7 +1512,8 @@ static int __change_page_attr(struct cpa > pgprot_val(new_prot) |= pgprot_val(cpa->mask_set); > > cpa_inc_4k_install(); > - new_prot = static_protections(new_prot, address, pfn, 1, > + /* Hand in lpsize = 0 to enforce the protection mechanism */ > + new_prot = static_protections(new_prot, address, pfn, 1, 0, > CPA_PROTECT);
And here we check the protections of a single 4k page, in which case large pages are irrelevant and again .lpsize=0 disables the new code.
> > new_prot = pgprot_clear_protnone_bits(new_prot);
That all seems OK I suppose.
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
| |