kdump: Allow removal of page tables for crashkernel memory

From: Michael Holzheu <[email protected]>

This patch introduces a mechanism that allows architecture backends to remove page tables for the crashkernel memory. This can protect the loaded kdump kernel from being overwritten by broken kernel code. Two new functions crash_map_reserved_pages() and crash_unmap_reserved_pages() are added that can be implemented by architecture code. The crash_map_reserved_pages() function is called before and crash_unmap_reserved_pages() after the crashkernel segments are loaded. The functions are also called in crash_shrink_memory() to create/remove page tables when the crashkernel memory size is reduced.

To support architectures that have large pages this patch also introduces a new define KEXEC_CRASH_MEM_ALIGN. The crashkernel start and size must always be aligned with KEXEC_CRASH_MEM_ALIGN.

Signed-off-by Michael Holzheu <[email protected]>

---
 include/linux/kexec.h |    6 ++++++
 kernel/kexec.c        |   21 +++++++++++++++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

include/linux/kexec.h +6 -0

@@ -37,6 +37,10 @@
 #define KEXEC_CRASH_CONTROL_MEMORY_LIMIT KEXEC_CONTROL_MEMORY_LIMIT
 #endif
 
+#ifndef KEXEC_CRASH_MEM_ALIGN
+#define KEXEC_CRASH_MEM_ALIGN PAGE_SIZE
+#endif
+
 #define KEXEC_NOTE_HEAD_BYTES ALIGN(sizeof(struct elf_note), 4)
 #define KEXEC_CORE_NOTE_NAME "CORE"
 #define KEXEC_CORE_NOTE_NAME_BYTES ALIGN(sizeof(KEXEC_CORE_NOTE_NAME), 4)

@@ -133,6 +137,8 @@ extern void crash_kexec(struct pt_regs *
 int kexec_should_crash(struct task_struct *);
 void crash_save_cpu(struct pt_regs *regs, int cpu);
 void crash_save_vmcoreinfo(void);
+void crash_map_reserved_pages(void);
+void crash_unmap_reserved_pages(void);
 void arch_crash_save_vmcoreinfo(void);
 void vmcoreinfo_append_str(const char *fmt, ...)
 	__attribute__ ((format (printf, 1, 2)));

kernel/kexec.c +19 -2

@@ -999,6 +999,7 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 			kimage_free(xchg(&kexec_crash_image, NULL));
 			result = kimage_crash_alloc(&image, entry,
 						     nr_segments, segments);
+			crash_map_reserved_pages();
 		}
 		if (result)
 			goto out;

@@ -1015,6 +1016,8 @@ SYSCALL_DEFINE4(kexec_load, unsigned lon
 				goto out;
 		}
 		kimage_terminate(image);
+		if (flags & KEXEC_ON_CRASH)
+			crash_unmap_reserved_pages();
 	}
 	/* Install the new kernel, and  Uninstall the old */
 	image = xchg(dest_image, image);

@@ -1026,6 +1029,18 @@ out:
 	return result;
 }
 
+/*
+ * Add and remove page tables for crashkernel memory
+ *
+ * Provide an empty default implementation here -- architecture
+ * code may override this
+ */
+void __weak crash_map_reserved_pages(void)
+{}
+
+void __weak crash_unmap_reserved_pages(void)
+{}
+
 #ifdef CONFIG_COMPAT
 asmlinkage long compat_sys_kexec_load(unsigned long entry,
 				unsigned long nr_segments,

@@ -1134,14 +1149,16 @@ int crash_shrink_memory(unsigned long ne
 		goto unlock;
 	}
 
-	start = roundup(start, PAGE_SIZE);
-	end = roundup(start + new_size, PAGE_SIZE);
+	start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
+	end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
 
+	crash_map_reserved_pages();
 	crash_free_reserved_phys_range(end, crashk_res.end);
 
 	if ((start == end) && (crashk_res.parent != NULL))
 		release_resource(&crashk_res);
 	crashk_res.end = end - 1;
+	crash_unmap_reserved_pages();
 
 unlock:
 	mutex_unlock(&kexec_mutex);

From: Michael Holzheu <[email protected]>

This patch implements the crash_map_pages() function for s390. KEXEC_CRASH_MEM_ALIGN is set to HPAGE_SIZE, in order to support kernel mappings that use large pages.

Signed-off-by Michael Holzheu <[email protected]>

---
 arch/s390/include/asm/kexec.h    |    3 +++
 arch/s390/kernel/machine_kexec.c |   31 +++++++++++++++++++++++++++++++
 arch/s390/kernel/setup.c         |   10 ++++++----
 3 files changed, 40 insertions(+), 4 deletions(-)

arch/s390/include/asm/kexec.h +0 -0

 /* The native architecture */
 #define KEXEC_ARCH KEXEC_ARCH_S390
 

arch/s390/kernel/machine_kexec.c +7 -0

+	BUG_ON(crashk_res.start % KEXEC_CRASH_MEM_ALIGN ||
+	       size % KEXEC_CRASH_MEM_ALIGN);
+	if (enable)
+		vmem_add_mapping(crashk_res.start, size);
+	else
+		vmem_remove_mapping(crashk_res.start, size);
+}
 
...

On Tue, 13 Sep 2011 15:26:37 +0200
Michael Holzheu <[email protected]> wrote:

arch/s390/include/asm/kexec.h line 40

Quoted 8 lines

arch/s390/include/asm/kexec.h +2 -0

@@ -36,6 +36,9 @@
 /* Allocate one page for the pdp and the second for the code */
 #define KEXEC_CONTROL_PAGE_SIZE 4096
 
+/* Alignment of crashkernel memory */
+#define KEXEC_CRASH_MEM_ALIGN HPAGE_SIZE

Why not make this unconditional, for all architectures which support hugepages? ie:

#ifdef HPAGE_SIZE
#define KEXEC_CRASH_MEM_ALIGN HPAGE_SIZE
#else
#define KEXEC_CRASH_MEM_ALIGN PAGE_SIZE
#endif

in include/linux/kexec.h?

IOW, what are the compromises here?

Also, does s390 support CONFIG_HUGETLB_PAGE=n? If so, does the use of HPAGE_SIZE still make sense? Does it compile?

Quoted 10 lines

arch/s390/include/asm/kexec.h +0 -0

 /* The native architecture */
 #define KEXEC_ARCH KEXEC_ARCH_S390
 

arch/s390/kernel/machine_kexec.c +0 -0

@@ -243,6 +243,37 @@ static void __machine_kdump(void *image)
 #endif
 

arch/s390/kernel/machine_kexec.c static void __machine_kdump(void *image) · line 250

Quoted 6 lines

arch/s390/kernel/machine_kexec.c +5 -0

 /*
+ * Map or unmap crashkernel memory
+ */
+static void crash_map_pages(int enable)
+{
+	unsigned long size = crashk_res.end - crashk_res.start + 1;

resource_size().

Hello Andrew,

Quoted 2 lines · Andrew Morton

On Tue, 13 Sep 2011 15:26:37 +0200
Michael Holzheu <[email protected]> wrote:

[snip]

Quoted 18 lines

arch/s390/include/asm/kexec.h line 40

Quoted 8 lines

arch/s390/include/asm/kexec.h +2 -0

@@ -36,6 +36,9 @@
 /* Allocate one page for the pdp and the second for the code */
 #define KEXEC_CONTROL_PAGE_SIZE 4096
 
+/* Alignment of crashkernel memory */
+#define KEXEC_CRASH_MEM_ALIGN HPAGE_SIZE

Why not make this unconditional, for all architectures which support hugepages? ie:

#ifdef HPAGE_SIZE
#define KEXEC_CRASH_MEM_ALIGN HPAGE_SIZE
#else
#define KEXEC_CRASH_MEM_ALIGN PAGE_SIZE
#endif

Quoted 3 lines

in include/linux/kexec.h?

IOW, what are the compromises here?

If we would do it that way, crashkernel memory on architectures that support large pages but do not support unmapping of crashkernel memory would always be aligned to HPAGE_SIZE. But only PAGE_SIZE alignment would be necessary in that case.

If that is acceptable I have no problem to define that unconditional for all architectures. Vivek what do you think?

Quoted 18 lines · Michael Holzheu

Quoted 9 lines

Why not make this unconditional, for all architectures which support hugepages? ie:

#ifdef HPAGE_SIZE
#define KEXEC_CRASH_MEM_ALIGN HPAGE_SIZE
#else
#define KEXEC_CRASH_MEM_ALIGN PAGE_SIZE
#endif

Quoted 3 lines

in include/linux/kexec.h?

IOW, what are the compromises here?

If we would do it that way, crashkernel memory on architectures that support large pages but do not support unmapping of crashkernel memory would always be aligned to HPAGE_SIZE. But only PAGE_SIZE alignment would be necessary in that case.

Quoted 2 lines

If that is acceptable I have no problem to define that unconditional for all architectures. Vivek what do you think?

As PAGE_SIZE alignment is sufficient for rest of the architecture, I am fine with keeping it in arch dependent files.