Patch "x86/cpu_entry_area: Move it out of the fixmap" has been added to the 4.14-stable tree
Subsystems (7)
This is a note to let you know that I've just added the patch titled
x86/cpu_entry_area: Move it out of the fixmap
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-cpu_entry_area-move-it-out-of-the-fixmap.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
92a0f81d89571e3e8759366e050ee05cc545ef99Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <[email protected]>
Date: Wed, 20 Dec 2017 18:51:31 +0100
Subject: x86/cpu_entry_area: Move it out of the fixmap
From: Thomas Gleixner <[email protected]>
commit 92a0f81d89571e3e8759366e050ee05cc545ef99 upstream.
Put the cpu_entry_area into a separate P4D entry. The fixmap gets too big and 0-day already hit a case where the fixmap PTEs were cleared by cleanup_highmap().
Aside of that the fixmap API is a pain as it's all backwards.
--- Documentation/x86/x86_64/mm.txt | 2 arch/x86/include/asm/cpu_entry_area.h | 18 ++++++++ arch/x86/include/asm/desc.h | 1 arch/x86/include/asm/fixmap.h | 32 --------------- arch/x86/include/asm/pgtable_32_types.h | 15 +++++-- arch/x86/include/asm/pgtable_64_types.h | 47 +++++++++++++--------- arch/x86/kernel/dumpstack.c | 1 arch/x86/kernel/traps.c | 5 +- arch/x86/mm/cpu_entry_area.c | 66 ++++++++++++++++++++++++-------- arch/x86/mm/dump_pagetables.c | 6 ++ arch/x86/mm/init_32.c | 6 ++ arch/x86/mm/kasan_init_64.c | 29 +++++++------- arch/x86/mm/pgtable_32.c | 1 arch/x86/xen/mmu_pv.c | 2 14 files changed, 143 insertions(+), 88 deletions(-)
Documentation/x86/x86_64/mm.txt +2 -0
@@ -12,6 +12,7 @@ ffffea0000000000 - ffffeaffffffffff (=40 ... unused hole ... ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB) ... unused hole ... +fffffe8000000000 - fffffeffffffffff (=39 bits) cpu_entry_area mapping ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks ... unused hole ... ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space
@@ -35,6 +36,7 @@ ffd4000000000000 - ffd5ffffffffffff (=49 ... unused hole ... ffdf000000000000 - fffffc0000000000 (=53 bits) kasan shadow memory (8PB) ... unused hole ... +fffffe8000000000 - fffffeffffffffff (=39 bits) cpu_entry_area mapping ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks ... unused hole ... ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space
arch/x86/include/asm/cpu_entry_area.h +17 -1
@@ -43,10 +43,26 @@ struct cpu_entry_area { };#define CPU_ENTRY_AREA_SIZE (sizeof(struct cpu_entry_area)) -#define CPU_ENTRY_AREA_PAGES (CPU_ENTRY_AREA_SIZE / PAGE_SIZE) +#define CPU_ENTRY_AREA_TOT_SIZE (CPU_ENTRY_AREA_SIZE * NR_CPUS) DECLARE_PER_CPU(struct cpu_entry_area *, cpu_entry_area);extern void setup_cpu_entry_areas (void ); +extern void cea_set_pte (void *cea_vaddr,phys_addr_t pa,pgprot_t flags); + +#define CPU_ENTRY_AREA_RO_IDT CPU_ENTRY_AREA_BASE +#define CPU_ENTRY_AREA_PER_CPU (CPU_ENTRY_AREA_RO_IDT + PAGE_SIZE) + +#define CPU_ENTRY_AREA_RO_IDT_VADDR ((void *)CPU_ENTRY_AREA_RO_IDT) + +#define CPU_ENTRY_AREA_MAP_SIZE \ + (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_TOT_SIZE - CPU_ENTRY_AREA_BASE) + +extern struct cpu_entry_area *get_cpu_entry_area (int cpu); + +static inline struct entry_stack *cpu_entry_stack (int cpu) +{ +return &get_cpu_entry_area (cpu)->entry_stack_page.stack; +}#endif
arch/x86/include/asm/desc.h +1 -0
@@ -7,6 +7,7 @@#include <asm/mmu.h> #include <asm/fixmap.h> #include <asm/irq_vectors.h> +#include <asm/cpu_entry_area.h> #include <linux/smp.h> #include <linux/percpu.h>
arch/x86/include/asm/fixmap.h +1 -31
@@ -25,7 +25,6 @@#else #include <uapi/asm/vsyscall.h> #endif -#include <asm/cpu_entry_area.h> /* * We can't declare FIXADDR_TOP as variable for x86_64 because vsyscall
@@ -84,7 +83,6 @@ enum fixed_addresses { FIX_IO_APIC_BASE_0, FIX_IO_APIC_BASE_END = FIX_IO_APIC_BASE_0 + MAX_IO_APICS - 1,#endif -FIX_RO_IDT ,/* Virtual mapping for read-only IDT */ #ifdef CONFIG_X86_32 FIX_KMAP_BEGIN ,/* reserved pte's for temporary kernel mappings */ FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
@@ -100,9 +98,6 @@ enum fixed_addresses {#ifdef CONFIG_X86_INTEL_MID FIX_LNW_VRTC,#endif -/* Fixmap entries to remap the GDTs, one per processor. */ -FIX_CPU_ENTRY_AREA_TOP , -FIX_CPU_ENTRY_AREA_BOTTOM =FIX_CPU_ENTRY_AREA_TOP + (CPU_ENTRY_AREA_PAGES *NR_CPUS ) -1 ,#ifdef CONFIG_ACPI_APEI_GHES /* Used for GHES mapping from assorted contexts */
@@ -143,7 +138,7 @@ enum fixed_addresses {extern void reserve_top_address (unsigned long reserve);#define FIXADDR_SIZE (__end_of_permanent_fixed_addresses << PAGE_SHIFT) -#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) +#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE)extern int fixmaps_set;
@@ -191,30 +186,5 @@ void __init *early_memremap_decrypted_wpvoid __early_set_fixmap (enum fixed_addresses idx,phys_addr_t phys,pgprot_t flags); -static inline unsigned int __get_cpu_entry_area_page_index (int cpu,int page) -{ -BUILD_BUG_ON (sizeof (struct cpu_entry_area ) %PAGE_SIZE !=0 ); - -return FIX_CPU_ENTRY_AREA_BOTTOM - cpu*CPU_ENTRY_AREA_PAGES - page; -} - -#define __get_cpu_entry_area_offset_index (cpu, offset) ({ \ - BUILD_BUG_ON(offset % PAGE_SIZE != 0); \ - __get_cpu_entry_area_page_index(cpu, offset / PAGE_SIZE); \ - }) - -#define get_cpu_entry_area_index (cpu, field) \ - __get_cpu_entry_area_offset_index((cpu), offsetof(struct cpu_entry_area, field)) - -static inline struct cpu_entry_area *get_cpu_entry_area (int cpu) -{ -return (struct cpu_entry_area *)__fix_to_virt (__get_cpu_entry_area_page_index (cpu,0 )); -} - -static inline struct entry_stack *cpu_entry_stack (int cpu) -{ -return &get_cpu_entry_area (cpu)->entry_stack_page.stack; -} -#endif /* !__ASSEMBLY__ */ #endif /* _ASM_X86_FIXMAP_H */
arch/x86/include/asm/pgtable_32_types.h +12 -3
@@ -38,13 +38,22 @@ extern bool __vmalloc_start_set; /* set#define LAST_PKMAP 1024#endif -#define PKMAP_BASE ((FIXADDR_START - PAGE_SIZE * (LAST_PKMAP + 1)) \ - & PMD_MASK) +/* +* Define this here and validate with BUILD_BUG_ON() in pgtable_32.c +* to avoid include recursion hell +*/ +#define CPU_ENTRY_AREA_PAGES (NR_CPUS * 40) + +#define CPU_ENTRY_AREA_BASE \ + ((FIXADDR_START - PAGE_SIZE * (CPU_ENTRY_AREA_PAGES + 1)) & PMD_MASK) + +#define PKMAP_BASE \ + ((CPU_ENTRY_AREA_BASE - PAGE_SIZE) & PMD_MASK)#ifdef CONFIG_HIGHMEM # define VMALLOC_END (PKMAP_BASE - 2 * PAGE_SIZE)#else -# define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE) +# define VMALLOC_END (CPU_ENTRY_AREA_BASE - 2 * PAGE_SIZE)#endif #define MODULES_VADDR VMALLOC_START
arch/x86/include/asm/pgtable_64_types.h +28 -19
60 lines not on this page · raw message
arch/x86/kernel/dumpstack.c +1 -0
@@ -18,6 +18,7 @@#include <linux/nmi.h> #include <linux/sysfs.h> +#include <asm/cpu_entry_area.h> #include <asm/stacktrace.h> #include <asm/unwind.h>
arch/x86/kernel/traps.c +3 -2
@@ -951,8 +951,9 @@ void __init trap_init(void)* "sidt" instruction will not leak the location of the kernel, and * to defend the IDT against arbitrary memory write vulnerabilities. * It will be reloaded in cpu_init() */ -__set_fixmap (FIX_RO_IDT ,__pa_symbol (idt_table),PAGE_KERNEL_RO ); - idt_descr.address =fix_to_virt (FIX_RO_IDT ); +cea_set_pte (CPU_ENTRY_AREA_RO_IDT_VADDR ,__pa_symbol (idt_table), +PAGE_KERNEL_RO ); + idt_descr.address =CPU_ENTRY_AREA_RO_IDT ;/* * Should be a barrier for any external CPU state:
arch/x86/mm/cpu_entry_area.c +50 -16
101 lines not on this page · raw message
arch/x86/mm/dump_pagetables.c +5 -1
@@ -58,6 +58,7 @@ enum address_markers_idx {KASAN_SHADOW_START_NR ,KASAN_SHADOW_END_NR , #endif +CPU_ENTRY_AREA_NR , #ifdef CONFIG_X86_ESPFIX64 ESPFIX_START_NR, #endif
@@ -81,6 +82,7 @@ static struct addr_marker address_marker [KASAN_SHADOW_START_NR] = { KASAN_SHADOW_START, "KASAN shadow" }, [KASAN_SHADOW_END_NR] = { KASAN_SHADOW_END, "KASAN shadow end" }, #endif + [CPU_ENTRY_AREA_NR] = { CPU_ENTRY_AREA_BASE,"CPU entry Area" }, #ifdef CONFIG_X86_ESPFIX64 [ESPFIX_START_NR] = { ESPFIX_BASE_ADDR, "ESPfix Area", 16 }, #endif
@@ -104,6 +106,7 @@ enum address_markers_idx {#ifdef CONFIG_HIGHMEM PKMAP_BASE_NR , #endif +CPU_ENTRY_AREA_NR ,FIXADDR_START_NR , END_OF_SPACE_NR, };
@@ -116,6 +119,7 @@ static struct addr_marker address_marker #ifdef CONFIG_HIGHMEM [PKMAP_BASE_NR ] = {0UL ,"Persistent kmap() Area" }, #endif + [CPU_ENTRY_AREA_NR] = { 0UL, "CPU entry area" }, [FIXADDR_START_NR] = { 0UL, "Fixmap area" }, [END_OF_SPACE_NR ] = {-1 ,NULL } };
@@ -541,8 +545,8 @@ static int __init pt_dump_init(void) address_markers[PKMAP_BASE_NR ].start_address =PKMAP_BASE ;# endif address_markers[FIXADDR_START_NR ].start_address =FIXADDR_START ; + address_markers[CPU_ENTRY_AREA_NR ].start_address =CPU_ENTRY_AREA_BASE ;#endif -return 0 ; }__initcall (pt_dump_init);
arch/x86/mm/init_32.c +6 -0
@@ -50,6 +50,7 @@#include <asm/setup.h> #include <asm/set_memory.h> #include <asm/page_types.h> +#include <asm/cpu_entry_area.h> #include <asm/init.h> #include "mm_internal.h"
@@ -766,6 +767,7 @@ void __init mem_init(void)mem_init_print_info (NULL ); printk(KERN_INFO "virtual kernel memory layout:\n" " fixmap : 0x%08lx - 0x%08lx (%4ld kB)\n" + " cpu_entry : 0x%08lx - 0x%08lx (%4ld kB)\n" #ifdef CONFIG_HIGHMEM " pkmap : 0x%08lx - 0x%08lx (%4ld kB)\n" #endif
@@ -777,6 +779,10 @@ void __init mem_init(void)FIXADDR_START ,FIXADDR_TOP , (FIXADDR_TOP -FIXADDR_START ) >>10 , +CPU_ENTRY_AREA_BASE , +CPU_ENTRY_AREA_BASE +CPU_ENTRY_AREA_MAP_SIZE , +CPU_ENTRY_AREA_MAP_SIZE >>10 , + #ifdef CONFIG_HIGHMEMPKMAP_BASE ,PKMAP_BASE +LAST_PKMAP *PAGE_SIZE , (LAST_PKMAP*PAGE_SIZE) >> 10,
arch/x86/mm/kasan_init_64.c +16 -13
@@ -15,6 +15,7 @@#include <asm/tlbflush.h> #include <asm/sections.h> #include <asm/pgtable.h> +#include <asm/cpu_entry_area.h> extern struct range pfn_mapped[E820_MAX_ENTRIES ];
@@ -322,31 +323,33 @@ void __init kasan_init(void)map_range (&pfn_mapped[i]); } -kasan_populate_zero_shadow ( -kasan_mem_to_shadow ((void *)PAGE_OFFSET +MAXMEM ), -kasan_mem_to_shadow ((void *)__START_KERNEL_map)); - -kasan_populate_shadow ((unsigned long )kasan_mem_to_shadow (_stext), - (unsigned long )kasan_mem_to_shadow (_end), -early_pfn_to_nid (__pa (_stext))); - - shadow_cpu_entry_begin = (void *)__fix_to_virt (FIX_CPU_ENTRY_AREA_BOTTOM ); + shadow_cpu_entry_begin = (void *)CPU_ENTRY_AREA_BASE ; shadow_cpu_entry_begin =kasan_mem_to_shadow (shadow_cpu_entry_begin); shadow_cpu_entry_begin = (void *)round_down ((unsigned long )shadow_cpu_entry_begin,PAGE_SIZE ); - shadow_cpu_entry_end = (void *)(__fix_to_virt (FIX_CPU_ENTRY_AREA_TOP ) +PAGE_SIZE ); + shadow_cpu_entry_end = (void *)(CPU_ENTRY_AREA_BASE + +CPU_ENTRY_AREA_MAP_SIZE ); shadow_cpu_entry_end =kasan_mem_to_shadow (shadow_cpu_entry_end); shadow_cpu_entry_end = (void *)round_up ((unsigned long )shadow_cpu_entry_end,PAGE_SIZE ); -kasan_populate_zero_shadow (kasan_mem_to_shadow ((void *)MODULES_END ), - shadow_cpu_entry_begin); +kasan_populate_zero_shadow ( +kasan_mem_to_shadow ((void *)PAGE_OFFSET +MAXMEM ), + shadow_cpu_entry_begin);kasan_populate_shadow ((unsigned long )shadow_cpu_entry_begin, (unsigned long )shadow_cpu_entry_end,0 ); -kasan_populate_zero_shadow (shadow_cpu_entry_end, (void *)KASAN_SHADOW_END ); +kasan_populate_zero_shadow (shadow_cpu_entry_end, +kasan_mem_to_shadow ((void *)__START_KERNEL_map)); + +kasan_populate_shadow ((unsigned long )kasan_mem_to_shadow (_stext), + (unsigned long )kasan_mem_to_shadow (_end), +early_pfn_to_nid (__pa (_stext))); + +kasan_populate_zero_shadow (kasan_mem_to_shadow ((void *)MODULES_END ), + (void *)KASAN_SHADOW_END );load_cr3 (init_top_pgt);__flush_tlb_all ();
arch/x86/mm/pgtable_32.c +1 -0
@@ -10,6 +10,7 @@#include <linux/pagemap.h> #include <linux/spinlock.h> +#include <asm/cpu_entry_area.h> #include <asm/pgtable.h> #include <asm/pgalloc.h> #include <asm/fixmap.h>
arch/x86/xen/mmu_pv.c +0 -2
@@ -2261,7 +2261,6 @@ static void xen_set_fixmap(unsigned idx,switch (idx) { case FIX_BTMAP_END ... FIX_BTMAP_BEGIN: -case FIX_RO_IDT :#ifdef CONFIG_X86_32 case FIX_WP_TEST :# ifdef CONFIG_HIGHMEM
@@ -2272,7 +2271,6 @@ static void xen_set_fixmap(unsigned idx,#endif case FIX_TEXT_POKE0 :case FIX_TEXT_POKE1 : - case FIX_CPU_ENTRY_AREA_TOP ... FIX_CPU_ENTRY_AREA_BOTTOM:/* All local page mappings */ pte =pfn_pte (phys, prot);break ;
Patches currently in stable-queue which might be from [email protected] are
queue-4.14/x86-entry-rename-sysenter_stack-to-cpu_entry_area_entry_stack.patch queue-4.14/x86-mm-put-mmu-to-hardware-asid-translation-in-one-place.patch queue-4.14/x86-vsyscall-64-explicitly-set-_page_user-in-the-pagetable-hierarchy.patch queue-4.14/x86-uv-use-the-right-tlb-flush-api.patch queue-4.14/x86-decoder-fix-and-update-the-opcodes-map.patch queue-4.14/x86-mm-dump_pagetables-check-page_present-for-real.patch queue-4.14/x86-ldt-prevent-ldt-inheritance-on-exec.patch queue-4.14/x86-microcode-dont-abuse-the-tlb-flush-interface.patch queue-4.14/x86-doc-remove-obvious-weirdnesses-from-the-x86-mm-layout-documentation.patch queue-4.14/init-invoke-init_espfix_bsp-from-mm_init.patch queue-4.14/x86-cpu_entry_area-move-it-to-a-separate-unit.patch queue-4.14/x86-vsyscall-64-warn-and-fail-vsyscall-emulation-in-native-mode.patch queue-4.14/x86-mm-create-asm-invpcid.h.patch queue-4.14/x86-cpu_entry_area-prevent-wraparound-in-setup_cpu_entry_area_ptes-on-32bit.patch queue-4.14/x86-mm-remove-superfluous-barriers.patch queue-4.14/x86-ldt-rework-locking.patch queue-4.14/pci-pm-force-devices-to-d0-in-pci_pm_thaw_noirq.patch queue-4.14/arch-mm-allow-arch_dup_mmap-to-fail.patch queue-4.14/x86-cpu_entry_area-move-it-out-of-the-fixmap.patch queue-4.14/tools-headers-sync-objtool-uapi-header.patch queue-4.14/x86-mm-remove-hard-coded-asid-limit-checks.patch queue-4.14/x86-kconfig-limit-nr_cpus-on-32-bit-to-a-sane-amount.patch queue-4.14/objtool-fix-64-bit-build-on-32-bit-host.patch queue-4.14/x86-mm-add-comments-to-clarify-which-tlb-flush-functions-are-supposed-to-flush-what.patch queue-4.14/x86-mm-move-the-cr3-construction-functions-to-tlbflush.h.patch queue-4.14/x86-mm-dump_pagetables-make-the-address-hints-correct-and-readable.patch queue-4.14/x86-insn-eval-add-utility-functions-to-get-segment-selector.patch queue-4.14/objtool-move-synced-files-to-their-original-relative-locations.patch queue-4.14/x86-mm-use-__flush_tlb_one-for-kernel-memory.patch queue-4.14/objtool-move-kernel-headers-code-sync-check-to-a-script.patch queue-4.14/x86-mm-64-improve-the-memory-map-documentation.patch queue-4.14/objtool-fix-cross-build.patch