lkml.org 
[lkml]   [2012]   [Dec]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [RFC] stack and heap are executable on x86_64
From
On Fri, Dec 21, 2012 at 9:01 AM, H. Peter Anvin <hpa@zytor.com> wrote:
> On 12/20/2012 10:27 PM, Yinghai Lu wrote:
>>
>>
>> after for-x86-boot we will have
>> ---[ Low Kernel Mapping ]---
>> 0xffff880000000000-0xffff880000099000 612K RW GLB
>> NX pte
>> 0xffff880000099000-0xffff88000009a000 4K ro GLB
>> NX pte
>> 0xffff88000009a000-0xffff88000009b000 4K ro GLB
>> x pte
>> 0xffff88000009b000-0xffff880000200000 1428K RW GLB
>> NX pte
>> 0xffff880000200000-0xffff8800dfe00000 3580M RW PSE GLB
>> NX pmd
>> 0xffff8800dfe00000-0xffff8800dfffe000 2040K RW GLB
>> NX pte
>> 0xffff8800dfffe000-0xffff8800e0000000 8K
>> pte
>> 0xffff8800e0000000-0xffff880100000000 512M
>> pmd
>> 0xffff880100000000-0xffff8801a0000000 2560M RW PSE GLB
>> NX pmd
>> ---[ High Kernel Mapping ]---
>> 0xffffffff80000000-0xffffffff81000000 16M
>> pmd
>> 0xffffffff81000000-0xffffffff82a00000 26M RW PSE GLB
>> x pmd
>> 0xffffffff82a00000-0xffffffff82b21000 1156K RW GLB
>> x pte
>> 0xffffffff82b21000-0xffffffff82c00000 892K RW GLB
>> NX pte
>> 0xffffffff82c00000-0xffffffff82e00000 2M RW PSE GLB
>> NX pmd
>> 0xffffffff82e00000-0xffffffff82e92000 584K RW GLB
>> NX pte
>> 0xffffffff82e92000-0xffffffff83000000 1464K RW GLB
>> x pte
>> 0xffffffff83000000-0xffffffff83c00000 12M RW PSE GLB
>> x pmd
>> 0xffffffff83c00000-0xffffffffa0000000 452M
>> pmd
>>
>> so low mapping will only have trampoline get x set.
>> is that expected ?
>>
>
> Yes.
>
>
>> Do we need to set low mapping corresponding to kernel range to x?
>
>
> No; we probably should never have the low mappings set to X, which comes
> down to what I said earlier... we should mark the low mapping NX at the
> PGD/PML4 level.
>
> However, this isn't good enough. You still have a large number of pages
> which are RWX, and we should *never* have RWX pages, period, full stop, and
> your map above sill have megabytes of them.

which line?

0xffffffff83000000-0xffffffff83c00000 12M RW PSE
GLB x pmd

my kernel INIT_SIZE is 27M, and it includes everything that i needed
in the kernel.

>
> Furthermore, just saying "we applied this patchset and it seems to go away"
> isn't good enough... we need an understanding of *why* it makes things go
> away and how that makes it safe.

i know the reason:

current kernel set x from trampoline to be x too late. So it set EXEC
in head_64.c for all 1G range.

so patch
http://git.kernel.org/?p=linux/kernel/git/yinghai/linux-yinghai.git;a=commitdiff;h=b927466d72df250fa9b79fce3624cd5efd1317b7
set that x early.
and in #PF handler version:
http://git.kernel.org/?p=linux/kernel/git/yinghai/linux-yinghai.git;a=commitdiff;h=3c06147be8e6db30dba4cafb170ad66f7baffbfc
init_mapping_kernel will set mapping for kernel and first 2M to
LARGEPAGE only without EXEC.

that is the reason why #PF handler version does not work with SMP.


\
 
 \ /
  Last update: 2012-12-21 19:01    [W:0.053 / U:0.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site