Messages in this thread | | | Date | Tue, 18 Nov 2014 18:11:57 +0100 (CET) | From | Thomas Gleixner <> | Subject | Re: [PATCH v2] x86, mm: set NX across entire PMD at boot |
| |
On Fri, 14 Nov 2014, Kees Cook wrote: > On Fri, Nov 14, 2014 at 6:29 PM, Yinghai Lu <yinghai@kernel.org> wrote: > > On Fri, Nov 14, 2014 at 5:29 PM, Yinghai Lu <yinghai@kernel.org> wrote: > >> On Fri, Nov 14, 2014 at 12:45 PM, Kees Cook <keescook@chromium.org> wrote: > >>> v2: > >>> - added call to free_init_pages(), as suggested by tglx > > > >> something is wrong: > >> > >> [ 7.842479] Freeing unused kernel memory: 3844K (ffffffff82e52000 - > >> ffffffff83213000) > >> [ 7.843305] Write protecting the kernel read-only data: 28672k > > > > .... > > should use attached one instead. > > > > 1. should use _brk_end instead of &end, as we only use partial of > > brk. > > 2. [_brk_end, pm_end) page range is already converted. aka > > is not wasted. > > Are you sure? For me, _brk_end isn't far enough:
_brk_end is guaranteed to be <= _end. But we really want to use _brk_end here, because if we have the following situation:
_brk_start: 0x03ff0000 _brk_end: 0x03ffff00 _end: 0x04016000
So we have the following PMDs setup:
0x03e00000 pmd rw nx <- covers the top of .bss and the start of .brk 0x04000000 pmd rw nx <- covers the end of .brk and some random unused
So if _brk_end is less than 0x04000000, then cleanup_highmem() has zapped the extra PMD already. So we don't want to call set_nx() on that.
If _brk_end is >= 0x04000000 then we cover that last pmd with the set_nx call.
Completely non obvious as anything else in that area.
Thanks,
tglx
| |