Re: [RFC] stack and heap are executable on x86_64

[Yinghai Lu]

On Fri, Dec 21, 2012 at 9:01 AM, H. Peter Anvin <hpa@xxxxxxxxx> wrote:
> On 12/20/2012 10:27 PM, Yinghai Lu wrote:
>>
>>
>> after for-x86-boot we will have
>> ---[ Low Kernel Mapping ]---
>> 0xffff880000000000-0xffff880000099000         612K     RW             GLB
>> NX pte
>> 0xffff880000099000-0xffff88000009a000           4K     ro             GLB
>> NX pte
>> 0xffff88000009a000-0xffff88000009b000           4K     ro             GLB
>> x  pte
>> 0xffff88000009b000-0xffff880000200000        1428K     RW             GLB
>> NX pte
>> 0xffff880000200000-0xffff8800dfe00000        3580M     RW         PSE GLB
>> NX pmd
>> 0xffff8800dfe00000-0xffff8800dfffe000        2040K     RW             GLB
>> NX pte
>> 0xffff8800dfffe000-0xffff8800e0000000           8K
>> pte
>> 0xffff8800e0000000-0xffff880100000000         512M
>> pmd
>> 0xffff880100000000-0xffff8801a0000000        2560M     RW         PSE GLB
>> NX pmd
>> ---[ High Kernel Mapping ]---
>> 0xffffffff80000000-0xffffffff81000000          16M
>> pmd
>> 0xffffffff81000000-0xffffffff82a00000          26M     RW         PSE GLB
>> x  pmd
>> 0xffffffff82a00000-0xffffffff82b21000        1156K     RW             GLB
>> x  pte
>> 0xffffffff82b21000-0xffffffff82c00000         892K     RW             GLB
>> NX pte
>> 0xffffffff82c00000-0xffffffff82e00000           2M     RW         PSE GLB
>> NX pmd
>> 0xffffffff82e00000-0xffffffff82e92000         584K     RW             GLB
>> NX pte
>> 0xffffffff82e92000-0xffffffff83000000        1464K     RW             GLB
>> x  pte
>> 0xffffffff83000000-0xffffffff83c00000          12M     RW         PSE GLB
>> x  pmd
>> 0xffffffff83c00000-0xffffffffa0000000         452M
>> pmd
>>
>> so low mapping will only have trampoline get x set.
>> is that expected ?
>>
>
> Yes.
>
>
>> Do we need to set low mapping corresponding to kernel range to x?
>
>
> No; we probably should never have the low mappings set to X, which comes
> down to what I said earlier... we should mark the low mapping NX at the
> PGD/PML4 level.
>
> However, this isn't good enough.  You still have a large number of pages
> which are RWX, and we should *never* have RWX pages, period, full stop, and
> your map above sill have megabytes of them.

which line?

 0xffffffff83000000-0xffffffff83c00000          12M     RW         PSE
GLB  x  pmd

my kernel INIT_SIZE is 27M, and it includes everything that i needed
in the kernel.

>
> Furthermore, just saying "we applied this patchset and it seems to go away"
> isn't good enough... we need an understanding of *why* it makes things go
> away and how that makes it safe.

i know the reason:

current kernel set x from trampoline to be x too late. So it set EXEC
in head_64.c for all 1G range.

so patch
http://git.kernel.org/?p=linux/kernel/git/yinghai/linux-yinghai.git;a=commitdiff;h=b927466d72df250fa9b79fce3624cd5efd1317b7
set that x early.
and in #PF handler version:
http://git.kernel.org/?p=linux/kernel/git/yinghai/linux-yinghai.git;a=commitdiff;h=3c06147be8e6db30dba4cafb170ad66f7baffbfc
init_mapping_kernel will set mapping for kernel  and first 2M to
LARGEPAGE only without EXEC.

that is the reason why #PF handler version does not work with SMP.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/