On Mon, Jun 12, 2023 at 12:14:54PM +0100, Mark Rutland wrote: > Hi Russell, > > On Tue, May 30, 2023 at 03:04:40PM +0100, Russell King (Oracle) wrote: > > Kernel text replication needs to maintain separate per-node page > > tables for the kernel text. In order to do this without affecting > > other kernel memory mappings, placing the kernel such that it does > > not share a L0 page table entry with any other mapping is desirable. > > > > Prior to this commit, the layout without KASLR was: > > > > +----------+ > > | vmalloc | > > +----------+ > > | Kernel | > > +----------+ MODULES_END, VMALLOC_START, KIMAGE_VADDR = > > | Modules | MODULES_VADDR + MODULES_VSIZE > > +----------+ MODULES_VADDR = _PAGE_END(VA_BITS_MIN) > > | VA space | > > +----------+ 0 > > > > This becomes: > > > > +----------+ > > | vmalloc | > > +----------+ VMALLOC_START = MODULES_END + PGDIR_SIZE > > | Kernel | > > +----------+ MODULES_END, KIMAGE_VADDR = _PAGE_END(VA_BITS_MIN) + PGDIR_SIZE > > | Modules | > > +----------+ MODULES_VADDR = MODULES_END - MODULES_VSIZE > > | VA space | > > +----------+ 0 > > With KSASLR we may randomize the kernel and module space over a substantial > portion of the vmalloc range. Are you expecting that text replication is going > to restruct that range, or that we'd make it mutually exclusive with KASLR? In the patch that adds the REPLICATE_KTEXT config option, I've made it exclusive with RANDOMIZE_BASE, but this change in layout isn't dependent on REPLICATE_KTEXT. I've tested it with RANDOMIZE_BASE=y, and nothing seems to get upset, so I believe that this patch doesn't cause any negative issues. > I also note that the L0 table could have as few as two entries (with 16K pages > and 4 levels). So either we'd need to also mess with an L1 table, or make text > replication mutually exclusive with such configurations. Ah, thanks for pointing that out - I was hoping to avoid needing to touch anything but L0 tables. However, it brings up a question: are there any NUMA systems that would have just two entries in the L0 table? I suspect NUMA systems have lots of RAM, and so would want a page table layout that results in multiple L0 entries. > > This assumes MODULES_VSIZE (128M) <= PGDIR_SIZE. > > As a heads-up, we've just changed MODULES_VSIZE to be 2G in > > https://lore.kernel.org/linux-arm-kernel/20230530110328.2213762-1-mark.rutland@xxxxxxx/ > > .. which is queued in the arm64 for-next/module-alloc branch: > > https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/log/?h=for-next/module-alloc Ok - so I need to get a bit more clever about calculating MODULES_END and KIMAGE_VADDR > > One side effect of this change is that KIMAGE_VADDR's definition now > > includes PGDIR_SIZE (to leave room for the modules) but this is not > > defined when asm/memory.h is included. This means KIMAGE_VADDR can > > not be used in inline functions within this file, so we convert > > kaslr_offset() and kaslr_enabled() to be macros instead. > > That series above also decoupled kaslr_enabled() from kaslr_offset(), > so we'd only need to change kaslr_offset(). Ok, I'll take a look to see how my changes are impacted. > > diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c > > index 4829abe017e9..baf74d0c43c9 100644 > > --- a/arch/arm64/mm/mmu.c > > +++ b/arch/arm64/mm/mmu.c > > @@ -478,7 +478,8 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys, > > static void update_mapping_prot(phys_addr_t phys, unsigned long virt, > > phys_addr_t size, pgprot_t prot) > > { > > - if ((virt >= PAGE_END) && (virt < VMALLOC_START)) { > > + if ((virt >= PAGE_END) && (virt < VMALLOC_START) && > > + !is_kernel(virt)) { > > pr_warn("BUG: not updating mapping for %pa at 0x%016lx - outside kernel range\n", > > &phys, virt); > > return; > > I think the existing conditions here aren't quite right, and have become bogus > over time, and I don't think that the is_kernel() check is necessary here. > > Originally, back in commit: > > c1cc1552616d0f35 ("arm64: MMU initialisation") > > We had: > > if (virt < VMALLOC_START) { > pr_warning("BUG: not creating mapping for 0x%016llx at 0x%016lx - outside kernel range\n", > phys, virt); > return; > } > > ... which checked that the VA range we were manipulating was in the TTBR1 VA > range, as at the time, VMALLOC_START happened to be the lowest TTBR1 address. > > That didn't substantially change until commit: > > 14c127c957c1c607 ("arm64: mm: Flip kernel VA space") > > ... when the test was changed to: > > if ((virt >= VA_START) && (virt < VMALLOC_START)) { > pr_warn("BUG: not creating mapping for %pa at 0x%016lx - outside kernel range\n", > &phys, virt); > return; > } > > Note: in that commit, VA_START was actually the end of the linear map (which > was itself a the start of the TTBR1 address space), so this is just checking if > we're poking a small portion of the TTBR1 address space, rather than if we're > poking *outside* of the TTBR1 address space. > > That doesn't make much sense, and I'm pretty sure that was a thinko rather than > an intentional change of semantic. > > I "fixed" that without thinking in commit: > > 77ad4ce69321abbe ("arm64: memory: rename VA_START to PAGE_END") > > ... making that: > > if ((virt >= PAGE_END) && (virt < VMALLOC_START)) { > pr_warn("BUG: not creating mapping for %pa at 0x%016lx - outside kernel range\n", > &phys, virt); > return; > } > > ... but clearly it has lost the original semantic and doesn't make much sense. > > I think the test should actually be something like: > > /* Must be a TTBR1 address */ > if (virt < PAGE_OFFSET ) { > ... > } > > ... and then we won't randomly trip for kernel mappings if those fall between > the linear map and vmalloc range. Okay, so that sounds like if this is fixed, then I won't need to patch it! Yay! -- RMK's Patch system: https://www.armlinux.org.uk/developer/patches/ FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
