Commit 3566561b authored by Magnus Damm's avatar Magnus Damm Committed by Andi Kleen
Browse files

[PATCH] i386: Avoid overwriting the current pgd (V4, i386)



kexec: Avoid overwriting the current pgd (V4, i386)

This patch upgrades the i386-specific kexec code to avoid overwriting the
current pgd. Overwriting the current pgd is bad when CONFIG_CRASH_DUMP is used
to start a secondary kernel that dumps the memory of the previous kernel.

The code introduces a new set of page tables. These tables are used to provide
an executable identity mapping without overwriting the current pgd.

Signed-off-by: default avatarMagnus Damm <magnus@valinux.co.jp>
Signed-off-by: default avatarAndi Kleen <ak@suse.de>
parent 4bfaaef0
Loading
Loading
Loading
Loading
+27 −90
Original line number Diff line number Diff line
@@ -21,70 +21,13 @@
#include <asm/system.h>

#define PAGE_ALIGNED __attribute__ ((__aligned__(PAGE_SIZE)))

#define L0_ATTR (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY)
#define L1_ATTR (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY)
#define L2_ATTR (_PAGE_PRESENT)

#define LEVEL0_SIZE (1UL << 12UL)

#ifndef CONFIG_X86_PAE
#define LEVEL1_SIZE (1UL << 22UL)
static u32 pgtable_level1[1024] PAGE_ALIGNED;

static void identity_map_page(unsigned long address)
{
	unsigned long level1_index, level2_index;
	u32 *pgtable_level2;

	/* Find the current page table */
	pgtable_level2 = __va(read_cr3());

	/* Find the indexes of the physical address to identity map */
	level1_index = (address % LEVEL1_SIZE)/LEVEL0_SIZE;
	level2_index = address / LEVEL1_SIZE;

	/* Identity map the page table entry */
	pgtable_level1[level1_index] = address | L0_ATTR;
	pgtable_level2[level2_index] = __pa(pgtable_level1) | L1_ATTR;

	/* Flush the tlb so the new mapping takes effect.
	 * Global tlb entries are not flushed but that is not an issue.
	 */
	load_cr3(pgtable_level2);
}

#else
#define LEVEL1_SIZE (1UL << 21UL)
#define LEVEL2_SIZE (1UL << 30UL)
static u64 pgtable_level1[512] PAGE_ALIGNED;
static u64 pgtable_level2[512] PAGE_ALIGNED;

static void identity_map_page(unsigned long address)
{
	unsigned long level1_index, level2_index, level3_index;
	u64 *pgtable_level3;

	/* Find the current page table */
	pgtable_level3 = __va(read_cr3());

	/* Find the indexes of the physical address to identity map */
	level1_index = (address % LEVEL1_SIZE)/LEVEL0_SIZE;
	level2_index = (address % LEVEL2_SIZE)/LEVEL1_SIZE;
	level3_index = address / LEVEL2_SIZE;

	/* Identity map the page table entry */
	pgtable_level1[level1_index] = address | L0_ATTR;
	pgtable_level2[level2_index] = __pa(pgtable_level1) | L1_ATTR;
	set_64bit(&pgtable_level3[level3_index],
					       __pa(pgtable_level2) | L2_ATTR);

	/* Flush the tlb so the new mapping takes effect.
	 * Global tlb entries are not flushed but that is not an issue.
	 */
	load_cr3(pgtable_level3);
}
static u32 kexec_pgd[1024] PAGE_ALIGNED;
#ifdef CONFIG_X86_PAE
static u32 kexec_pmd0[1024] PAGE_ALIGNED;
static u32 kexec_pmd1[1024] PAGE_ALIGNED;
#endif
static u32 kexec_pte0[1024] PAGE_ALIGNED;
static u32 kexec_pte1[1024] PAGE_ALIGNED;

static void set_idt(void *newidt, __u16 limit)
{
@@ -128,16 +71,6 @@ static void load_segments(void)
#undef __STR
}

typedef asmlinkage NORET_TYPE void (*relocate_new_kernel_t)(
					unsigned long indirection_page,
					unsigned long reboot_code_buffer,
					unsigned long start_address,
					unsigned int has_pae) ATTRIB_NORET;

extern const unsigned char relocate_new_kernel[];
extern void relocate_new_kernel_end(void);
extern const unsigned int relocate_new_kernel_size;

/*
 * A architecture hook called to validate the
 * proposed image and prepare the control pages
@@ -170,25 +103,29 @@ void machine_kexec_cleanup(struct kimage *image)
 */
NORET_TYPE void machine_kexec(struct kimage *image)
{
	unsigned long page_list;
	unsigned long reboot_code_buffer;

	relocate_new_kernel_t rnk;
	unsigned long page_list[PAGES_NR];
	void *control_page;

	/* Interrupts aren't acceptable while we reboot */
	local_irq_disable();

	/* Compute some offsets */
	reboot_code_buffer = page_to_pfn(image->control_code_page)
								<< PAGE_SHIFT;
	page_list = image->head;

	/* Set up an identity mapping for the reboot_code_buffer */
	identity_map_page(reboot_code_buffer);

	/* copy it out */
	memcpy((void *)reboot_code_buffer, relocate_new_kernel,
						relocate_new_kernel_size);
	control_page = page_address(image->control_code_page);
	memcpy(control_page, relocate_kernel, PAGE_SIZE);

	page_list[PA_CONTROL_PAGE] = __pa(control_page);
	page_list[VA_CONTROL_PAGE] = (unsigned long)relocate_kernel;
	page_list[PA_PGD] = __pa(kexec_pgd);
	page_list[VA_PGD] = (unsigned long)kexec_pgd;
#ifdef CONFIG_X86_PAE
	page_list[PA_PMD_0] = __pa(kexec_pmd0);
	page_list[VA_PMD_0] = (unsigned long)kexec_pmd0;
	page_list[PA_PMD_1] = __pa(kexec_pmd1);
	page_list[VA_PMD_1] = (unsigned long)kexec_pmd1;
#endif
	page_list[PA_PTE_0] = __pa(kexec_pte0);
	page_list[VA_PTE_0] = (unsigned long)kexec_pte0;
	page_list[PA_PTE_1] = __pa(kexec_pte1);
	page_list[VA_PTE_1] = (unsigned long)kexec_pte1;

	/* The segment registers are funny things, they have both a
	 * visible and an invisible part.  Whenever the visible part is
@@ -207,8 +144,8 @@ NORET_TYPE void machine_kexec(struct kimage *image)
	set_idt(phys_to_virt(0),0);

	/* now call it */
	rnk = (relocate_new_kernel_t) reboot_code_buffer;
	(*rnk)(page_list, reboot_code_buffer, image->start, cpu_has_pae);
	relocate_kernel((unsigned long)image->head, (unsigned long)page_list,
			image->start, cpu_has_pae);
}

/* crashkernel=size@addr specifies the location to reserve for
+147 −15
Original line number Diff line number Diff line
@@ -7,16 +7,138 @@
 */

#include <linux/linkage.h>
#include <asm/page.h>
#include <asm/kexec.h>

/*
	 * Must be relocatable PIC code callable as a C function, that once
	 * it starts can not use the previous processes stack.
 * Must be relocatable PIC code callable as a C function
 */
	.globl relocate_new_kernel

#define PTR(x) (x << 2)
#define PAGE_ALIGNED (1 << PAGE_SHIFT)
#define PAGE_ATTR 0x63 /* _PAGE_PRESENT|_PAGE_RW|_PAGE_ACCESSED|_PAGE_DIRTY */
#define PAE_PGD_ATTR 0x01 /* _PAGE_PRESENT */

	.text
	.align PAGE_ALIGNED
	.globl relocate_kernel
relocate_kernel:
	movl	8(%esp), %ebp /* list of pages */

#ifdef CONFIG_X86_PAE
	/* map the control page at its virtual address */

	movl	PTR(VA_PGD)(%ebp), %edi
	movl	PTR(VA_CONTROL_PAGE)(%ebp), %eax
	andl	$0xc0000000, %eax
	shrl	$27, %eax
	addl	%edi, %eax

	movl	PTR(PA_PMD_0)(%ebp), %edx
	orl	$PAE_PGD_ATTR, %edx
	movl	%edx, (%eax)

	movl	PTR(VA_PMD_0)(%ebp), %edi
	movl	PTR(VA_CONTROL_PAGE)(%ebp), %eax
	andl	$0x3fe00000, %eax
	shrl	$18, %eax
	addl	%edi, %eax

	movl	PTR(PA_PTE_0)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)

	movl	PTR(VA_PTE_0)(%ebp), %edi
	movl	PTR(VA_CONTROL_PAGE)(%ebp), %eax
	andl	$0x001ff000, %eax
	shrl	$9, %eax
	addl	%edi, %eax

	movl	PTR(PA_CONTROL_PAGE)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)

	/* identity map the control page at its physical address */

	movl	PTR(VA_PGD)(%ebp), %edi
	movl	PTR(PA_CONTROL_PAGE)(%ebp), %eax
	andl	$0xc0000000, %eax
	shrl	$27, %eax
	addl	%edi, %eax

	movl	PTR(PA_PMD_1)(%ebp), %edx
	orl	$PAE_PGD_ATTR, %edx
	movl	%edx, (%eax)

	movl	PTR(VA_PMD_1)(%ebp), %edi
	movl	PTR(PA_CONTROL_PAGE)(%ebp), %eax
	andl	$0x3fe00000, %eax
	shrl	$18, %eax
	addl	%edi, %eax

	movl	PTR(PA_PTE_1)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)

	movl	PTR(VA_PTE_1)(%ebp), %edi
	movl	PTR(PA_CONTROL_PAGE)(%ebp), %eax
	andl	$0x001ff000, %eax
	shrl	$9, %eax
	addl	%edi, %eax

	movl	PTR(PA_CONTROL_PAGE)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)
#else
	/* map the control page at its virtual address */

	movl	PTR(VA_PGD)(%ebp), %edi
	movl	PTR(VA_CONTROL_PAGE)(%ebp), %eax
	andl	$0xffc00000, %eax
	shrl	$20, %eax
	addl	%edi, %eax

	movl	PTR(PA_PTE_0)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)

	movl	PTR(VA_PTE_0)(%ebp), %edi
	movl	PTR(VA_CONTROL_PAGE)(%ebp), %eax
	andl	$0x003ff000, %eax
	shrl	$10, %eax
	addl	%edi, %eax

	movl	PTR(PA_CONTROL_PAGE)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)

	/* identity map the control page at its physical address */

	movl	PTR(VA_PGD)(%ebp), %edi
	movl	PTR(PA_CONTROL_PAGE)(%ebp), %eax
	andl	$0xffc00000, %eax
	shrl	$20, %eax
	addl	%edi, %eax

	movl	PTR(PA_PTE_1)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)

	movl	PTR(VA_PTE_1)(%ebp), %edi
	movl	PTR(PA_CONTROL_PAGE)(%ebp), %eax
	andl	$0x003ff000, %eax
	shrl	$10, %eax
	addl	%edi, %eax

	movl	PTR(PA_CONTROL_PAGE)(%ebp), %edx
	orl	$PAGE_ATTR, %edx
	movl	%edx, (%eax)
#endif

relocate_new_kernel:
	/* read the arguments and say goodbye to the stack */
	movl  4(%esp), %ebx /* page_list */
	movl  8(%esp), %ebp /* reboot_code_buffer */
	movl  8(%esp), %ebp /* list of pages */
	movl  12(%esp), %edx /* start address */
	movl  16(%esp), %ecx /* cpu_has_pae */

@@ -24,11 +146,26 @@ relocate_new_kernel:
	pushl $0
	popfl

	/* set a new stack at the bottom of our page... */
	lea   4096(%ebp), %esp
	/* get physical address of control page now */
	/* this is impossible after page table switch */
	movl	PTR(PA_CONTROL_PAGE)(%ebp), %edi

	/* switch to new set of page tables */
	movl	PTR(PA_PGD)(%ebp), %eax
	movl	%eax, %cr3

	/* setup a new stack at the end of the physical control page */
	lea	4096(%edi), %esp

	/* jump to identity mapped page */
	movl    %edi, %eax
	addl    $(identity_mapped - relocate_kernel), %eax
	pushl   %eax
	ret

	/* store the parameters back on the stack */
	pushl   %edx /* store the start address */
identity_mapped:
	/* store the start address on the stack */
	pushl   %edx

	/* Set cr0 to a known state:
	 * 31 0 == Paging disabled
@@ -113,8 +250,3 @@ relocate_new_kernel:
	xorl    %edi, %edi
	xorl    %ebp, %ebp
	ret
relocate_new_kernel_end:

	.globl relocate_new_kernel_size
relocate_new_kernel_size:
	.long relocate_new_kernel_end - relocate_new_kernel
+27 −0
Original line number Diff line number Diff line
#ifndef _I386_KEXEC_H
#define _I386_KEXEC_H

#define PA_CONTROL_PAGE  0
#define VA_CONTROL_PAGE  1
#define PA_PGD           2
#define VA_PGD           3
#define PA_PTE_0         4
#define VA_PTE_0         5
#define PA_PTE_1         6
#define VA_PTE_1         7
#ifdef CONFIG_X86_PAE
#define PA_PMD_0         8
#define VA_PMD_0         9
#define PA_PMD_1         10
#define VA_PMD_1         11
#define PAGES_NR         12
#else
#define PAGES_NR         8
#endif

#ifndef __ASSEMBLY__

#include <asm/fixmap.h>
#include <asm/ptrace.h>
#include <asm/string.h>
@@ -72,5 +92,12 @@ static inline void crash_setup_regs(struct pt_regs *newregs,
               newregs->eip = (unsigned long)current_text_addr();
       }
}
asmlinkage NORET_TYPE void
relocate_kernel(unsigned long indirection_page,
		unsigned long control_page,
		unsigned long start_address,
		unsigned int has_pae) ATTRIB_NORET;

#endif /* __ASSEMBLY__ */

#endif /* _I386_KEXEC_H */