 fd8526ad14
			
		
	
	
	fd8526ad14
	
	
	
		
			
			Matthew noticed that hugetlb mappings don't participate in ASLR on x86-64: % for i in `seq 3`; do > tools/testing/selftests/vm/map_hugetlb | grep address > done Returned address is 0x2aaaaac00000 Returned address is 0x2aaaaac00000 Returned address is 0x2aaaaac00000 /proc/PID/maps entries for the mapping are always the same (except inode number): 2aaaaac00000-2aaabac00000 rw-p 00000000 00:0c 8200 /anon_hugepage (deleted) 2aaaaac00000-2aaabac00000 rw-p 00000000 00:0c 256 /anon_hugepage (deleted) 2aaaaac00000-2aaabac00000 rw-p 00000000 00:0c 7180 /anon_hugepage (deleted) The reason is the generic hugetlb_get_unmapped_area() function which is used on x86-64. It doesn't support randomization and use bottom-up unmapped area lookup, instead of usual top-down on x86-64. x86 has arch-specific hugetlb_get_unmapped_area(), but it's used only on x86-32. Let's use arch-specific hugetlb_get_unmapped_area() on x86-64 too. That adds ASLR and switches hugetlb mappings to use top-down unmapped area lookup: % for i in `seq 3`; do > tools/testing/selftests/vm/map_hugetlb | grep address > done Returned address is 0x7f4f08a00000 Returned address is 0x7fdda4200000 Returned address is 0x7febe0000000 /proc/PID/maps entries: 7f4f08a00000-7f4f18a00000 rw-p 00000000 00:0c 1168 /anon_hugepage (deleted) 7fdda4200000-7fddb4200000 rw-p 00000000 00:0c 7092 /anon_hugepage (deleted) 7febe0000000-7febf0000000 rw-p 00000000 00:0c 7183 /anon_hugepage (deleted) Unmapped area lookup policy for hugetlb mappings is consistent with normal mappings now -- the only difference is alignment requirements for huge pages. libhugetlbfs test-suite didn't detect any regressions with the patch applied (although it shows few failures on my machine regardless the patch). Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Matthew Wilcox <willy@linux.intel.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Mel Gorman <mgorman@suse.de> Link: http://lkml.kernel.org/r/20131119131750.EA45CE0090@blue.fi.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
		
			
				
	
	
		
			191 lines
		
	
	
	
		
			4.1 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			191 lines
		
	
	
	
		
			4.1 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * IA-32 Huge TLB Page Support for Kernel.
 | |
|  *
 | |
|  * Copyright (C) 2002, Rohit Seth <rohit.seth@intel.com>
 | |
|  */
 | |
| 
 | |
| #include <linux/init.h>
 | |
| #include <linux/fs.h>
 | |
| #include <linux/mm.h>
 | |
| #include <linux/hugetlb.h>
 | |
| #include <linux/pagemap.h>
 | |
| #include <linux/err.h>
 | |
| #include <linux/sysctl.h>
 | |
| #include <asm/mman.h>
 | |
| #include <asm/tlb.h>
 | |
| #include <asm/tlbflush.h>
 | |
| #include <asm/pgalloc.h>
 | |
| 
 | |
| #if 0	/* This is just for testing */
 | |
| struct page *
 | |
| follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
 | |
| {
 | |
| 	unsigned long start = address;
 | |
| 	int length = 1;
 | |
| 	int nr;
 | |
| 	struct page *page;
 | |
| 	struct vm_area_struct *vma;
 | |
| 
 | |
| 	vma = find_vma(mm, addr);
 | |
| 	if (!vma || !is_vm_hugetlb_page(vma))
 | |
| 		return ERR_PTR(-EINVAL);
 | |
| 
 | |
| 	pte = huge_pte_offset(mm, address);
 | |
| 
 | |
| 	/* hugetlb should be locked, and hence, prefaulted */
 | |
| 	WARN_ON(!pte || pte_none(*pte));
 | |
| 
 | |
| 	page = &pte_page(*pte)[vpfn % (HPAGE_SIZE/PAGE_SIZE)];
 | |
| 
 | |
| 	WARN_ON(!PageHead(page));
 | |
| 
 | |
| 	return page;
 | |
| }
 | |
| 
 | |
| int pmd_huge(pmd_t pmd)
 | |
| {
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| int pud_huge(pud_t pud)
 | |
| {
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| struct page *
 | |
| follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 | |
| 		pmd_t *pmd, int write)
 | |
| {
 | |
| 	return NULL;
 | |
| }
 | |
| 
 | |
| int pmd_huge_support(void)
 | |
| {
 | |
| 	return 0;
 | |
| }
 | |
| #else
 | |
| 
 | |
| struct page *
 | |
| follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
 | |
| {
 | |
| 	return ERR_PTR(-EINVAL);
 | |
| }
 | |
| 
 | |
| int pmd_huge(pmd_t pmd)
 | |
| {
 | |
| 	return !!(pmd_val(pmd) & _PAGE_PSE);
 | |
| }
 | |
| 
 | |
| int pud_huge(pud_t pud)
 | |
| {
 | |
| 	return !!(pud_val(pud) & _PAGE_PSE);
 | |
| }
 | |
| 
 | |
| int pmd_huge_support(void)
 | |
| {
 | |
| 	return 1;
 | |
| }
 | |
| #endif
 | |
| 
 | |
| #ifdef CONFIG_HUGETLB_PAGE
 | |
| static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
 | |
| 		unsigned long addr, unsigned long len,
 | |
| 		unsigned long pgoff, unsigned long flags)
 | |
| {
 | |
| 	struct hstate *h = hstate_file(file);
 | |
| 	struct vm_unmapped_area_info info;
 | |
| 
 | |
| 	info.flags = 0;
 | |
| 	info.length = len;
 | |
| 	info.low_limit = current->mm->mmap_legacy_base;
 | |
| 	info.high_limit = TASK_SIZE;
 | |
| 	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
 | |
| 	info.align_offset = 0;
 | |
| 	return vm_unmapped_area(&info);
 | |
| }
 | |
| 
 | |
| static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
 | |
| 		unsigned long addr0, unsigned long len,
 | |
| 		unsigned long pgoff, unsigned long flags)
 | |
| {
 | |
| 	struct hstate *h = hstate_file(file);
 | |
| 	struct vm_unmapped_area_info info;
 | |
| 	unsigned long addr;
 | |
| 
 | |
| 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
 | |
| 	info.length = len;
 | |
| 	info.low_limit = PAGE_SIZE;
 | |
| 	info.high_limit = current->mm->mmap_base;
 | |
| 	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
 | |
| 	info.align_offset = 0;
 | |
| 	addr = vm_unmapped_area(&info);
 | |
| 
 | |
| 	/*
 | |
| 	 * A failed mmap() very likely causes application failure,
 | |
| 	 * so fall back to the bottom-up function here. This scenario
 | |
| 	 * can happen with large stack limits and large mmap()
 | |
| 	 * allocations.
 | |
| 	 */
 | |
| 	if (addr & ~PAGE_MASK) {
 | |
| 		VM_BUG_ON(addr != -ENOMEM);
 | |
| 		info.flags = 0;
 | |
| 		info.low_limit = TASK_UNMAPPED_BASE;
 | |
| 		info.high_limit = TASK_SIZE;
 | |
| 		addr = vm_unmapped_area(&info);
 | |
| 	}
 | |
| 
 | |
| 	return addr;
 | |
| }
 | |
| 
 | |
| unsigned long
 | |
| hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
 | |
| 		unsigned long len, unsigned long pgoff, unsigned long flags)
 | |
| {
 | |
| 	struct hstate *h = hstate_file(file);
 | |
| 	struct mm_struct *mm = current->mm;
 | |
| 	struct vm_area_struct *vma;
 | |
| 
 | |
| 	if (len & ~huge_page_mask(h))
 | |
| 		return -EINVAL;
 | |
| 	if (len > TASK_SIZE)
 | |
| 		return -ENOMEM;
 | |
| 
 | |
| 	if (flags & MAP_FIXED) {
 | |
| 		if (prepare_hugepage_range(file, addr, len))
 | |
| 			return -EINVAL;
 | |
| 		return addr;
 | |
| 	}
 | |
| 
 | |
| 	if (addr) {
 | |
| 		addr = ALIGN(addr, huge_page_size(h));
 | |
| 		vma = find_vma(mm, addr);
 | |
| 		if (TASK_SIZE - len >= addr &&
 | |
| 		    (!vma || addr + len <= vma->vm_start))
 | |
| 			return addr;
 | |
| 	}
 | |
| 	if (mm->get_unmapped_area == arch_get_unmapped_area)
 | |
| 		return hugetlb_get_unmapped_area_bottomup(file, addr, len,
 | |
| 				pgoff, flags);
 | |
| 	else
 | |
| 		return hugetlb_get_unmapped_area_topdown(file, addr, len,
 | |
| 				pgoff, flags);
 | |
| }
 | |
| #endif /* CONFIG_HUGETLB_PAGE */
 | |
| 
 | |
| #ifdef CONFIG_X86_64
 | |
| static __init int setup_hugepagesz(char *opt)
 | |
| {
 | |
| 	unsigned long ps = memparse(opt, &opt);
 | |
| 	if (ps == PMD_SIZE) {
 | |
| 		hugetlb_add_hstate(PMD_SHIFT - PAGE_SHIFT);
 | |
| 	} else if (ps == PUD_SIZE && cpu_has_gbpages) {
 | |
| 		hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
 | |
| 	} else {
 | |
| 		printk(KERN_ERR "hugepagesz: Unsupported page size %lu M\n",
 | |
| 			ps >> 20);
 | |
| 		return 0;
 | |
| 	}
 | |
| 	return 1;
 | |
| }
 | |
| __setup("hugepagesz=", setup_hugepagesz);
 | |
| #endif
 |