mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-14 06:22:34 +02:00
Rework the general infrastructure around RANDOM_KMALLOC_CACHES into more flexible KMALLOC_PARTITION_CACHES, with the former being a partitioning mode of the latter. Introduce a new mode, KMALLOC_PARTITION_TYPED, which leverages a feature available in Clang 22 and later, called "allocation tokens" via __builtin_infer_alloc_token() [1]. Unlike KMALLOC_PARTITION_RANDOM (formerly RANDOM_KMALLOC_CACHES), this mode deterministically assigns a slab cache to an allocation of type T, regardless of allocation site. The builtin __builtin_infer_alloc_token(<malloc-args>, ...) instructs the compiler to infer an allocation type from arguments commonly passed to memory-allocating functions and returns a type-derived token ID. The implementation passes kmalloc-args to the builtin: the compiler performs best-effort type inference, and then recognizes common patterns such as `kmalloc(sizeof(T), ...)`, `kmalloc(sizeof(T) * n, ...)`, but also `(T *)kmalloc(...)`. Where the compiler fails to infer a type the fallback token (default: 0) is chosen. Note: kmalloc_obj(..) APIs fix the pattern how size and result type are expressed, and therefore ensures there's not much drift in which patterns the compiler needs to recognize. Specifically, kmalloc_obj() and friends expand to `(TYPE *)KMALLOC(__obj_size, GFP)`, which the compiler recognizes via the cast to TYPE*. Clang's default token ID calculation is described as [1]: typehashpointersplit: This mode assigns a token ID based on the hash of the allocated type's name, where the top half ID-space is reserved for types that contain pointers and the bottom half for types that do not contain pointers. Separating pointer-containing objects from pointerless objects and data allocations can help mitigate certain classes of memory corruption exploits [2]: attackers who gains a buffer overflow on a primitive buffer cannot use it to directly corrupt pointers or other critical metadata in an object residing in a different, isolated heap region. It is important to note that heap isolation strategies offer a best-effort approach, and do not provide a 100% security guarantee, albeit achievable at relatively low performance cost. Note that this also does not prevent cross-cache attacks: while waiting for future features like SLAB_VIRTUAL [3] to provide physical page isolation, this feature should be deployed alongside SHUFFLE_PAGE_ALLOCATOR and init_on_free=1 to mitigate cross-cache attacks and page-reuse attacks as much as possible today. With all that, my kernel (x86 defconfig) shows me a histogram of slab cache object distribution per /proc/slabinfo (after boot): <slab cache> <objs> <hist> kmalloc-part-15 1465 ++++++++++++++ kmalloc-part-14 2988 +++++++++++++++++++++++++++++ kmalloc-part-13 1656 ++++++++++++++++ kmalloc-part-12 1045 ++++++++++ kmalloc-part-11 1697 ++++++++++++++++ kmalloc-part-10 1489 ++++++++++++++ kmalloc-part-09 965 +++++++++ kmalloc-part-08 710 +++++++ kmalloc-part-07 100 + kmalloc-part-06 217 ++ kmalloc-part-05 105 + kmalloc-part-04 4047 ++++++++++++++++++++++++++++++++++++++++ kmalloc-part-03 183 + kmalloc-part-02 283 ++ kmalloc-part-01 316 +++ kmalloc 1422 ++++++++++++++ The above /proc/slabinfo snapshot shows me there are 6673 allocated objects (slabs 00 - 07) that the compiler claims contain no pointers or it was unable to infer the type of, and 12015 objects that contain pointers (slabs 08 - 15). On a whole, this looks relatively sane. Additionally, when I compile my kernel with -Rpass=alloc-token, which provides diagnostics where (after dead-code elimination) type inference failed, I see 186 allocation sites where the compiler failed to identify a type (down from 966 when I sent the RFC [4]). Some initial review confirms these are mostly variable sized buffers, but also include structs with trailing flexible length arrays. Link: https://clang.llvm.org/docs/AllocToken.html [1] Link: https://blog.dfsec.com/ios/2025/05/30/blasting-past-ios-18/ [2] Link: https://lwn.net/Articles/944647/ [3] Link: https://lore.kernel.org/all/20250825154505.1558444-1-elver@google.com/ [4] Link: https://discourse.llvm.org/t/rfc-a-framework-for-allocator-partitioning-hints/87434 Acked-by: GONG Ruiqi <gongruiqi1@huawei.com> Co-developed-by: Harry Yoo (Oracle) <harry@kernel.org> Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org> Signed-off-by: Marco Elver <elver@google.com> Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org> Link: https://patch.msgid.link/20260511200136.3201646-1-elver@google.com Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
165 lines
5.2 KiB
C
165 lines
5.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __LINUX_PERCPU_H
|
|
#define __LINUX_PERCPU_H
|
|
|
|
#include <linux/alloc_tag.h>
|
|
#include <linux/mmdebug.h>
|
|
#include <linux/preempt.h>
|
|
#include <linux/smp.h>
|
|
#include <linux/pfn.h>
|
|
#include <linux/init.h>
|
|
#include <linux/cleanup.h>
|
|
#include <linux/sched.h>
|
|
|
|
#include <asm/percpu.h>
|
|
|
|
/* enough to cover all DEFINE_PER_CPUs in modules */
|
|
#ifdef CONFIG_MODULES
|
|
#define PERCPU_MODULE_RESERVE (8 << 10)
|
|
#else
|
|
#define PERCPU_MODULE_RESERVE 0
|
|
#endif
|
|
|
|
/* minimum unit size, also is the maximum supported allocation size */
|
|
#define PCPU_MIN_UNIT_SIZE PFN_ALIGN(32 << 10)
|
|
|
|
/* minimum allocation size and shift in bytes */
|
|
#define PCPU_MIN_ALLOC_SHIFT 2
|
|
#define PCPU_MIN_ALLOC_SIZE (1 << PCPU_MIN_ALLOC_SHIFT)
|
|
|
|
/*
|
|
* The PCPU_BITMAP_BLOCK_SIZE must be the same size as PAGE_SIZE as the
|
|
* updating of hints is used to manage the nr_empty_pop_pages in both
|
|
* the chunk and globally.
|
|
*/
|
|
#define PCPU_BITMAP_BLOCK_SIZE PAGE_SIZE
|
|
#define PCPU_BITMAP_BLOCK_BITS (PCPU_BITMAP_BLOCK_SIZE >> \
|
|
PCPU_MIN_ALLOC_SHIFT)
|
|
|
|
#ifdef CONFIG_KMALLOC_PARTITION_CACHES
|
|
# if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PAGE_SIZE_4KB)
|
|
# define PERCPU_DYNAMIC_SIZE_SHIFT 13
|
|
# else
|
|
# define PERCPU_DYNAMIC_SIZE_SHIFT 12
|
|
#endif /* LOCKDEP and PAGE_SIZE > 4KiB */
|
|
#else
|
|
#define PERCPU_DYNAMIC_SIZE_SHIFT 10
|
|
#endif
|
|
|
|
/*
|
|
* Percpu allocator can serve percpu allocations before slab is
|
|
* initialized which allows slab to depend on the percpu allocator.
|
|
* The following parameter decide how much resource to preallocate
|
|
* for this. Keep PERCPU_DYNAMIC_RESERVE equal to or larger than
|
|
* PERCPU_DYNAMIC_EARLY_SIZE.
|
|
*/
|
|
#define PERCPU_DYNAMIC_EARLY_SIZE (20 << PERCPU_DYNAMIC_SIZE_SHIFT)
|
|
|
|
/*
|
|
* PERCPU_DYNAMIC_RESERVE indicates the amount of free area to piggy
|
|
* back on the first chunk for dynamic percpu allocation if arch is
|
|
* manually allocating and mapping it for faster access (as a part of
|
|
* large page mapping for example).
|
|
*
|
|
* The following values give between one and two pages of free space
|
|
* after typical minimal boot (2-way SMP, single disk and NIC) with
|
|
* both defconfig and a distro config on x86_64 and 32. More
|
|
* intelligent way to determine this would be nice.
|
|
*/
|
|
#if BITS_PER_LONG > 32
|
|
#define PERCPU_DYNAMIC_RESERVE (28 << PERCPU_DYNAMIC_SIZE_SHIFT)
|
|
#else
|
|
#define PERCPU_DYNAMIC_RESERVE (20 << PERCPU_DYNAMIC_SIZE_SHIFT)
|
|
#endif
|
|
|
|
extern void *pcpu_base_addr;
|
|
extern const unsigned long *pcpu_unit_offsets;
|
|
|
|
struct pcpu_group_info {
|
|
int nr_units; /* aligned # of units */
|
|
unsigned long base_offset; /* base address offset */
|
|
unsigned int *cpu_map; /* unit->cpu map, empty
|
|
* entries contain NR_CPUS */
|
|
};
|
|
|
|
struct pcpu_alloc_info {
|
|
size_t static_size;
|
|
size_t reserved_size;
|
|
size_t dyn_size;
|
|
size_t unit_size;
|
|
size_t atom_size;
|
|
size_t alloc_size;
|
|
size_t __ai_size; /* internal, don't use */
|
|
int nr_groups; /* 0 if grouping unnecessary */
|
|
struct pcpu_group_info groups[];
|
|
};
|
|
|
|
enum pcpu_fc {
|
|
PCPU_FC_AUTO,
|
|
PCPU_FC_EMBED,
|
|
PCPU_FC_PAGE,
|
|
|
|
PCPU_FC_NR,
|
|
};
|
|
extern const char * const pcpu_fc_names[PCPU_FC_NR];
|
|
|
|
extern enum pcpu_fc pcpu_chosen_fc;
|
|
|
|
typedef int (pcpu_fc_cpu_to_node_fn_t)(int cpu);
|
|
typedef int (pcpu_fc_cpu_distance_fn_t)(unsigned int from, unsigned int to);
|
|
|
|
extern struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
|
|
int nr_units);
|
|
extern void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai);
|
|
|
|
extern void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
|
|
void *base_addr);
|
|
|
|
extern int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
|
|
size_t atom_size,
|
|
pcpu_fc_cpu_distance_fn_t cpu_distance_fn,
|
|
pcpu_fc_cpu_to_node_fn_t cpu_to_nd_fn);
|
|
|
|
#ifdef CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK
|
|
void __init pcpu_populate_pte(unsigned long addr);
|
|
extern int __init pcpu_page_first_chunk(size_t reserved_size,
|
|
pcpu_fc_cpu_to_node_fn_t cpu_to_nd_fn);
|
|
#endif
|
|
|
|
extern bool __is_kernel_percpu_address(unsigned long addr, unsigned long *can_addr);
|
|
extern bool is_kernel_percpu_address(unsigned long addr);
|
|
|
|
#if !defined(CONFIG_SMP) || !defined(CONFIG_HAVE_SETUP_PER_CPU_AREA)
|
|
extern void __init setup_per_cpu_areas(void);
|
|
#endif
|
|
|
|
extern void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
|
|
gfp_t gfp) __alloc_size(1);
|
|
|
|
#define __alloc_percpu_gfp(_size, _align, _gfp) \
|
|
alloc_hooks(pcpu_alloc_noprof(_size, _align, false, _gfp))
|
|
#define __alloc_percpu(_size, _align) \
|
|
alloc_hooks(pcpu_alloc_noprof(_size, _align, false, GFP_KERNEL))
|
|
#define __alloc_reserved_percpu(_size, _align) \
|
|
alloc_hooks(pcpu_alloc_noprof(_size, _align, true, GFP_KERNEL))
|
|
|
|
#define alloc_percpu_gfp(type, gfp) \
|
|
(typeof(type) __percpu *)__alloc_percpu_gfp(sizeof(type), \
|
|
__alignof__(type), gfp)
|
|
#define alloc_percpu(type) \
|
|
(typeof(type) __percpu *)__alloc_percpu(sizeof(type), \
|
|
__alignof__(type))
|
|
#define alloc_percpu_noprof(type) \
|
|
((typeof(type) __percpu *)pcpu_alloc_noprof(sizeof(type), \
|
|
__alignof__(type), false, GFP_KERNEL))
|
|
|
|
extern void free_percpu(void __percpu *__pdata);
|
|
|
|
DEFINE_FREE(free_percpu, void __percpu *, free_percpu(_T))
|
|
|
|
extern phys_addr_t per_cpu_ptr_to_phys(void *addr);
|
|
|
|
extern unsigned long pcpu_nr_pages(void);
|
|
|
|
#endif /* __LINUX_PERCPU_H */
|