[PATCH v3 0/2] efi: Free memory on exit

[PATCH v3 0/2] efi: Free memory on exit

[Alexander Graf]

When exiting grub, we currently leave the heap allocated. This means that if we
exit and rerun grub, after a few iterations we can run into memory shortage.

This patch set frees the heap on exit. That way we can rerun grub many times
without much problem.

Alexander Graf (2):
  efi: Move grub_reboot() into kernel
  efi: Free malloc regions on exit

 grub-core/Makefile.core.def |  9 ++++---
 grub-core/kern/efi/init.c   |  1 +
 grub-core/kern/efi/mm.c     | 59 +++++++++++++++++++++++++++++++++++++++++++++
 include/grub/efi/efi.h      |  1 +
 include/grub/misc.h         |  3 ++-
 5 files changed, 68 insertions(+), 5 deletions(-)

-- 
2.12.3

[PATCH v3 1/2] efi: Move grub_reboot() into kernel

[Alexander Graf]

The reboot function calls machine_fini() and then reboots the system.
Currently it lives in lib/ which means it gets compiled into the
reboot module which lives on the heap.

In a following patch, I want to free the heap on machine_fini()
though, so we would free the memory that the code is running in. That
obviously breaks with smarter UEFI implementations.

So this patch moves it into the core. That way we ensure that all
code running after machine_fini() in the UEFI case is running from
memory that got allocated (and gets deallocated) by the UEFI core.

Signed-off-by: Alexander Graf <agraf@suse.de>
---
 grub-core/Makefile.core.def | 9 +++++----
 include/grub/misc.h         | 3 ++-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
index a65c27f7f..d01654b12 100644
--- a/grub-core/Makefile.core.def
+++ b/grub-core/Makefile.core.def
@@ -235,6 +235,11 @@ kernel = {
   arm64_efi = kern/arm64/efi/init.c;
   arm64_efi = kern/efi/fdt.c;
 
+  ia64_efi = lib/efi/reboot.c;
+  x86_64_efi = lib/efi/reboot.c;
+  arm_efi = lib/efi/reboot.c;
+  arm64_efi = lib/efi/reboot.c;
+
   i386_pc = kern/i386/pc/init.c;
   i386_pc = kern/i386/pc/mmap.c;
   i386_pc = term/i386/pc/console.c;
@@ -872,10 +877,6 @@ module = {
   name = reboot;
   i386 = lib/i386/reboot.c;
   i386 = lib/i386/reboot_trampoline.S;
-  ia64_efi = lib/efi/reboot.c;
-  x86_64_efi = lib/efi/reboot.c;
-  arm_efi = lib/efi/reboot.c;
-  arm64_efi = lib/efi/reboot.c;
   powerpc_ieee1275 = lib/ieee1275/reboot.c;
   sparc64_ieee1275 = lib/ieee1275/reboot.c;
   mips_arc = lib/mips/arc/reboot.c;
diff --git a/include/grub/misc.h b/include/grub/misc.h
index 2a9f87cc2..372f009e8 100644
--- a/include/grub/misc.h
+++ b/include/grub/misc.h
@@ -396,7 +396,8 @@ grub_abs (int x)
 }
 
 /* Reboot the machine.  */
-#if defined (GRUB_MACHINE_EMU) || defined (GRUB_MACHINE_QEMU_MIPS)
+#if defined (GRUB_MACHINE_EMU) || defined (GRUB_MACHINE_QEMU_MIPS) || \
+    defined (GRUB_MACHINE_EFI)
 void EXPORT_FUNC(grub_reboot) (void) __attribute__ ((noreturn));
 #else
 void grub_reboot (void) __attribute__ ((noreturn));
-- 
2.12.3

[PATCH v3 2/2] efi: Free malloc regions on exit

[Alexander Graf]

When we exit grub, we don't free all the memory that we allocated earlier
for our heap region. This can cause problems with setups where you try
to descend the boot order using "exit" entries, such as PXE -> HD boot
scenarios.

Signed-off-by: Alexander Graf <agraf@suse.de>

---

v1 -> v2:

  - add comment explaining the number of regions
  - move nr of regions into a define
  - add warning if we exceed the number of freeable regions
  - reset region counter to 0 on fini

v2 -> v3:

  - use dynamic list instead of static array at runtime
  - use allocate_pool for list, so we are not bound by heap or random numbers
---
 grub-core/kern/efi/init.c |  1 +
 grub-core/kern/efi/mm.c   | 59 +++++++++++++++++++++++++++++++++++++++++++++++
 include/grub/efi/efi.h    |  1 +
 3 files changed, 61 insertions(+)

diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
index 2c31847bf..3dfdf2d22 100644
--- a/grub-core/kern/efi/init.c
+++ b/grub-core/kern/efi/init.c
@@ -80,4 +80,5 @@ grub_efi_fini (void)
 {
   grub_efidisk_fini ();
   grub_console_fini ();
+  grub_efi_memory_fini ();
 }
diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
index ac2a4c556..3455076e3 100644
--- a/grub-core/kern/efi/mm.c
+++ b/grub-core/kern/efi/mm.c
@@ -49,6 +49,18 @@ static grub_efi_uintn_t finish_desc_size;
 static grub_efi_uint32_t finish_desc_version;
 int grub_efi_is_finished = 0;
 
+/*
+ * We need to roll back EFI allocations on exit. Remember allocations that
+ * we'll free on exit. In most cases only one will be used.
+ */
+struct efi_allocation;
+struct efi_allocation {
+	struct efi_allocation *next;
+	grub_efi_physical_address_t start_addr;
+	grub_efi_uint64_t pages;
+};
+static struct efi_allocation *efi_allocated_memory;
+
 /* Allocate pages. Return the pointer to the first of allocated pages.  */
 void *
 grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
@@ -386,14 +398,19 @@ add_memory_regions (grub_efi_memory_descriptor_t *memory_map,
 		    grub_efi_uint64_t required_pages)
 {
   grub_efi_memory_descriptor_t *desc;
+  grub_efi_boot_services_t *b;
+
+  b = grub_efi_system_table->boot_services;
 
   for (desc = memory_map;
        desc < memory_map_end;
        desc = NEXT_MEMORY_DESCRIPTOR (desc, desc_size))
     {
+      struct efi_allocation *alloc;
       grub_efi_uint64_t pages;
       grub_efi_physical_address_t start;
       void *addr;
+      grub_efi_status_t status;
 
       start = desc->physical_start;
       pages = desc->num_pages;
@@ -411,6 +428,19 @@ add_memory_regions (grub_efi_memory_descriptor_t *memory_map,
 		    (void *) ((grub_addr_t) start),
 		    (unsigned) pages);
 
+      status = efi_call_3 (b->allocate_pool, GRUB_EFI_LOADER_DATA,
+                           sizeof(*alloc), (void**)&alloc);
+      if (status == GRUB_EFI_SUCCESS)
+        {
+          alloc->next = efi_allocated_memory;
+          alloc->start_addr = start;
+          alloc->pages = pages;
+          efi_allocated_memory = alloc;
+        }
+      else
+          grub_printf ("Could not malloc memory to remember EFI allocation. "
+                       "Exiting grub2 won't free all memory.\n");
+
       grub_mm_init_region (addr, PAGES_TO_BYTES (pages));
 
       required_pages -= pages;
@@ -422,6 +452,35 @@ add_memory_regions (grub_efi_memory_descriptor_t *memory_map,
     grub_fatal ("too little memory");
 }
 
+void
+grub_efi_memory_fini (void)
+{
+  struct efi_allocation *alloc;
+  grub_efi_boot_services_t *b;
+
+  b = grub_efi_system_table->boot_services;
+
+  for (alloc = efi_allocated_memory; alloc;)
+    {
+      struct efi_allocation *next;
+
+      /* Free the allocation */
+      grub_efi_free_pages (alloc->start_addr,
+                           alloc->pages);
+
+      /* Remember the next entry */
+      next = alloc->next;
+
+      /* Free the current list entry */
+      efi_call_1 (b->free_pool, alloc);
+
+      /* And move on to the next */
+      alloc = next;
+    }
+
+  efi_allocated_memory = NULL;
+}
+
 #if 0
 /* Print the memory map.  */
 static void
diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
index 3fa082816..c996913e5 100644
--- a/include/grub/efi/efi.h
+++ b/include/grub/efi/efi.h
@@ -55,6 +55,7 @@ EXPORT_FUNC(grub_efi_get_memory_map) (grub_efi_uintn_t *memory_map_size,
 				      grub_efi_uintn_t *map_key,
 				      grub_efi_uintn_t *descriptor_size,
 				      grub_efi_uint32_t *descriptor_version);
+void grub_efi_memory_fini (void);
 grub_efi_loaded_image_t *EXPORT_FUNC(grub_efi_get_loaded_image) (grub_efi_handle_t image_handle);
 void EXPORT_FUNC(grub_efi_print_device_path) (grub_efi_device_path_t *dp);
 char *EXPORT_FUNC(grub_efi_get_filename) (grub_efi_device_path_t *dp);
-- 
2.12.3

Re: [PATCH v3 1/2] efi: Move grub_reboot() into kernel

[Leif Lindholm]

On Tue, Aug 29, 2017 at 06:00:34PM +0200, Alexander Graf wrote:
> The reboot function calls machine_fini() and then reboots the system.
> Currently it lives in lib/ which means it gets compiled into the
> reboot module which lives on the heap.
> 
> In a following patch, I want to free the heap on machine_fini()
> though, so we would free the memory that the code is running in. That
> obviously breaks with smarter UEFI implementations.
> 
> So this patch moves it into the core. That way we ensure that all
> code running after machine_fini() in the UEFI case is running from
> memory that got allocated (and gets deallocated) by the UEFI core.
> 
> Signed-off-by: Alexander Graf <agraf@suse.de>
> ---
>  grub-core/Makefile.core.def | 9 +++++----
>  include/grub/misc.h         | 3 ++-
>  2 files changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def
> index a65c27f7f..d01654b12 100644
> --- a/grub-core/Makefile.core.def
> +++ b/grub-core/Makefile.core.def
> @@ -235,6 +235,11 @@ kernel = {
>    arm64_efi = kern/arm64/efi/init.c;
>    arm64_efi = kern/efi/fdt.c;
>  
> +  ia64_efi = lib/efi/reboot.c;
> +  x86_64_efi = lib/efi/reboot.c;
> +  arm_efi = lib/efi/reboot.c;
> +  arm64_efi = lib/efi/reboot.c;
> +

Actually, if we're moving these (which I am all for), can we squash
this down to a single "efi =" line?

And as I am already in bikeshedding mode: if we move it into the
kernel image, should we also move the source file to
grub-core/kern/efi/?

/
    Leif

>    i386_pc = kern/i386/pc/init.c;
>    i386_pc = kern/i386/pc/mmap.c;
>    i386_pc = term/i386/pc/console.c;
> @@ -872,10 +877,6 @@ module = {
>    name = reboot;
>    i386 = lib/i386/reboot.c;
>    i386 = lib/i386/reboot_trampoline.S;
> -  ia64_efi = lib/efi/reboot.c;
> -  x86_64_efi = lib/efi/reboot.c;
> -  arm_efi = lib/efi/reboot.c;
> -  arm64_efi = lib/efi/reboot.c;
>    powerpc_ieee1275 = lib/ieee1275/reboot.c;
>    sparc64_ieee1275 = lib/ieee1275/reboot.c;
>    mips_arc = lib/mips/arc/reboot.c;
> diff --git a/include/grub/misc.h b/include/grub/misc.h
> index 2a9f87cc2..372f009e8 100644
> --- a/include/grub/misc.h
> +++ b/include/grub/misc.h
> @@ -396,7 +396,8 @@ grub_abs (int x)
>  }
>  
>  /* Reboot the machine.  */
> -#if defined (GRUB_MACHINE_EMU) || defined (GRUB_MACHINE_QEMU_MIPS)
> +#if defined (GRUB_MACHINE_EMU) || defined (GRUB_MACHINE_QEMU_MIPS) || \
> +    defined (GRUB_MACHINE_EFI)
>  void EXPORT_FUNC(grub_reboot) (void) __attribute__ ((noreturn));
>  #else
>  void grub_reboot (void) __attribute__ ((noreturn));
> -- 
> 2.12.3
> 
> 
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH v3 2/2] efi: Free malloc regions on exit

[Leif Lindholm]

On Tue, Aug 29, 2017 at 06:00:35PM +0200, Alexander Graf wrote:
> When we exit grub, we don't free all the memory that we allocated earlier
> for our heap region. This can cause problems with setups where you try
> to descend the boot order using "exit" entries, such as PXE -> HD boot
> scenarios.
> 
> Signed-off-by: Alexander Graf <agraf@suse.de>

Really happy to see this, but repeating a comment here from irc:
This deals with the biggest problem with returning to UEFI - GRUB
allocates 25% of available RAM, which before this patch we don't
release. However, various operations may allocate EFI memory directly,
and those allocations are not currently being tracked.

If further allocations could be tracked from
grub_efi_allocate_pages_real, these could be unwound in
_memory_fini(). Those can safely be allocated from the heap.

/
    Leif

> ---
> 
> v1 -> v2:
> 
>   - add comment explaining the number of regions
>   - move nr of regions into a define
>   - add warning if we exceed the number of freeable regions
>   - reset region counter to 0 on fini
> 
> v2 -> v3:
> 
>   - use dynamic list instead of static array at runtime
>   - use allocate_pool for list, so we are not bound by heap or random numbers
> ---
>  grub-core/kern/efi/init.c |  1 +
>  grub-core/kern/efi/mm.c   | 59 +++++++++++++++++++++++++++++++++++++++++++++++
>  include/grub/efi/efi.h    |  1 +
>  3 files changed, 61 insertions(+)
> 
> diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
> index 2c31847bf..3dfdf2d22 100644
> --- a/grub-core/kern/efi/init.c
> +++ b/grub-core/kern/efi/init.c
> @@ -80,4 +80,5 @@ grub_efi_fini (void)
>  {
>    grub_efidisk_fini ();
>    grub_console_fini ();
> +  grub_efi_memory_fini ();
>  }
> diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
> index ac2a4c556..3455076e3 100644
> --- a/grub-core/kern/efi/mm.c
> +++ b/grub-core/kern/efi/mm.c
> @@ -49,6 +49,18 @@ static grub_efi_uintn_t finish_desc_size;
>  static grub_efi_uint32_t finish_desc_version;
>  int grub_efi_is_finished = 0;
>  
> +/*
> + * We need to roll back EFI allocations on exit. Remember allocations that
> + * we'll free on exit. In most cases only one will be used.
> + */
> +struct efi_allocation;
> +struct efi_allocation {
> +	struct efi_allocation *next;
> +	grub_efi_physical_address_t start_addr;
> +	grub_efi_uint64_t pages;
> +};
> +static struct efi_allocation *efi_allocated_memory;
> +
>  /* Allocate pages. Return the pointer to the first of allocated pages.  */
>  void *
>  grub_efi_allocate_pages_real (grub_efi_physical_address_t address,
> @@ -386,14 +398,19 @@ add_memory_regions (grub_efi_memory_descriptor_t *memory_map,
>  		    grub_efi_uint64_t required_pages)
>  {
>    grub_efi_memory_descriptor_t *desc;
> +  grub_efi_boot_services_t *b;
> +
> +  b = grub_efi_system_table->boot_services;
>  
>    for (desc = memory_map;
>         desc < memory_map_end;
>         desc = NEXT_MEMORY_DESCRIPTOR (desc, desc_size))
>      {
> +      struct efi_allocation *alloc;
>        grub_efi_uint64_t pages;
>        grub_efi_physical_address_t start;
>        void *addr;
> +      grub_efi_status_t status;
>  
>        start = desc->physical_start;
>        pages = desc->num_pages;
> @@ -411,6 +428,19 @@ add_memory_regions (grub_efi_memory_descriptor_t *memory_map,
>  		    (void *) ((grub_addr_t) start),
>  		    (unsigned) pages);
>  
> +      status = efi_call_3 (b->allocate_pool, GRUB_EFI_LOADER_DATA,
> +                           sizeof(*alloc), (void**)&alloc);
> +      if (status == GRUB_EFI_SUCCESS)
> +        {
> +          alloc->next = efi_allocated_memory;
> +          alloc->start_addr = start;
> +          alloc->pages = pages;
> +          efi_allocated_memory = alloc;
> +        }
> +      else
> +          grub_printf ("Could not malloc memory to remember EFI allocation. "
> +                       "Exiting grub2 won't free all memory.\n");
> +
>        grub_mm_init_region (addr, PAGES_TO_BYTES (pages));
>  
>        required_pages -= pages;
> @@ -422,6 +452,35 @@ add_memory_regions (grub_efi_memory_descriptor_t *memory_map,
>      grub_fatal ("too little memory");
>  }
>  
> +void
> +grub_efi_memory_fini (void)
> +{
> +  struct efi_allocation *alloc;
> +  grub_efi_boot_services_t *b;
> +
> +  b = grub_efi_system_table->boot_services;
> +
> +  for (alloc = efi_allocated_memory; alloc;)
> +    {
> +      struct efi_allocation *next;
> +
> +      /* Free the allocation */
> +      grub_efi_free_pages (alloc->start_addr,
> +                           alloc->pages);
> +
> +      /* Remember the next entry */
> +      next = alloc->next;
> +
> +      /* Free the current list entry */
> +      efi_call_1 (b->free_pool, alloc);
> +
> +      /* And move on to the next */
> +      alloc = next;
> +    }
> +
> +  efi_allocated_memory = NULL;
> +}
> +
>  #if 0
>  /* Print the memory map.  */
>  static void
> diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h
> index 3fa082816..c996913e5 100644
> --- a/include/grub/efi/efi.h
> +++ b/include/grub/efi/efi.h
> @@ -55,6 +55,7 @@ EXPORT_FUNC(grub_efi_get_memory_map) (grub_efi_uintn_t *memory_map_size,
>  				      grub_efi_uintn_t *map_key,
>  				      grub_efi_uintn_t *descriptor_size,
>  				      grub_efi_uint32_t *descriptor_version);
> +void grub_efi_memory_fini (void);
>  grub_efi_loaded_image_t *EXPORT_FUNC(grub_efi_get_loaded_image) (grub_efi_handle_t image_handle);
>  void EXPORT_FUNC(grub_efi_print_device_path) (grub_efi_device_path_t *dp);
>  char *EXPORT_FUNC(grub_efi_get_filename) (grub_efi_device_path_t *dp);
> -- 
> 2.12.3
> 
> 
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH v3 2/2] efi: Free malloc regions on exit

[Alexander Graf]

On 08/29/2017 08:25 PM, Leif Lindholm wrote:
> On Tue, Aug 29, 2017 at 06:00:35PM +0200, Alexander Graf wrote:
>> When we exit grub, we don't free all the memory that we allocated earlier
>> for our heap region. This can cause problems with setups where you try
>> to descend the boot order using "exit" entries, such as PXE -> HD boot
>> scenarios.
>>
>> Signed-off-by: Alexander Graf <agraf@suse.de>
> Really happy to see this, but repeating a comment here from irc:
> This deals with the biggest problem with returning to UEFI - GRUB
> allocates 25% of available RAM, which before this patch we don't
> release. However, various operations may allocate EFI memory directly,
> and those allocations are not currently being tracked.
>
> If further allocations could be tracked from
> grub_efi_allocate_pages_real, these could be unwound in
> _memory_fini(). Those can safely be allocated from the heap.

I'm using pool allocations now which *usually* go into a malloc like 
pool on the UEFI side anyway, hence I don't think we should complicate 
the logic even more and differentiate between heap and non-heap 
allocations. I'll just add all allocations from 
efi_allocate_pages_real() to the list and free them on exit - that 
should be safest.


Alex

Re: [PATCH v3 2/2] efi: Free malloc regions on exit

[Leif Lindholm]

On Tue, Aug 29, 2017 at 08:45:32PM +0200, Alexander Graf wrote:
> On 08/29/2017 08:25 PM, Leif Lindholm wrote:
> > On Tue, Aug 29, 2017 at 06:00:35PM +0200, Alexander Graf wrote:
> > > When we exit grub, we don't free all the memory that we allocated earlier
> > > for our heap region. This can cause problems with setups where you try
> > > to descend the boot order using "exit" entries, such as PXE -> HD boot
> > > scenarios.
> > > 
> > > Signed-off-by: Alexander Graf <agraf@suse.de>
> > Really happy to see this, but repeating a comment here from irc:
> > This deals with the biggest problem with returning to UEFI - GRUB
> > allocates 25% of available RAM, which before this patch we don't
> > release. However, various operations may allocate EFI memory directly,
> > and those allocations are not currently being tracked.
> > 
> > If further allocations could be tracked from
> > grub_efi_allocate_pages_real, these could be unwound in
> > _memory_fini(). Those can safely be allocated from the heap.
> 
> I'm using pool allocations now which *usually* go into a malloc like pool on
> the UEFI side anyway, hence I don't think we should complicate the logic
> even more and differentiate between heap and non-heap allocations. I'll just
> add all allocations from efi_allocate_pages_real() to the list and free them
> on exit - that should be safest.

Sure, the comment was intended to point out a relaxation of
requirements, not a restriction. I.e. unlike the entries for
tracking the allocations of the heap, later allocations _can_ be
stored on the heap.

/
    Leif