linux-kernel - Re: [PATCH v3 1/3] x86/64: Make kernel text mapping always take one whole page table in early boot code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 6 Jan 2017 17:35:05 +0800
From:   Baoquan He <bhe@...hat.com>
To:     Borislav Petkov <bp@...e.de>
Cc:     Kees Cook <keescook@...omium.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>, Yinghai Lu <yinghai@...nel.org>,
        Thomas Garnier <thgarnie@...gle.com>,
        Alexander Kuleshov <kuleshovmail@...il.com>,
        Andy Lutomirski <luto@...nel.org>,
        "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Dave Anderson <anderson@...hat.com>,
        Dave Young <dyoung@...hat.com>
Subject: Re: [PATCH v3 1/3] x86/64: Make kernel text mapping always take one
 whole page table in early boot code

On 01/05/17 at 09:52pm, Borislav Petkov wrote:
> On Thu, Jan 05, 2017 at 11:35:57AM -0800, Kees Cook wrote:
> > The only reason I had it as an option was for kernel module space. It
> > wasn't clear to me at the time if enough space remained for modules in
> > all use-cases. It seems like probably there is, so I have no objection
> > to making the mapping 1G unconditionally.
> 
> Oh someone will crawl out of the woodwork handwaiving that 1G of modules
> is not enough. But then that someone would have to choose between kaslr
> and >1G modules.
> 
> Realistically, on a typical bigger machine, the modules take up
> something like <10M:
> 
> $ lsmod | awk '{ sum +=$2 } END { print sum }'
> 7188480
> 
> so I'm not really worried if we reduce it by default to 1G. Besides, the
> reduction has been there for a while now - since CONFIG_RANDOMIZE_BASE -
> so we probably would've heard complaints already...

Fair enough, so worry about the space of kernel modules can be removed.

Now I am thinking if a new constant KERNEL_MAPPING_SIZE is still needed.
Below are commits changing value of KERNEL_IMAGE_SIZE made by Ingo.

~~~~~~~~
85eb69a1    x86: increase the kernel text limit to 512 MB
Ingo changed KERNEL_IMAGE_SIZE from 128M to 512M.

88f3aec7    x86: fix spontaneous reboot with allyesconfig bzImage
This changed KERNEL_IMAGE_SIZE from 40M to 128M. At that time it was
called KERNEL_TEXT_SIZE.
~~~~~~~~

All these changes are considered for increasing the kernel image limit.
As I said in patch 2/3 log, KERNEL_IMAGE_SIZE plays two parts, one is
limiting the size of kernel image, the other is representing the size of
kernel image mapping area. Before kernel mapping area was invariant,
increasing kernel image size means enlarging kernel mapping area, this
is fine. If kernel can be mapped into 1G space, id doesn't mean kernel
image is allowed to be 1G. Now linker will check the size of kernel
image in kernel/vmlinux.lds.S. Maybe I need keep the patch 2/3 and make
KERNEL_MAPPING_SIZE default to 1G. 

Any thoughts about this?

> 
> Btw, we should probably document the reduction in the va map document
> too:

Sure, I will update and post with this patch added, thanks.

> 
> ---
> From: Borislav Petkov <bp@...e.de>
> Date: Thu, 5 Jan 2017 21:47:18 +0100
> Subject: [PATCH] x86/mm: Document modules space reduction
> 
> KASLR reduces module mapping space to 1G, document that.
> 
> Signed-off-by: Borislav Petkov <bp@...e.de>
> ---
>  Documentation/x86/x86_64/mm.txt | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
> index 5724092db811..a737dfbc198b 100644
> --- a/Documentation/x86/x86_64/mm.txt
> +++ b/Documentation/x86/x86_64/mm.txt
> @@ -39,6 +39,8 @@ memory window (this size is arbitrary, it can be raised later if needed).
>  The mappings are not part of any other kernel PGD and are only available
>  during EFI runtime calls.
>  
> +CONFIG_RANDOMIZE_BASE (KASLR) reduces module mapping space from 1.5G to 1G.
> +
>  Note that if CONFIG_RANDOMIZE_MEMORY is enabled, the direct mapping of all
>  physical memory, vmalloc/ioremap space and virtual memory map are randomized.
>  Their order is preserved but their base will be offset early at boot time.
> -- 
> 2.11.0
> 
> SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
> --