linux-kernel - Re: [PATCH v3 1/3] x86/64: Make kernel text mapping always take one whole page table in early boot code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 5 Jan 2017 11:35:57 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Borislav Petkov <bp@...e.de>
Cc:     Baoquan He <bhe@...hat.com>, "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>, Yinghai Lu <yinghai@...nel.org>,
        Thomas Garnier <thgarnie@...gle.com>,
        Alexander Kuleshov <kuleshovmail@...il.com>,
        Andy Lutomirski <luto@...nel.org>,
        "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Dave Anderson <anderson@...hat.com>,
        Dave Young <dyoung@...hat.com>
Subject: Re: [PATCH v3 1/3] x86/64: Make kernel text mapping always take one
 whole page table in early boot code

On Thu, Jan 5, 2017 at 6:01 AM, Borislav Petkov <bp@...e.de> wrote:
> On Thu, Jan 05, 2017 at 11:28:00AM +0800, Baoquan He wrote:
>> Possibly people worry more that no enough space left for kernel modules
>> mapping whthin 1G, just a guess. I am fine with making text mapping size
>> 1G by default. Kees must know more about the 1G only if kaslr enabled.
>
> So I'm thinking practically kaslr will be enabled on the majority
> of the systems anyway so we will have 1G text mapping size on most.
> The question is, are there any downsides/issues with making that the
> default.
>
> hpa, do you see any problems with it?

The only reason I had it as an option was for kernel module space. It
wasn't clear to me at the time if enough space remained for modules in
all use-cases. It seems like probably there is, so I have no objection
to making the mapping 1G unconditionally.

-Kees

-- 
Kees Cook
Nexus Security