linux-kernel - Re: [PATCH 1/2] x86/mm/ptdump: Optimize check for W+X mappings for CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG_fn=XaqYE7KNxnxB6=U5uiQHp+x+a1-EJDkd-E+D2UN2NZ7A@mail.gmail.com>
Date:   Tue, 14 Feb 2017 13:21:03 +0100
From:   Alexander Potapenko <glider@...gle.com>
To:     Andrey Ryabinin <aryabinin@...tuozzo.com>
Cc:     x86@...nel.org, Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        kasan-dev <kasan-dev@...glegroups.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Mark Rutland <mark.rutland@....com>,
        Tobias Regnery <tobias.regnery@...il.com>
Subject: Re: [PATCH 1/2] x86/mm/ptdump: Optimize check for W+X mappings for CONFIG_KASAN=y

On Tue, Feb 14, 2017 at 11:08 AM, Andrey Ryabinin
<aryabinin@...tuozzo.com> wrote:
> Enabling both DEBUG_WX=y and KASAN=y options significantly increases
> boot time (dozens of seconds at least).
> KASAN fills kernel page tables with repeated values to map several
> TBs of the virtual memory to the single kasan_zero_page:
>
>     kasan_zero_pud ->
>         kasan_zero_pmd->
>             kasan_zero_pte->
>                 kasan_zero_page
>
> So, the page table walker used to find W+X mapping check the same
> kasan_zero_p?d page table entries a lot more than once.
> With patch pud walker will skip the pud if it has the same value as
> the previous one . Skipping done iff we search for W+X mappings,
> so this optimization won't affect the page table dump via debugfs.
>
> This dropped time spend in W+X check from ~30 sec to reasonable 0.1 sec:
>
> Before:
> [    4.579991] Freeing unused kernel memory: 1000K
> [   35.257523] x86/mm: Checked W+X mappings: passed, no W+X pages found.
>
> After:
> [    5.138756] Freeing unused kernel memory: 1000K
> [    5.266496] x86/mm: Checked W+X mappings: passed, no W+X pages found.
>
> Signed-off-by: Andrey Ryabinin <aryabinin@...tuozzo.com>
Reviewed-by: Alexander Potapenko <glider@...gle.com>
> ---
>  arch/x86/mm/dump_pagetables.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
> index 8aa6bea..0813534 100644
> --- a/arch/x86/mm/dump_pagetables.c
> +++ b/arch/x86/mm/dump_pagetables.c
> @@ -327,18 +327,31 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr,
>
>  #if PTRS_PER_PUD > 1
>
> +/*
> + * This is an optimization for CONFIG_DEBUG_WX=y + CONFIG_KASAN=y
> + * KASAN fills page tables with the same values. Since there is no
> + * point in checking page table more than once we just skip repeated
> + * entries. This saves us dozens of seconds during boot.
> + */
> +static bool pud_already_checked(pud_t *prev_pud, pud_t *pud, bool checkwx)
> +{
> +       return checkwx && prev_pud && (pud_val(*prev_pud) == pud_val(*pud));
> +}
> +
>  static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
>                                                         unsigned long P)
>  {
>         int i;
>         pud_t *start;
>         pgprotval_t prot;
> +       pud_t *prev_pud = NULL;
>
>         start = (pud_t *) pgd_page_vaddr(addr);
>
>         for (i = 0; i < PTRS_PER_PUD; i++) {
>                 st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
> -               if (!pud_none(*start)) {
> +               if (!pud_none(*start) &&
> +                   !pud_already_checked(prev_pud, start, st->check_wx)) {
>                         if (pud_large(*start) || !pud_present(*start)) {
>                                 prot = pud_flags(*start);
>                                 note_page(m, st, __pgprot(prot), 2);
> @@ -349,6 +362,7 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
>                 } else
>                         note_page(m, st, __pgprot(0), 2);
>
> +               prev_pud = start;
>                 start++;
>         }
>  }
> --
> 2.10.2
>



-- 
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg