linux-kernel - Re: [PATCH v2] x86_64, vmcoreinfo: Append 'page_offset_base' to vmcoreinfo

Open Source and information security mailing list archives

Message-ID: <CAGXu5jJzVMmqJ9JvFqDhDx=QShiWisWO0bY49cD5r-7By5dxFg@mail.gmail.com>
Date:   Tue, 27 Nov 2018 16:39:50 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Baoquan He <bhe@...hat.com>
Cc:     Borislav Petkov <bp@...en8.de>,
        Kazuhito Hagio <k-hagio@...jp.nec.com>,
        Bhupesh Sharma <bhsharma@...hat.com>, X86 ML <x86@...nel.org>,
        Kexec Mailing List <kexec@...ts.infradead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Omar Sandoval <osandov@...com>,
        Dave Anderson <anderson@...hat.com>,
        James Morse <james.morse@....com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Bhupesh SHARMA <bhupesh.linux@...il.com>,
        Ingo Molnar <mingo@...nel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH v2] x86_64, vmcoreinfo: Append 'page_offset_base' to vmcoreinfo

On Tue, Nov 27, 2018 at 3:29 PM, Baoquan He <bhe@...hat.com> wrote:
> On 11/27/18 at 02:16pm, Kees Cook wrote:
>> Why is KERNELOFFSET= not sufficient?
>>
>> See commit b6085a865762 ("x86, kaslr: export offset in VMCOREINFO ELF notes")
>>
>> +       vmcoreinfo_append_str("KERNELOFFSET=%lx\n",
>> +                             (unsigned long)&_text - __START_KERNEL);
>
> KERNELOFFSET is virtual address delta after kernel text KASLR, namely
> the offset from the original default kernel text virtual address,
> 0xffffffff88000000.
>
> While after memory region KASLR in kernel_randomize_memory(), the
> starting address of the direct mapping of physical memory, PAGE_OFFSET,
> is changed too. We need get it to analyze memory in makedumpfile/crash.
> Currently we deduce it from elf program segment of kcore:
> Program Headers:
>   Type           Offset             VirtAddr           PhysAddr
>                  FileSiz            MemSiz              Flags  Align
> ......
>
>   LOAD           0x00000a62c0004000 0xffff8a62c0001000 0x0000000000001000
>                  0x000000000009c000 0x000000000009c000  RWE    1000
>
> page_offset = 0xffff8a62c0001000 - 0x0000000000001000;
> Since we put the direct mapping segments at the bottom part of kcore, we
> can always get page_offset right.
>
> Thanks
> Baoquan
>
>>
>> -Kees
>>
>> >> diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
>> >> index 4c8acdfdc5a7..6161d77c5bfb 100644
>> >> --- a/arch/x86/kernel/machine_kexec_64.c
>> >> +++ b/arch/x86/kernel/machine_kexec_64.c
>> >> @@ -356,6 +356,9 @@ void arch_crash_save_vmcoreinfo(void)
>> >>       VMCOREINFO_SYMBOL(init_top_pgt);
>> >>       vmcoreinfo_append_str("NUMBER(pgtable_l5_enabled)=%d\n",
>> >>                       pgtable_l5_enabled());
>> >> +#ifdef CONFIG_RANDOMIZE_BASE

Okay, gotcha. In that case, shouldn't this be CONFIG_RANDOMIZE_MEMORY?

-Kees

>> >> +     VMCOREINFO_NUMBER(page_offset_base);
>> >> +#endif
>> >>
>> >>  #ifdef CONFIG_NUMA
>> >>       VMCOREINFO_SYMBOL(node_data);
>>
>> --
>> Kees Cook
>>
>> _______________________________________________
>> kexec mailing list
>> kexec@...ts.infradead.org
>> http://lists.infradead.org/mailman/listinfo/kexec

-- 
Kees Cook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives