From patchwork Wed Feb 15 13:58:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Borislav Petkov X-Patchwork-Id: 9574135 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6DF13601D8 for ; Wed, 15 Feb 2017 13:59:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6678B284C9 for ; Wed, 15 Feb 2017 13:59:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5A1F5284CD; Wed, 15 Feb 2017 13:59:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 71D63284CC for ; Wed, 15 Feb 2017 13:59:00 +0000 (UTC) Received: (qmail 8053 invoked by uid 550); 15 Feb 2017 13:58:59 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 8021 invoked from network); 15 Feb 2017 13:58:58 -0000 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Date: Wed, 15 Feb 2017 14:58:24 +0100 From: Borislav Petkov To: Thomas Garnier Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Kees Cook , Andy Lutomirski , Paul Gortmaker , Andy Lutomirski , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Jiri Kosina , Matt Fleming , Ard Biesheuvel , Boris Ostrovsky , Juergen Gross , Rusty Russell , Peter Zijlstra , Christian Borntraeger , "Luis R . Rodriguez" , He Chen , Brian Gerst , Stanislaw Gruszka , Arnd Bergmann , Adam Buchbinder , Dave Hansen , Vitaly Kuznetsov , Josh Poimboeuf , Tim Chen , Rik van Riel , Andi Kleen , Jiri Olsa , Michael Ellerman , Joerg Roedel , Paolo Bonzini , Radim =?utf-8?B?S3LEjW3DocWZ?= , x86@kernel.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-pm@vger.kernel.org, linux-efi@vger.kernel.org, xen-devel@lists.xenproject.org, lguest@lists.ozlabs.org, kvm@vger.kernel.org, kernel-hardening@lists.openwall.com Message-ID: <20170215135824.tflwuf3esu2npwwo@pd.tnic> References: <20170214194259.75960-1-thgarnie@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20170214194259.75960-1-thgarnie@google.com> User-Agent: NeoMutt/20161014 (1.7.1) Subject: [kernel-hardening] Re: [PATCH v3 1/4] x86/mm: Adapt MODULES_END based on Fixmap section size X-Virus-Scanned: ClamAV using ClamSMTP On Tue, Feb 14, 2017 at 11:42:56AM -0800, Thomas Garnier wrote: > This patch aligns MODULES_END to the beginning of the Fixmap section. > It optimizes the space available for both sections. The address is > pre-computed based on the number of pages required by the Fixmap > section. > > It will allow GDT remapping in the Fixmap section. The current > MODULES_END static address does not provide enough space for the kernel > to support a large number of processors. > > Signed-off-by: Thomas Garnier > --- > Based on next-20170213 > --- > arch/x86/include/asm/fixmap.h | 8 ++++++++ > arch/x86/include/asm/pgtable_64_types.h | 3 --- > arch/x86/kernel/module.c | 1 + > arch/x86/mm/dump_pagetables.c | 1 + > arch/x86/mm/kasan_init_64.c | 1 + > 5 files changed, 11 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h > index 8554f960e21b..20231189e0e3 100644 > --- a/arch/x86/include/asm/fixmap.h > +++ b/arch/x86/include/asm/fixmap.h > @@ -132,6 +132,14 @@ enum fixed_addresses { > > extern void reserve_top_address(unsigned long reserve); > > +/* On 64-bit, the module sections ends with the start of the fixmap */ > +#ifdef CONFIG_X86_64 > +#define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE) > +#define MODULES_END __fix_to_virt(__end_of_fixed_addresses + 1) > +#define MODULES_LEN (MODULES_END - MODULES_VADDR) > +#endif /* CONFIG_X86_64 */ JFYI: so there's another patchset which adds KERNEL_MAPPING_SIZE: https://lkml.kernel.org/r/1486040077-3719-1-git-send-email-bhe@redhat.com and makes it a 1G, i.e., the KASLR default. I guess the above will have to be KERNEL_MAPPING_SIZE then. And why are you moving those to fixmap.h? What's wrong with including fixmap.h into pgtable_64_types.h so that you can get __end_of_fixed_addresses? FWIW, I didn't even have to add any includes with my .config, i.e., that builds: --- --- but I wouldn't be surprised if some strange configuration would need it. > #define FIXADDR_SIZE (__end_of_permanent_fixed_addresses << PAGE_SHIFT) > #define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) > > diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h > index 3a264200c62f..de8bace10200 100644 > --- a/arch/x86/include/asm/pgtable_64_types.h > +++ b/arch/x86/include/asm/pgtable_64_types.h > @@ -66,9 +66,6 @@ typedef struct { pteval_t pte; } pte_t; > #define VMEMMAP_START __VMEMMAP_BASE > #endif /* CONFIG_RANDOMIZE_MEMORY */ > #define VMALLOC_END (VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL)) > -#define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE) > -#define MODULES_END _AC(0xffffffffff000000, UL) How much of an ABI breakage would that be? See Documentation/x86/x86_64/mm.txt. With my .config MODULES_END becomes 0xffffffffff1fe000 and it'll remain dynamic depending on .config. No idea how much in userspace relies on MODULES_END being static 0xffffffffff000000... Hmm. diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h index 3a264200c62f..eda7fa856fa9 100644 --- a/arch/x86/include/asm/pgtable_64_types.h +++ b/arch/x86/include/asm/pgtable_64_types.h @@ -67,7 +67,7 @@ typedef struct { pteval_t pte; } pte_t; #endif /* CONFIG_RANDOMIZE_MEMORY */ #define VMALLOC_END (VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL)) #define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE) -#define MODULES_END _AC(0xffffffffff000000, UL) +#define MODULES_END __fix_to_virt(__end_of_fixed_addresses + 1) #define MODULES_LEN (MODULES_END - MODULES_VADDR) #define ESPFIX_PGD_ENTRY _AC(-2, UL) #define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)