Re: [PATCH 0/2] Determine kernel text mapping size at runtime for x86_64

[Dave Anderson]

----- Original Message -----
> On Wed, Dec 7, 2016 at 11:56 PM, Baoquan He <bhe@xxxxxxxxxx> wrote:
> > Dave Anderson ever told in Crash utility he makes judgement whether it's
> > a kaslr kernel by size of KERNEL_IMAGE_SIZE. As long as it's 1G, it's
> > recognized as kaslr. Then the current upstream kernel has a wrong behaviour,
> > it sets KERNEL_IMAGE_SIZE as 1G as long as CONFIG_RANDOMIZE_BASE is enabled,
> > though people specify "nokaslr" into cmdline to disable kaslr explicitly.
> 
> I'm not sure that's the correct solution to the Crash utility -- the
> kaslr-ness of a kernel should be already exposed in the dump with the
> kaslr_enabled variable yes?

The crash utility doesn't use KERNEL_IMAGE_SIZE to determine whether
KASLR is in play, but rather to determine the base of the modules virtual
address space (i.e, the same way the kernel does).  And then it uses that
value in a couple other places.

Dave


> 
> > So in this patchset, made changes to determine the size of kernel text
> > mapping
> > area at runtime. If "nokaslr" specified, kernel mapping size is 512M though
> > CONFIG_RANDOMIZE_BASE is enabled.
> 
> This seems to make the non-KASLR case more consistent, so I'm fine
> with the idea. Once the build-bots are happy with everything, consider
> the series:
> 
> Acked-by: Kees Cook <keescook@xxxxxxxxxxxx>
> 
> Thanks!
> 
> -Kees
> 
> >
> > Baoquan He (2):
> >   x86/64: Make kernel text mapping always take one whole page table in
> >     early boot code
> >   x86/KASLR/64: Determine kernel text mapping size at runtime
> >
> >  arch/x86/boot/compressed/kaslr.c        | 15 ++++++++++-----
> >  arch/x86/include/asm/kaslr.h            |  1 +
> >  arch/x86/include/asm/page_64_types.h    | 20 ++++++++++++--------
> >  arch/x86/include/asm/pgtable_64_types.h |  2 +-
> >  arch/x86/kernel/head64.c                | 11 ++++++-----
> >  arch/x86/kernel/head_64.S               | 16 +++++++++-------
> >  arch/x86/mm/dump_pagetables.c           |  3 ++-
> >  arch/x86/mm/init_64.c                   |  2 +-
> >  arch/x86/mm/physaddr.c                  |  6 +++---
> >  9 files changed, 45 insertions(+), 31 deletions(-)
> >
> > --
> > 2.5.5
> >
> 
> 
> 
> --
> Kees Cook
> Nexus Security
>