linux-pm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Pavel Machek <pavel@ucw.cz>
To: Ingo Molnar <mingo@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>,
	"Peter Zijlstra" <peterz@infradead.org>,
	"Thomas Garnier" <thgarnie@google.com>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"David S . Miller" <davem@davemloft.net>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"Ingo Molnar" <mingo@redhat.com>,
	"Josh Poimboeuf" <jpoimboe@redhat.com>,
	"Arnd Bergmann" <arnd@arndb.de>,
	"Matthias Kaehlcke" <mka@chromium.org>,
	"Boris Ostrovsky" <boris.ostrovsky@oracle.com>,
	"Juergen Gross" <jgross@suse.com>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Radim Krčmář" <rkrcmar@redhat.com>,
	"Joerg Roedel" <joro@8bytes.org>,
	"Tom Lendacky" <thomas.lendacky@amd.com>,
	"Andy Lutomirski" <luto@kernel.org>,
	"Borislav Petkov" <bp@suse.de>, "Brian Gerst" <brgerst@gmail.com>,
	"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
	"Rafael J . Wysocki" <rjw@rjwysocki.net>,
	"Len Brown" <len.brown@intel.com>, "Tejun Heo" <tj@kernel.org>
Subject: Re: x86: PIE support and option to extend KASLR randomization
Date: Mon, 25 Sep 2017 00:37:08 +0200	[thread overview]
Message-ID: <20170924223708.GA12616@amd> (raw)
In-Reply-To: <20170923100029.6nzpui6c3ke76bbs@gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1813 bytes --]

Hi!

> > We do need to consider how we want modules to fit into whatever model we
> > choose, though.  They can be adjacent, or we could go with a more
> > traditional dynamic link model where the modules can be separate, and
> > chained together with the main kernel via the GOT.
> 
> So I believe we should start with 'adjacent'. The thing is, having modules 
> separately randomized mostly helps if any of the secret locations fails and
> we want to prevent hopping from one to the other. But if one the kernel-privileged
> secret location fails then KASLR has already failed to a significant degree...
> 
> So I think the large-PIC model for modules does not buy us any real advantages in 
> practice, and the disadvantages of large-PIC are real and most Linux users have to 
> pay that cost unconditionally, as distro kernels have half of their kernel 
> functionality living in modules.
> 
> But I do see fundamental value in being able to hide the kernel somewhere in a ~48 
> bits address space, especially if we also implement Linus's suggestion to utilize 
> the lower bits as well. 0..281474976710656 is a nicely large range and will get 
> larger with time.
> 
> But it should all be done smartly and carefully:
> 
> For example, there would be collision with regular user-space mappings, right?
> Can local unprivileged users use mmap(MAP_FIXED) probing to figure out where
> the kernel lives?

Local unpriviledged users can probably get your secret bits using
cache probing and jump prediction buffers.

Yes, you don't want to leak the information using mmap(MAP_FIXED), but
CPU will leak it for you, anyway.
									Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

  reply	other threads:[~2017-09-24 22:37 UTC|newest]

Thread overview: 81+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-08-10 17:25 x86: PIE support and option to extend KASLR randomization Thomas Garnier
2017-08-10 17:25 ` [RFC v2 01/23] x86/crypto: Adapt assembly for PIE support Thomas Garnier
2017-08-10 17:25 ` [RFC v2 02/23] x86: Use symbol name on bug table " Thomas Garnier
2017-08-10 17:25 ` [RFC v2 03/23] x86: Use symbol name in jump " Thomas Garnier
2017-08-10 17:25 ` [RFC v2 04/23] x86: Add macro to get symbol address " Thomas Garnier
2017-08-10 17:25 ` [RFC v2 05/23] xen: Adapt assembly " Thomas Garnier
2017-08-10 17:25 ` [RFC v2 06/23] kvm: " Thomas Garnier
2017-08-10 17:25 ` [RFC v2 07/23] x86: relocate_kernel - " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 08/23] x86/entry/64: " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 09/23] x86: pm-trace - " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 10/23] x86/CPU: " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 11/23] x86/acpi: " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 12/23] x86/boot/64: " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 13/23] x86/power/64: " Thomas Garnier
2017-08-11 12:36   ` Pavel Machek
2017-08-11 15:09     ` Thomas Garnier
2017-08-10 17:26 ` [RFC v2 14/23] x86/paravirt: " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 15/23] x86/boot/64: Use _text in a global " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 16/23] x86/percpu: Adapt percpu " Thomas Garnier
2017-08-10 17:26 ` [RFC v2 17/23] compiler: Option to default to hidden symbols Thomas Garnier
2017-08-10 17:26 ` [RFC v2 18/23] x86/relocs: Handle DYN relocations for PIE support Thomas Garnier
2017-08-10 17:26 ` [RFC v2 19/23] x86: Support global stack cookie Thomas Garnier
2017-08-10 17:26 ` [RFC v2 20/23] x86/pie: Add option to build the kernel as PIE for x86_64 Thomas Garnier
2017-08-10 17:26 ` [RFC v2 21/23] x86/relocs: Add option to generate 64-bit relocations Thomas Garnier
2017-08-10 17:26 ` [RFC v2 22/23] x86/module: Add support for mcmodel large and PLTs Thomas Garnier
2017-08-10 17:26 ` [RFC v2 23/23] x86/kaslr: Add option to extend KASLR range from 1GB to 3GB Thomas Garnier
2017-08-11 12:41 ` x86: PIE support and option to extend KASLR randomization Ingo Molnar
2017-08-11 15:09   ` Thomas Garnier
2017-08-15  7:56     ` Ingo Molnar
2017-08-15 14:20       ` Thomas Garnier
2017-08-15 14:47         ` Daniel Micay
2017-08-15 14:58           ` Thomas Garnier
2017-08-16 15:12         ` Ingo Molnar
2017-08-16 16:09           ` Christopher Lameter
2017-08-16 16:26           ` Daniel Micay
2017-08-16 16:32             ` Ard Biesheuvel
2017-08-16 16:57           ` Thomas Garnier
2017-08-17  8:09             ` Ingo Molnar
2017-08-17 14:10               ` Thomas Garnier
2017-08-24 21:13                 ` Thomas Garnier
2017-08-24 21:42                   ` Linus Torvalds
2017-08-25 15:35                     ` Thomas Garnier
2017-08-25  1:07                   ` Steven Rostedt
2017-08-25  8:04                   ` Ingo Molnar
2017-08-25 15:05                     ` Thomas Garnier
2017-08-29 19:34                       ` Thomas Garnier
2017-09-21 15:59                         ` Ingo Molnar
2017-09-21 16:10                           ` Ard Biesheuvel
2017-09-21 21:21                             ` Thomas Garnier
2017-09-22  4:24                               ` Markus Trippelsdorf
2017-09-22 14:38                                 ` Thomas Garnier
2017-09-22 23:55                               ` Thomas Garnier
2017-09-21 21:16                           ` Thomas Garnier
2017-09-22  0:06                             ` Thomas Garnier
2017-09-22 16:32                             ` Ingo Molnar
2017-09-22 18:08                               ` Thomas Garnier
2017-09-23  9:43                                 ` Ingo Molnar
2017-10-02 20:28                                   ` Thomas Garnier
2017-09-22 18:38                               ` H. Peter Anvin
2017-09-22 18:57                                 ` Kees Cook
2017-09-22 19:06                                   ` H. Peter Anvin
2017-09-22 18:59                                 ` Thomas Garnier
2017-09-23  9:49                                 ` Ingo Molnar
2017-08-17 14:12               ` Boris Lukashev
2017-08-25 15:38                 ` Christopher Lameter
2017-08-27 22:39                   ` Boris Lukashev
2017-08-28  9:59                 ` Pavel Machek
2017-08-21 13:32           ` Peter Zijlstra
2017-08-21 14:28             ` Peter Zijlstra
2017-09-22 18:27               ` H. Peter Anvin
2017-09-23 10:00                 ` Ingo Molnar
2017-09-24 22:37                   ` Pavel Machek [this message]
2017-09-25  7:33                     ` Ingo Molnar
2017-10-06 10:39                       ` Pavel Machek
2017-10-20  8:13                         ` Ingo Molnar
2017-08-21 14:31         ` Peter Zijlstra
2017-08-21 15:57           ` Thomas Garnier
2017-08-28  1:26           ` H. Peter Anvin
  -- strict thread matches above, loose matches on Subject: below --
2017-10-04 21:19 Thomas Garnier
2017-07-18 22:33 Thomas Garnier
2017-07-19 14:08 ` Christopher Lameter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170924223708.GA12616@amd \
    --to=pavel@ucw.cz \
    --cc=arnd@arndb.de \
    --cc=boris.ostrovsky@oracle.com \
    --cc=bp@suse.de \
    --cc=brgerst@gmail.com \
    --cc=davem@davemloft.net \
    --cc=herbert@gondor.apana.org.au \
    --cc=hpa@zytor.com \
    --cc=jgross@suse.com \
    --cc=joro@8bytes.org \
    --cc=jpoimboe@redhat.com \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=len.brown@intel.com \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=mingo@redhat.com \
    --cc=mka@chromium.org \
    --cc=pbonzini@redhat.com \
    --cc=peterz@infradead.org \
    --cc=rjw@rjwysocki.net \
    --cc=rkrcmar@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=thgarnie@google.com \
    --cc=thomas.lendacky@amd.com \
    --cc=tj@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).