From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753477AbdGJHvs (ORCPT ); Mon, 10 Jul 2017 03:51:48 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47096 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752276AbdGJHvr (ORCPT ); Mon, 10 Jul 2017 03:51:47 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 741943B74E Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=bhe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 741943B74E Date: Mon, 10 Jul 2017 15:50:52 +0800 From: Baoquan He To: Kees Cook Cc: LKML , "x86@kernel.org" , Matt Fleming , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , izumi.taku@jp.fujitsu.com, fanc.fnst@cn.fujitsu.com, Thomas Garnier Subject: Re: [PATCH v4 4/4] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions Message-ID: <20170710075052.GE13560@x1> References: <1499603862-11516-1-git-send-email-bhe@redhat.com> <1499603862-11516-5-git-send-email-bhe@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.0 (2016-08-17) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Mon, 10 Jul 2017 07:51:46 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Kees, Do you think the patch as below is OK to you? Thanks! >>From 1cec45dc65090f6d17bf3499b8904efc1822082e Mon Sep 17 00:00:00 2001 From: Baoquan He Date: Fri, 7 Jul 2017 17:25:41 +0800 Subject: [PATCH v5 4/4] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions Kernel text may be located in non-mirror regions (movable zone) when both address range mirroring feature and KASLR are enabled. The address range mirroring feature arranges such mirror region into normal zone and other region into movable zone in order to locate kernel code and data in mirror region. The physical memory region whose descriptors in EFI memory map has EFI_MEMORY_MORE_RELIABLE attribute (bit: 16) are mirrored. If efi is detected, iterate efi memory map and pick the mirror region to process for adding candidate of randomization slot. If efi is disabled or no mirror region found, still process e820 memory map. Signed-off-by: Baoquan He --- v4->v5: Change the process_efi_entries() to return bool value to indicate if a mirror region is found and has been processed to add slots. Move process_efi_entries() into #ifdef CONFIG_EFI section, and also make another dummy process_efi_entries() to return false behind #else. These are done according to Kees's suggestion. arch/x86/boot/compressed/kaslr.c | 68 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 66 insertions(+), 2 deletions(-) diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c index 99c7194f7ea6..9059b571eca1 100644 --- a/arch/x86/boot/compressed/kaslr.c +++ b/arch/x86/boot/compressed/kaslr.c @@ -37,7 +37,9 @@ #include #include #include +#include #include +#include /* Macros used by the included decompressor code below. */ #define STATIC @@ -558,6 +560,65 @@ static void process_mem_region(struct mem_vector *entry, } } +#ifdef CONFIG_EFI +/* + * Returns true if mirror region found (and must have been processed + * for slots adding) + */ +static bool process_efi_entries(unsigned long minimum, + unsigned long image_size) +{ + struct efi_info *e = &boot_params->efi_info; + bool efi_mirror_found = false; + struct mem_vector region; + efi_memory_desc_t *md; + unsigned long pmap; + char *signature; + u32 nr_desc; + int i; + + signature = (char *)&boot_params->efi_info.efi_loader_signature; + if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) && + strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) + return false; + +#ifdef CONFIG_X86_32 + /* Can't handle data above 4GB at this time */ + if (e->efi_memmap_hi) { + warn("Memory map is above 4GB, EFI should be disabled.\n"); + return false; + } + pmap = e->efi_memmap; +#else + pmap = (e->efi_memmap | ((__u64)e->efi_memmap_hi << 32)); +#endif + + nr_desc = e->efi_memmap_size / e->efi_memdesc_size; + for (i = 0; i < nr_desc; i++) { + md = (efi_memory_desc_t *)(pmap + (i * e->efi_memdesc_size)); + if (md->attribute & EFI_MEMORY_MORE_RELIABLE) { + region.start = md->phys_addr; + region.size = md->num_pages << EFI_PAGE_SHIFT; + process_mem_region(®ion, minimum, image_size); + efi_mirror_found = true; + + if (slot_area_index == MAX_SLOT_AREA) { + debug_putstr("Aborted efi scan (slot_areas full)!\n"); + break; + } + } + } + + return efi_mirror_found; +} +#else +static inline bool process_efi_entries(unsigned long minimum, + unsigned long image_size) +{ + return false; +} +#endif + static void process_e820_entries(unsigned long minimum, unsigned long image_size) { @@ -586,13 +647,16 @@ static unsigned long find_random_phys_addr(unsigned long minimum, { /* Check if we had too many memmaps. */ if (memmap_too_large) { - debug_putstr("Aborted e820 scan (more than 4 memmap= args)!\n"); + debug_putstr("Aborted memory entries scan (more than 4 memmap= args)!\n"); return 0; } /* Make sure minimum is aligned. */ minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN); + if(process_efi_entries(minimum, image_size)) + return slots_fetch_random(); + process_e820_entries(minimum, image_size); return slots_fetch_random(); } @@ -652,7 +716,7 @@ void choose_random_location(unsigned long input, */ min_addr = min(*output, 512UL << 20); - /* Walk e820 and find a random address. */ + /* Walk available memory entries to find a random address. */ random_addr = find_random_phys_addr(min_addr, output_size); if (!random_addr) { warn("Physical KASLR disabled: no suitable memory region!"); -- 2.5.5