Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1666524 > unrolled thread

[RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed

Back to article view | Back to linux.kernel

Contents

  [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed Baoquan He <bhe@redhat.com> - 2017-06-15 10:00 +0200
    [PATCH 1/2] x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map Baoquan He <bhe@redhat.com> - 2017-06-15 10:00 +0200
    Re: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be  randomized in mirror regions if existed Baoquan He <bhe@redhat.com> - 2017-06-15 10:10 +0200
      RE: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be  randomized in mirror regions if existed "Izumi, Taku" <izumi.taku@jp.fujitsu.com> - 2017-06-15 10:50 +0200
        Re: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be  randomized in mirror regions if existed 'Baoquan He' <bhe@redhat.com> - 2017-06-15 11:30 +0200

#1666524 — [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed

Our customer reported that Kernel text may be located on non-mirror
region (movable zone) when both address range mirroring feature and
KASLR are enabled.

The functions of address range mirroring feature are as follows.
- The physical memory region whose descriptors in EFI memory map have
  EFI_MEMORY_MORE_RELIABLE attribute (bit: 16) are mirrored
- The function arranges such mirror region into normal zone and other region
  into movable zone in order to locate kernel code and data on mirror region

So we need restrict kernel to be located inside mirror region if it
is existed.

The method is very simple. If efi is enabled, just iterate all efi
memory map and pick up mirror region to process for adding candidate
of slot. If efi disabled or no mirror region existed, still process
e820 memory map. This won't bring much efficiency loss, at worst we
just go through all efi memory maps and found no mirror.

One question:
From code, though mirror regions are existed, they are meaningful only
if kernelcore=mirror kernel option is specified. Not sure if my understanding
is correct.

NOTE:
I haven't got a machine with efi mirror region enabled, so only test the
e820 map processing case and the case of no mirror region on efi machine.
So set this as a RFC patchset, will post formal one after above question
is made clear and mirror issue test passed.

Baoquan He (2):
  x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map
  x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if
    existed

 arch/x86/boot/compressed/kaslr.c | 129 +++++++++++++++++++++++++++++++--------
 1 file changed, 104 insertions(+), 25 deletions(-)

-- 
2.5.5

[toc] | [next] | [standalone]

#1666530 — [PATCH 1/2] x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map

Now function process_e820_entry is only used to process e820 memory
entry. Adapt it for memory region only, not just for e820. Later
we will use it to process efi mirror regions.

So rename the original process_e820_entry to process_mem_region, and
extract and wrap the e820 specific processing code into process_e820_entry.

Signed-off-by: Baoquan He <bhe@redhat.com>
---
 arch/x86/boot/compressed/kaslr.c | 60 ++++++++++++++++++++++------------------
 1 file changed, 33 insertions(+), 27 deletions(-)

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index fe318b4..c2ed051 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -479,35 +479,31 @@ static unsigned long slots_fetch_random(void)
 	return 0;
 }
 
-static void process_e820_entry(struct boot_e820_entry *entry,
+static void process_mem_region(struct mem_vector *entry,
 			       unsigned long minimum,
 			       unsigned long image_size)
 {
 	struct mem_vector region, overlap;
 	struct slot_area slot_area;
 	unsigned long start_orig, end;
-	struct boot_e820_entry cur_entry;
-
-	/* Skip non-RAM entries. */
-	if (entry->type != E820_TYPE_RAM)
-		return;
+	struct mem_vector cur_entry;
 
 	/* On 32-bit, ignore entries entirely above our maximum. */
-	if (IS_ENABLED(CONFIG_X86_32) && entry->addr >= KERNEL_IMAGE_SIZE)
+	if (IS_ENABLED(CONFIG_X86_32) && entry->start >= KERNEL_IMAGE_SIZE)
 		return;
 
 	/* Ignore entries entirely below our minimum. */
-	if (entry->addr + entry->size < minimum)
+	if (entry->start + entry->size < minimum)
 		return;
 
 	/* Ignore entries above memory limit */
-	end = min(entry->size + entry->addr, mem_limit);
-	if (entry->addr >= end)
+	end = min(entry->size + entry->start, mem_limit);
+	if (entry->start >= end)
 		return;
-	cur_entry.addr = entry->addr;
-	cur_entry.size = end - entry->addr;
+	cur_entry.start = entry->start;
+	cur_entry.size = end - entry->start;
 
-	region.start = cur_entry.addr;
+	region.start = cur_entry.start;
 	region.size = cur_entry.size;
 
 	/* Give up if slot area array is full. */
@@ -522,7 +518,7 @@ static void process_e820_entry(struct boot_e820_entry *entry,
 		region.start = ALIGN(region.start, CONFIG_PHYSICAL_ALIGN);
 
 		/* Did we raise the address above this e820 region? */
-		if (region.start > cur_entry.addr + cur_entry.size)
+		if (region.start > cur_entry.start + cur_entry.size)
 			return;
 
 		/* Reduce size by any delta from the original address. */
@@ -562,12 +558,31 @@ static void process_e820_entry(struct boot_e820_entry *entry,
 	}
 }
 
-static unsigned long find_random_phys_addr(unsigned long minimum,
-					   unsigned long image_size)
+static void process_e820_entry(unsigned long minimum,unsigned long image_size)
 {
 	int i;
-	unsigned long addr;
+	struct mem_vector region;
+	struct boot_e820_entry *entry;
+
+	/* Verify potential e820 positions, appending to slots list. */
+        for (i = 0; i < boot_params->e820_entries; i++) {
+                entry = &boot_params->e820_table[i];
+                /* Skip non-RAM entries. */
+                if (entry->type != E820_TYPE_RAM)
+                        continue;
+                region.start = entry->addr;
+                region.size = entry->size;
+                process_mem_region(&region, minimum, image_size);
+                if (slot_area_index == MAX_SLOT_AREA) {
+                        debug_putstr("Aborted e820 scan (slot_areas full)!\n");
+                        break;
+                }
+        }
+}
 
+static unsigned long find_random_phys_addr(unsigned long minimum,
+					   unsigned long image_size)
+{
 	/* Check if we had too many memmaps. */
 	if (memmap_too_large) {
 		debug_putstr("Aborted e820 scan (more than 4 memmap= args)!\n");
@@ -577,16 +592,7 @@ static unsigned long find_random_phys_addr(unsigned long minimum,
 	/* Make sure minimum is aligned. */
 	minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
 
-	/* Verify potential e820 positions, appending to slots list. */
-	for (i = 0; i < boot_params->e820_entries; i++) {
-		process_e820_entry(&boot_params->e820_table[i], minimum,
-				   image_size);
-		if (slot_area_index == MAX_SLOT_AREA) {
-			debug_putstr("Aborted e820 scan (slot_areas full)!\n");
-			break;
-		}
-	}
-
+	process_e820_entry(minimum, image_size);
 	return slots_fetch_random();
 }
 
-- 
2.5.5

[toc] | [prev] | [next] | [standalone]

#1666544 — Re: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed

Sorry, forget adding Taku to the list.

Hi Taku,

On 06/15/17 at 03:52pm, Baoquan He wrote:
> Our customer reported that Kernel text may be located on non-mirror
> region (movable zone) when both address range mirroring feature and
> KASLR are enabled.
> 
> The functions of address range mirroring feature are as follows.
> - The physical memory region whose descriptors in EFI memory map have
>   EFI_MEMORY_MORE_RELIABLE attribute (bit: 16) are mirrored
> - The function arranges such mirror region into normal zone and other region
>   into movable zone in order to locate kernel code and data on mirror region
> 
> So we need restrict kernel to be located inside mirror region if it
> is existed.
> 
> The method is very simple. If efi is enabled, just iterate all efi
> memory map and pick up mirror region to process for adding candidate
> of slot. If efi disabled or no mirror region existed, still process
> e820 memory map. This won't bring much efficiency loss, at worst we
> just go through all efi memory maps and found no mirror.
> 
> One question:
> From code, though mirror regions are existed, they are meaningful only
> if kernelcore=mirror kernel option is specified. Not sure if my understanding
> is correct.

Since you are the author of kernelcore=mirror related code and expert on
mirror feature, could you help answer above question?

Thanks
Baoquan
> 
> NOTE:
> I haven't got a machine with efi mirror region enabled, so only test the
> e820 map processing case and the case of no mirror region on efi machine.
> So set this as a RFC patchset, will post formal one after above question
> is made clear and mirror issue test passed.
> 
> Baoquan He (2):
>   x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map
>   x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if
>     existed
> 
>  arch/x86/boot/compressed/kaslr.c | 129 +++++++++++++++++++++++++++++++--------
>  1 file changed, 104 insertions(+), 25 deletions(-)
> 
> -- 
> 2.5.5
> 

[toc] | [prev] | [next] | [standalone]

#1666575 — RE: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed

Dear Baoquan,

> > Our customer reported that Kernel text may be located on non-mirror
> > region (movable zone) when both address range mirroring feature and
> > KASLR are enabled.

   I know your customer :)

> > The functions of address range mirroring feature are as follows.
> > - The physical memory region whose descriptors in EFI memory map have
> >   EFI_MEMORY_MORE_RELIABLE attribute (bit: 16) are mirrored
> > - The function arranges such mirror region into normal zone and other
> region
> >   into movable zone in order to locate kernel code and data on mirror
> > region
> >
> > So we need restrict kernel to be located inside mirror region if it is
> > existed.
> >
> > The method is very simple. If efi is enabled, just iterate all efi
> > memory map and pick up mirror region to process for adding candidate
> > of slot. If efi disabled or no mirror region existed, still process
> > e820 memory map. This won't bring much efficiency loss, at worst we
> > just go through all efi memory maps and found no mirror.
> >
> > One question:
> > From code, though mirror regions are existed, they are meaningful only
> > if kernelcore=mirror kernel option is specified. Not sure if my
> > understanding is correct.

   Your understanding is almost correct. 
   Only when "kernelcore=mirror" specified, the above procedure works.
   But, if mirrored regions are existed, bootmem allocator tries to 
   allocate from mirrored region independently of "kerenelcore=mirror" option.

   So, IMHO, kernel text is important, so putting it to mirrored (more reliable)
   region is reasonable whether or not "kernelcore=mirror" is specified.

   Anyway thanks for submitting patch.
   We have Address Range Mirroring capable machine, so we'll test your patch.

  Sincerely,
  Taku Izumi

> 
> Since you are the author of kernelcore=mirror related code and expert on
> mirror feature, could you help answer above question?
> 
> Thanks
> Baoquan
> >
> > NOTE:
> > I haven't got a machine with efi mirror region enabled, so only test
> > the
> > e820 map processing case and the case of no mirror region on efi machine.
> > So set this as a RFC patchset, will post formal one after above
> > question is made clear and mirror issue test passed.
> >
> > Baoquan He (2):
> >   x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map
> >   x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if
> >     existed
> >
> >  arch/x86/boot/compressed/kaslr.c | 129
> > +++++++++++++++++++++++++++++++--------
> >  1 file changed, 104 insertions(+), 25 deletions(-)
> >
> > --
> > 2.5.5
> >

[toc] | [prev] | [next] | [standalone]

#1666598 — Re: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed

On 06/15/17 at 08:34am, Izumi, Taku wrote:
> Dear Baoquan,
> 
> > > Our customer reported that Kernel text may be located on non-mirror
> > > region (movable zone) when both address range mirroring feature and
> > > KASLR are enabled.
> 
>    I know your customer :)

LOL, have to agree.

> > > The method is very simple. If efi is enabled, just iterate all efi
> > > memory map and pick up mirror region to process for adding candidate
> > > of slot. If efi disabled or no mirror region existed, still process
> > > e820 memory map. This won't bring much efficiency loss, at worst we
> > > just go through all efi memory maps and found no mirror.
> > >
> > > One question:
> > > From code, though mirror regions are existed, they are meaningful only
> > > if kernelcore=mirror kernel option is specified. Not sure if my
> > > understanding is correct.
> 
>    Your understanding is almost correct. 
>    Only when "kernelcore=mirror" specified, the above procedure works.
>    But, if mirrored regions are existed, bootmem allocator tries to 
>    allocate from mirrored region independently of "kerenelcore=mirror" option.
> 
>    So, IMHO, kernel text is important, so putting it to mirrored (more reliable)
>    region is reasonable whether or not "kernelcore=mirror" is specified.

Ah, yeah, thanks for telling. So at boot time memblock will put mirror
region in highest priority to allocate. Then let me remove the
kernelcore=mirror handling code, the process_efi_entry will be simpler.

commit a3f5bafcc04aaf62990e0cf3ced1cc6d8dc6fe95
Author: Tony Luck <tony.luck@intel.com>
Date:   Wed Jun 24 16:58:12 2015 -0700

    mm/memblock: allocate boot time data structures from mirrored memory

> 
>    Anyway thanks for submitting patch.
>    We have Address Range Mirroring capable machine, so we'll test your patch.

Thanks a lot for help, Yasuaki Ishimatsu said he also will loan me a testing
machine when it's available.

Thanks
Baoquan

> > 
> > >
> > > NOTE:
> > > I haven't got a machine with efi mirror region enabled, so only test
> > > the
> > > e820 map processing case and the case of no mirror region on efi machine.
> > > So set this as a RFC patchset, will post formal one after above
> > > question is made clear and mirror issue test passed.
> > >
> > > Baoquan He (2):
> > >   x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map
> > >   x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if
> > >     existed
> > >
> > >  arch/x86/boot/compressed/kaslr.c | 129
> > > +++++++++++++++++++++++++++++++--------
> > >  1 file changed, 104 insertions(+), 25 deletions(-)
> > >
> > > --
> > > 2.5.5
> > >
> 

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web