Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1681346 > unrolled thread

[PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

Started byBaoquan He <bhe@redhat.com>
First post2017-07-05 10:10 +0200
Last post2017-07-06 03:20 +0200
Articles 3 — 2 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions Baoquan He <bhe@redhat.com> - 2017-07-05 10:10 +0200
    Re: [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Kees Cook <keescook@chromium.org> - 2017-07-06 00:10 +0200
      Re: [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Baoquan He <bhe@redhat.com> - 2017-07-06 03:20 +0200

#1681346 — [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromBaoquan He <bhe@redhat.com>
Date2017-07-05 10:10 +0200
Subject[PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZNxL-3Ho-11@gated-at.bofh.it>
Kernel text may be located in non-mirror regions (movable zone) when both
address range mirroring feature and KASLR are enabled.

The address range mirroring feature arranges such mirror region into
normal zone and other region into movable zone in order to locate
kernel code and data in mirror region. The physical memory region
whose descriptors in EFI memory map has EFI_MEMORY_MORE_RELIABLE
attribute (bit: 16) are mirrored.

If efi is detected, iterate efi memory map and pick the mirror region to
process for adding candidate of randomization slot. If efi is disabled
or no mirror region found, still process e820 memory map.

Signed-off-by: Baoquan He <bhe@redhat.com>
---
 arch/x86/boot/compressed/kaslr.c | 52 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 85c360eec4a6..94f08fd375ae 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -37,7 +37,9 @@
 #include <linux/uts.h>
 #include <linux/utsname.h>
 #include <linux/ctype.h>
+#include <linux/efi.h>
 #include <generated/utsrelease.h>
+#include <asm/efi.h>
 
 /* Macros used by the included decompressor code below. */
 #define STATIC
@@ -558,6 +560,48 @@ static void process_mem_region(struct mem_vector *entry,
 	}
 }
 
+/* Marks if efi mirror regions have been found and handled. */
+static bool efi_mirror_found;
+
+static void process_efi_entry(unsigned long minimum, unsigned long image_size)
+{
+	struct efi_info *e = &boot_params->efi_info;
+	struct mem_vector region;
+	efi_memory_desc_t *md;
+	unsigned long pmap;
+	char *signature;
+	u32 nr_desc;
+	int i;
+
+
+	signature = (char *)&boot_params->efi_info.efi_loader_signature;
+	if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
+	    strncmp(signature, EFI64_LOADER_SIGNATURE, 4))
+		return;
+
+#ifdef CONFIG_X86_32
+	/* Can't handle data above 4GB at this time */
+	if (e->efi_memmap_hi) {
+		warn("Memory map is above 4GB, EFI should be disabled.\n");
+		return;
+	}
+	pmap =  e->efi_memmap;
+#else
+	pmap = (e->efi_memmap | ((__u64)e->efi_memmap_hi << 32));
+#endif
+
+	nr_desc = e->efi_memmap_size / e->efi_memdesc_size;
+	for (i = 0; i < nr_desc; i++) {
+		md = (efi_memory_desc_t *)(pmap + (i * e->efi_memdesc_size));
+		if (md->attribute & EFI_MEMORY_MORE_RELIABLE) {
+			region.start = md->phys_addr;
+			region.size = md->num_pages << EFI_PAGE_SHIFT;
+			process_mem_region(&region, minimum, image_size);
+			efi_mirror_found = true;
+		}
+	}
+}
+
 static void process_e820_entry(unsigned long minimum, unsigned long image_size)
 {
 	int i;
@@ -592,6 +636,12 @@ static unsigned long find_random_phys_addr(unsigned long minimum,
 	/* Make sure minimum is aligned. */
 	minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
 
+#ifdef CONFIG_EFI
+	process_efi_entry(minimum, image_size);
+	if (efi_mirror_found)
+		return slots_fetch_random();
+#endif
+
 	process_e820_entry(minimum, image_size);
 	return slots_fetch_random();
 }
@@ -651,7 +701,7 @@ void choose_random_location(unsigned long input,
 	 */
 	min_addr = min(*output, 512UL << 20);
 
-	/* Walk e820 and find a random address. */
+	/* Walk available memory entries to find a random address. */
 	random_addr = find_random_phys_addr(min_addr, output_size);
 	if (!random_addr) {
 		warn("Physical KASLR disabled: no suitable memory region!");
-- 
2.5.5

[toc] | [next] | [standalone]

#1681901 — Re: [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromKees Cook <keescook@chromium.org>
Date2017-07-06 00:10 +0200
SubjectRe: [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<u00EF-3NZ-9@gated-at.bofh.it>
In reply to#1681346
On Wed, Jul 5, 2017 at 1:06 AM, Baoquan He <bhe@redhat.com> wrote:
> Kernel text may be located in non-mirror regions (movable zone) when both
> address range mirroring feature and KASLR are enabled.
>
> The address range mirroring feature arranges such mirror region into
> normal zone and other region into movable zone in order to locate
> kernel code and data in mirror region. The physical memory region
> whose descriptors in EFI memory map has EFI_MEMORY_MORE_RELIABLE
> attribute (bit: 16) are mirrored.
>
> If efi is detected, iterate efi memory map and pick the mirror region to
> process for adding candidate of randomization slot. If efi is disabled
> or no mirror region found, still process e820 memory map.
>
> Signed-off-by: Baoquan He <bhe@redhat.com>
> ---
>  arch/x86/boot/compressed/kaslr.c | 52 +++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 51 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
> index 85c360eec4a6..94f08fd375ae 100644
> --- a/arch/x86/boot/compressed/kaslr.c
> +++ b/arch/x86/boot/compressed/kaslr.c
> @@ -37,7 +37,9 @@
>  #include <linux/uts.h>
>  #include <linux/utsname.h>
>  #include <linux/ctype.h>
> +#include <linux/efi.h>
>  #include <generated/utsrelease.h>
> +#include <asm/efi.h>
>
>  /* Macros used by the included decompressor code below. */
>  #define STATIC
> @@ -558,6 +560,48 @@ static void process_mem_region(struct mem_vector *entry,
>         }
>  }
>
> +/* Marks if efi mirror regions have been found and handled. */
> +static bool efi_mirror_found;
> +
> +static void process_efi_entry(unsigned long minimum, unsigned long image_size)

Since this walks all entries (not a single entry), please name it
process_efi_entries() (or some other more clear name).

Thanks!

-Kees

> +{
> +       struct efi_info *e = &boot_params->efi_info;
> +       struct mem_vector region;
> +       efi_memory_desc_t *md;
> +       unsigned long pmap;
> +       char *signature;
> +       u32 nr_desc;
> +       int i;
> +
> +
> +       signature = (char *)&boot_params->efi_info.efi_loader_signature;
> +       if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
> +           strncmp(signature, EFI64_LOADER_SIGNATURE, 4))
> +               return;
> +
> +#ifdef CONFIG_X86_32
> +       /* Can't handle data above 4GB at this time */
> +       if (e->efi_memmap_hi) {
> +               warn("Memory map is above 4GB, EFI should be disabled.\n");
> +               return;
> +       }
> +       pmap =  e->efi_memmap;
> +#else
> +       pmap = (e->efi_memmap | ((__u64)e->efi_memmap_hi << 32));
> +#endif
> +
> +       nr_desc = e->efi_memmap_size / e->efi_memdesc_size;
> +       for (i = 0; i < nr_desc; i++) {
> +               md = (efi_memory_desc_t *)(pmap + (i * e->efi_memdesc_size));
> +               if (md->attribute & EFI_MEMORY_MORE_RELIABLE) {
> +                       region.start = md->phys_addr;
> +                       region.size = md->num_pages << EFI_PAGE_SHIFT;
> +                       process_mem_region(&region, minimum, image_size);
> +                       efi_mirror_found = true;
> +               }
> +       }
> +}
> +
>  static void process_e820_entry(unsigned long minimum, unsigned long image_size)
>  {
>         int i;
> @@ -592,6 +636,12 @@ static unsigned long find_random_phys_addr(unsigned long minimum,
>         /* Make sure minimum is aligned. */
>         minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
>
> +#ifdef CONFIG_EFI
> +       process_efi_entry(minimum, image_size);
> +       if (efi_mirror_found)
> +               return slots_fetch_random();
> +#endif
> +
>         process_e820_entry(minimum, image_size);
>         return slots_fetch_random();
>  }
> @@ -651,7 +701,7 @@ void choose_random_location(unsigned long input,
>          */
>         min_addr = min(*output, 512UL << 20);
>
> -       /* Walk e820 and find a random address. */
> +       /* Walk available memory entries to find a random address. */
>         random_addr = find_random_phys_addr(min_addr, output_size);
>         if (!random_addr) {
>                 warn("Physical KASLR disabled: no suitable memory region!");
> --
> 2.5.5
>



-- 
Kees Cook
Pixel Security

[toc] | [prev] | [next] | [standalone]

#1681991 — Re: [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromBaoquan He <bhe@redhat.com>
Date2017-07-06 03:20 +0200
SubjectRe: [PATCH v3 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<u03Cx-5Kk-5@gated-at.bofh.it>
In reply to#1681901
On 07/05/17 at 03:08pm, Kees Cook wrote:
> On Wed, Jul 5, 2017 at 1:06 AM, Baoquan He <bhe@redhat.com> wrote:
> > Kernel text may be located in non-mirror regions (movable zone) when both
> > address range mirroring feature and KASLR are enabled.
> >
> > The address range mirroring feature arranges such mirror region into
> > normal zone and other region into movable zone in order to locate
> > kernel code and data in mirror region. The physical memory region
> > whose descriptors in EFI memory map has EFI_MEMORY_MORE_RELIABLE
> > attribute (bit: 16) are mirrored.
> >
> > If efi is detected, iterate efi memory map and pick the mirror region to
> > process for adding candidate of randomization slot. If efi is disabled
> > or no mirror region found, still process e820 memory map.
> >
> > Signed-off-by: Baoquan He <bhe@redhat.com>
> > ---
> >  arch/x86/boot/compressed/kaslr.c | 52 +++++++++++++++++++++++++++++++++++++++-
> >  1 file changed, 51 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
> > index 85c360eec4a6..94f08fd375ae 100644
> > --- a/arch/x86/boot/compressed/kaslr.c
> > +++ b/arch/x86/boot/compressed/kaslr.c
> > @@ -37,7 +37,9 @@
> >  #include <linux/uts.h>
> >  #include <linux/utsname.h>
> >  #include <linux/ctype.h>
> > +#include <linux/efi.h>
> >  #include <generated/utsrelease.h>
> > +#include <asm/efi.h>
> >
> >  /* Macros used by the included decompressor code below. */
> >  #define STATIC
> > @@ -558,6 +560,48 @@ static void process_mem_region(struct mem_vector *entry,
> >         }
> >  }
> >
> > +/* Marks if efi mirror regions have been found and handled. */
> > +static bool efi_mirror_found;
> > +
> > +static void process_efi_entry(unsigned long minimum, unsigned long image_size)
> 
> Since this walks all entries (not a single entry), please name it
> process_efi_entries() (or some other more clear name).

Thanks for your reviewing, Kees!

Ok, will change. Since the e820 function was named as
process_e820_entry, I just did similarly. It makes sense to change as
you suggested, and the process_e820_entry too as you commented in v2
thread.

Thanks
Baoquan

> > +{
> > +       struct efi_info *e = &boot_params->efi_info;
> > +       struct mem_vector region;
> > +       efi_memory_desc_t *md;
> > +       unsigned long pmap;
> > +       char *signature;
> > +       u32 nr_desc;
> > +       int i;
> > +
> > +
> > +       signature = (char *)&boot_params->efi_info.efi_loader_signature;
> > +       if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
> > +           strncmp(signature, EFI64_LOADER_SIGNATURE, 4))
> > +               return;
> > +
> > +#ifdef CONFIG_X86_32
> > +       /* Can't handle data above 4GB at this time */
> > +       if (e->efi_memmap_hi) {
> > +               warn("Memory map is above 4GB, EFI should be disabled.\n");
> > +               return;
> > +       }
> > +       pmap =  e->efi_memmap;
> > +#else
> > +       pmap = (e->efi_memmap | ((__u64)e->efi_memmap_hi << 32));
> > +#endif
> > +
> > +       nr_desc = e->efi_memmap_size / e->efi_memdesc_size;
> > +       for (i = 0; i < nr_desc; i++) {
> > +               md = (efi_memory_desc_t *)(pmap + (i * e->efi_memdesc_size));
> > +               if (md->attribute & EFI_MEMORY_MORE_RELIABLE) {
> > +                       region.start = md->phys_addr;
> > +                       region.size = md->num_pages << EFI_PAGE_SHIFT;
> > +                       process_mem_region(&region, minimum, image_size);
> > +                       efi_mirror_found = true;
> > +               }
> > +       }
> > +}
> > +
> >  static void process_e820_entry(unsigned long minimum, unsigned long image_size)
> >  {
> >         int i;
> > @@ -592,6 +636,12 @@ static unsigned long find_random_phys_addr(unsigned long minimum,
> >         /* Make sure minimum is aligned. */
> >         minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
> >
> > +#ifdef CONFIG_EFI
> > +       process_efi_entry(minimum, image_size);
> > +       if (efi_mirror_found)
> > +               return slots_fetch_random();
> > +#endif
> > +
> >         process_e820_entry(minimum, image_size);
> >         return slots_fetch_random();
> >  }
> > @@ -651,7 +701,7 @@ void choose_random_location(unsigned long input,
> >          */
> >         min_addr = min(*output, 512UL << 20);
> >
> > -       /* Walk e820 and find a random address. */
> > +       /* Walk available memory entries to find a random address. */
> >         random_addr = find_random_phys_addr(min_addr, output_size);
> >         if (!random_addr) {
> >                 warn("Physical KASLR disabled: no suitable memory region!");
> > --
> > 2.5.5
> >
> 
> 
> 
> -- 
> Kees Cook
> Pixel Security

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web