Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1680740 > unrolled thread

[PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

Started byBaoquan He <bhe@redhat.com>
First post2017-07-04 10:10 +0200
Last post2017-07-05 01:20 +0200
Articles 7 — 3 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions Baoquan He <bhe@redhat.com> - 2017-07-04 10:10 +0200
    Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Thomas Gleixner <tglx@linutronix.de> - 2017-07-04 16:10 +0200
      Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Baoquan He <bhe@redhat.com> - 2017-07-04 16:40 +0200
        Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Thomas Gleixner <tglx@linutronix.de> - 2017-07-04 16:50 +0200
          Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Matt Fleming <matt@codeblueprint.co.uk> - 2017-07-04 17:40 +0200
            Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Thomas Gleixner <tglx@linutronix.de> - 2017-07-04 17:50 +0200
              Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized  in mirror regions Baoquan He <bhe@redhat.com> - 2017-07-05 01:20 +0200

#1680740 — [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromBaoquan He <bhe@redhat.com>
Date2017-07-04 10:10 +0200
Subject[PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZr4f-5Hh-19@gated-at.bofh.it>
Kernel text may be located in non-mirror regions (movable zone) when both
address range mirroring feature and KASLR are enabled.

The address range mirroring feature arranges such mirror region into
normal zone and other region into movable zone in order to locate
kernel code and data in mirror region. The physical memory region
whose descriptors in EFI memory map has EFI_MEMORY_MORE_RELIABLE
attribute (bit: 16) are mirrored.

If efi is detected, iterate efi memory map and pick the mirror region to
process for adding candidate of randomization slot. If efi is disabled
or no mirror region found, still process e820 memory map.

Signed-off-by: Baoquan He <bhe@redhat.com>
---
 arch/x86/boot/compressed/kaslr.c | 52 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 85c360eec4a6..5f10e0b10ef4 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -37,7 +37,9 @@
 #include <linux/uts.h>
 #include <linux/utsname.h>
 #include <linux/ctype.h>
+#include <linux/efi.h>
 #include <generated/utsrelease.h>
+#include <asm/efi.h>
 
 /* Macros used by the included decompressor code below. */
 #define STATIC
@@ -558,6 +560,50 @@ static void process_mem_region(struct mem_vector *entry,
 	}
 }
 
+/* Marks if efi mirror regions have been found and handled. */
+static bool efi_mirror_found;
+
+static void process_efi_entry(unsigned long minimum, unsigned long image_size)
+{
+	struct efi_info *e = &boot_params->efi_info;
+	struct mem_vector region;
+	efi_memory_desc_t *md;
+	unsigned long pmap;
+	char *signature;
+	u32 nr_desc;
+	int i;
+
+
+#ifdef CONFIG_EFI
+	signature = (char *)&boot_params->efi_info.efi_loader_signature;
+#endif
+	if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
+	    strncmp(signature, EFI64_LOADER_SIGNATURE, 4))
+		return;
+
+#ifdef CONFIG_X86_32
+	/* Can't handle data above 4GB at this time */
+	if (e->efi_memmap_hi) {
+		warn("Memory map is above 4GB, EFI should be disabled.\n");
+		return;
+	}
+	pmap =  e->efi_memmap;
+#else
+	pmap = (e->efi_memmap | ((__u64)e->efi_memmap_hi << 32));
+#endif
+
+	nr_desc = e->efi_memmap_size / e->efi_memdesc_size;
+	for (i = 0; i < nr_desc; i++) {
+		md = (efi_memory_desc_t *)(pmap + (i * e->efi_memdesc_size));
+		if (md->attribute & EFI_MEMORY_MORE_RELIABLE) {
+			region.start = md->phys_addr;
+			region.size = md->num_pages << EFI_PAGE_SHIFT;
+			process_mem_region(&region, minimum, image_size);
+			efi_mirror_found = true;
+		}
+	}
+}
+
 static void process_e820_entry(unsigned long minimum, unsigned long image_size)
 {
 	int i;
@@ -592,6 +638,10 @@ static unsigned long find_random_phys_addr(unsigned long minimum,
 	/* Make sure minimum is aligned. */
 	minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
 
+	process_efi_entry(minimum, image_size);
+	if (efi_mirror_found)
+		return slots_fetch_random();
+
 	process_e820_entry(minimum, image_size);
 	return slots_fetch_random();
 }
@@ -651,7 +701,7 @@ void choose_random_location(unsigned long input,
 	 */
 	min_addr = min(*output, 512UL << 20);
 
-	/* Walk e820 and find a random address. */
+	/* Walk available memory entries to find a random address. */
 	random_addr = find_random_phys_addr(min_addr, output_size);
 	if (!random_addr) {
 		warn("Physical KASLR disabled: no suitable memory region!");
-- 
2.5.5

[toc] | [next] | [standalone]

#1680997 — Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromThomas Gleixner <tglx@linutronix.de>
Date2017-07-04 16:10 +0200
SubjectRe: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZwGB-Oa-15@gated-at.bofh.it>
In reply to#1680740
On Tue, 4 Jul 2017, Baoquan He wrote:
> +/* Marks if efi mirror regions have been found and handled. */
> +static bool efi_mirror_found;
> +
> +static void process_efi_entry(unsigned long minimum, unsigned long image_size)
> +{
> +	struct efi_info *e = &boot_params->efi_info;
> +	struct mem_vector region;
> +	efi_memory_desc_t *md;
> +	unsigned long pmap;
> +	char *signature;
> +	u32 nr_desc;
> +	int i;
> +
> +
> +#ifdef CONFIG_EFI
> +	signature = (char *)&boot_params->efi_info.efi_loader_signature;
> +#endif

So if CONFIG_EFI=n you happily dereference the uninitialized signature
pointer ...

Why is process_efi_entry() invoked at all if EFI is not enabled?

> +	if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
> +	    strncmp(signature, EFI64_LOADER_SIGNATURE, 4))
> +		return;
> +

Thanks,

	tglx

[toc] | [prev] | [next] | [standalone]

#1681024 — Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromBaoquan He <bhe@redhat.com>
Date2017-07-04 16:40 +0200
SubjectRe: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZx9E-12c-5@gated-at.bofh.it>
In reply to#1680997
On 07/04/17 at 04:00pm, Thomas Gleixner wrote:
> On Tue, 4 Jul 2017, Baoquan He wrote:
> > +/* Marks if efi mirror regions have been found and handled. */
> > +static bool efi_mirror_found;
> > +
> > +static void process_efi_entry(unsigned long minimum, unsigned long image_size)
> > +{
> > +	struct efi_info *e = &boot_params->efi_info;
> > +	struct mem_vector region;
> > +	efi_memory_desc_t *md;
> > +	unsigned long pmap;
> > +	char *signature;
> > +	u32 nr_desc;
> > +	int i;
> > +
> > +
> > +#ifdef CONFIG_EFI
> > +	signature = (char *)&boot_params->efi_info.efi_loader_signature;
> > +#endif
> 
> So if CONFIG_EFI=n you happily dereference the uninitialized signature
> pointer ...

Right, this is a mistake. Thanks for pointing it out. I should have
checked if the pointer is NULL.

In fact I just referred to code in setup_arch(). Now I have a question,
though CONFIG_EFI=y but efi firmware is not enabled,
boot_params.efi_info.efi_loader_signature should be initilized to 0.
Then below code is also problematic.

#ifdef CONFIG_EFI
        if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,                                                                         
                     EFI32_LOADER_SIGNATURE, 4)) {
                set_bit(EFI_BOOT, &efi.flags);
        } else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
                     EFI64_LOADER_SIGNATURE, 4)) {
                set_bit(EFI_BOOT, &efi.flags);
                set_bit(EFI_64BIT, &efi.flags);
        }

        if (efi_enabled(EFI_BOOT))
                efi_memblock_x86_reserve_range();
#endif

> 
> Why is process_efi_entry() invoked at all if EFI is not enabled?


Yeah, and it's better to check if CONFIG_EFI is enabled before
invocation of process_efi_entry(). Let me change it as below and repost.
Thanks again for looking into this patchset.

+#ifdef CONFIG_EFI
        process_efi_entry(minimum, image_size);
+#endif

> 
> > +	if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
> > +	    strncmp(signature, EFI64_LOADER_SIGNATURE, 4))
> > +		return;
> > +
> 
> Thanks,
> 
> 	tglx

[toc] | [prev] | [next] | [standalone]

#1681026 — Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromThomas Gleixner <tglx@linutronix.de>
Date2017-07-04 16:50 +0200
SubjectRe: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZxjj-1fd-15@gated-at.bofh.it>
In reply to#1681024
On Tue, 4 Jul 2017, Baoquan He wrote:

> On 07/04/17 at 04:00pm, Thomas Gleixner wrote:
> > On Tue, 4 Jul 2017, Baoquan He wrote:
> > > +/* Marks if efi mirror regions have been found and handled. */
> > > +static bool efi_mirror_found;
> > > +
> > > +static void process_efi_entry(unsigned long minimum, unsigned long image_size)
> > > +{
> > > +	struct efi_info *e = &boot_params->efi_info;
> > > +	struct mem_vector region;
> > > +	efi_memory_desc_t *md;
> > > +	unsigned long pmap;
> > > +	char *signature;
> > > +	u32 nr_desc;
> > > +	int i;
> > > +
> > > +
> > > +#ifdef CONFIG_EFI
> > > +	signature = (char *)&boot_params->efi_info.efi_loader_signature;
> > > +#endif
> > 
> > So if CONFIG_EFI=n you happily dereference the uninitialized signature
> > pointer ...
> 
> Right, this is a mistake. Thanks for pointing it out. I should have
> checked if the pointer is NULL.

The pointer is not NULL, it's not initialized.
 
> In fact I just referred to code in setup_arch(). Now I have a question,
> though CONFIG_EFI=y but efi firmware is not enabled,
> boot_params.efi_info.efi_loader_signature should be initilized to 0.
> Then below code is also problematic.
>
> #ifdef CONFIG_EFI
>         if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,                                                                         
>                      EFI32_LOADER_SIGNATURE, 4)) {
>                 set_bit(EFI_BOOT, &efi.flags);
>         } else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
>                      EFI64_LOADER_SIGNATURE, 4)) {
>                 set_bit(EFI_BOOT, &efi.flags);
>                 set_bit(EFI_64BIT, &efi.flags);
>         }
> 
>         if (efi_enabled(EFI_BOOT))
>                 efi_memblock_x86_reserve_range();
> #endif

Indeed. Matt?

Thanks,

	tglx

[toc] | [prev] | [next] | [standalone]

#1681060 — Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromMatt Fleming <matt@codeblueprint.co.uk>
Date2017-07-04 17:40 +0200
SubjectRe: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZy5I-1N0-21@gated-at.bofh.it>
In reply to#1681026
On Tue, 04 Jul, at 04:46:58PM, Thomas Gleixner wrote:
> On Tue, 4 Jul 2017, Baoquan He wrote:
>  
> > In fact I just referred to code in setup_arch(). Now I have a question,
> > though CONFIG_EFI=y but efi firmware is not enabled,
> > boot_params.efi_info.efi_loader_signature should be initilized to 0.
> > Then below code is also problematic.
> >
> > #ifdef CONFIG_EFI
> >         if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,                                                                         
> >                      EFI32_LOADER_SIGNATURE, 4)) {
> >                 set_bit(EFI_BOOT, &efi.flags);
> >         } else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
> >                      EFI64_LOADER_SIGNATURE, 4)) {
> >                 set_bit(EFI_BOOT, &efi.flags);
> >                 set_bit(EFI_64BIT, &efi.flags);
> >         }
> > 
> >         if (efi_enabled(EFI_BOOT))
> >                 efi_memblock_x86_reserve_range();
> > #endif
> 
> Indeed. Matt?

It's possibly that I'm missing some context, but boot_params should be
zero'd -- the x86 boot protocol requires that the entire data
structure be zero'd on allocation.

Have I missed something?

[toc] | [prev] | [next] | [standalone]

#1681065 — Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromThomas Gleixner <tglx@linutronix.de>
Date2017-07-04 17:50 +0200
SubjectRe: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZyfo-1QF-17@gated-at.bofh.it>
In reply to#1681060
On Tue, 4 Jul 2017, Matt Fleming wrote:
> On Tue, 04 Jul, at 04:46:58PM, Thomas Gleixner wrote:
> > On Tue, 4 Jul 2017, Baoquan He wrote:
> >  
> > > In fact I just referred to code in setup_arch(). Now I have a question,
> > > though CONFIG_EFI=y but efi firmware is not enabled,
> > > boot_params.efi_info.efi_loader_signature should be initilized to 0.
> > > Then below code is also problematic.
> > >
> > > #ifdef CONFIG_EFI
> > >         if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,                                                                         
> > >                      EFI32_LOADER_SIGNATURE, 4)) {
> > >                 set_bit(EFI_BOOT, &efi.flags);
> > >         } else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
> > >                      EFI64_LOADER_SIGNATURE, 4)) {
> > >                 set_bit(EFI_BOOT, &efi.flags);
> > >                 set_bit(EFI_64BIT, &efi.flags);
> > >         }
> > > 
> > >         if (efi_enabled(EFI_BOOT))
> > >                 efi_memblock_x86_reserve_range();
> > > #endif
> > 
> > Indeed. Matt?
> 
> It's possibly that I'm missing some context, but boot_params should be
> zero'd -- the x86 boot protocol requires that the entire data
> structure be zero'd on allocation.
> 
> Have I missed something?

No. I misread the code. The strncmp() operates on
boot_params.efi_info.efi_loader_signature itself, so yes, all is fine.

It's just Baoquans copy and paste wreckage which is busted.

Thanks,

	tglx

[toc] | [prev] | [next] | [standalone]

#1681211 — Re: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

FromBaoquan He <bhe@redhat.com>
Date2017-07-05 01:20 +0200
SubjectRe: [PATCH v2 2/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
Message-ID<tZFgS-6y4-1@gated-at.bofh.it>
In reply to#1681065
On 07/04/17 at 05:46pm, Thomas Gleixner wrote:
> On Tue, 4 Jul 2017, Matt Fleming wrote:
> > On Tue, 04 Jul, at 04:46:58PM, Thomas Gleixner wrote:
> > > On Tue, 4 Jul 2017, Baoquan He wrote:
> > >  
> > > > In fact I just referred to code in setup_arch(). Now I have a question,
> > > > though CONFIG_EFI=y but efi firmware is not enabled,
> > > > boot_params.efi_info.efi_loader_signature should be initilized to 0.
> > > > Then below code is also problematic.
> > > >
> > > > #ifdef CONFIG_EFI
> > > >         if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,                                                                         
> > > >                      EFI32_LOADER_SIGNATURE, 4)) {
> > > >                 set_bit(EFI_BOOT, &efi.flags);
> > > >         } else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
> > > >                      EFI64_LOADER_SIGNATURE, 4)) {
> > > >                 set_bit(EFI_BOOT, &efi.flags);
> > > >                 set_bit(EFI_64BIT, &efi.flags);
> > > >         }
> > > > 
> > > >         if (efi_enabled(EFI_BOOT))
> > > >                 efi_memblock_x86_reserve_range();
> > > > #endif
> > > 
> > > Indeed. Matt?
> > 
> > It's possibly that I'm missing some context, but boot_params should be
> > zero'd -- the x86 boot protocol requires that the entire data
> > structure be zero'd on allocation.
> > 
> > Have I missed something?
> 
> No. I misread the code. The strncmp() operates on
> boot_params.efi_info.efi_loader_signature itself, so yes, all is fine.

Sorry, I must be dizzy at late night of yesterday, just gave wrong
answer when questioned.

> 
> It's just Baoquans copy and paste wreckage which is busted.
> 
> Thanks,
> 
> 	tglx
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web