Re: [PATCH] x86/kaslr: P2PDMA is one of a class of ZONE_DEVICE-KASLR collisions

[Balbir Singh <balbirs@nvidia.com>]

On 11/11/25 10:34, dan.j.williams@intel.com wrote:
> Balbir Singh wrote:
>> On 11/8/25 13:32, Dan Williams wrote:
>>> Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
>>> is too narrow. ZONE_DEVICE, in general, lets any physical address be added
>>> to the direct-map. I.e. not only ACPI hotplug ranges, CXL Memory Windows,
>>> or EFI Specific Purpose Memory, but also any PCI MMIO range for the
>>> CONFIG_DEVICE_PRIVATE and CONFIG_PCI_P2PDMA cases.
>>>
>>> A potential path to recover entropy would be to walk ACPI and determine the
>>> limits for hotplug and PCI MMIO before kernel_randomize_memory(). On
>>> smaller systems that could yield some KASLR address bits. This needs
>>> additional investigation to determine if some limited ACPI table scanning
>>> can happen this early without an open coded solution like
>>> arch/x86/boot/compressed/acpi.c needs to deploy.
>>>
>>> Cc: Balbir Singh <balbirs@nvidia.com>
>>> Cc: Ingo Molnar <mingo@kernel.org>
>>> Cc: Kees Cook <kees@kernel.org>
>>> Cc: Bjorn Helgaas <bhelgaas@google.com>
>>> Cc: Peter Zijlstra <peterz@infradead.org>
>>> Cc: Andy Lutomirski <luto@kernel.org>
>>> Cc: Logan Gunthorpe <logang@deltatee.com>
>>> Cc: Andrew Morton <akpm@linux-foundation.org>
>>> Cc: David Hildenbrand <david@redhat.com>
>>> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
>>> Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
>>> Cc: Vlastimil Babka <vbabka@suse.cz>
>>> Cc: Mike Rapoport <rppt@kernel.org>
>>> Cc: Suren Baghdasaryan <surenb@google.com>
>>> Cc: Michal Hocko <mhocko@suse.com>
>>> Cc: "Yasunori Gotou (Fujitsu)" <y-goto@fujitsu.com>
>>> Fixes: 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
>>> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
>>
>> P2PDMA requires ZONE_DEVICE, Most distros have P2PDMA enabled, you mention
>> smaller devices - are you referring to kernels/distros where P2PDMA is not
>> enabled and only ZONE_DEVICE is?
> 
> There are 2 considerations
> 
> - Occasions where P2PDMA is disabled, but ZONE_DEVICE is enabled.
> 
>   I started looking at this after a report about CXL failures with KASLR.
>   I do not have the kernel configuration for that end user report, but I
>   can only a imagine it was indeed a case of CONFIG_PCI_P2PDMA=n and
>   CONFIG_DEV_DAX_CXL=y
> 
> - Occasions where ZONE_DEVICE and memory hotplug are enabled, but ACPI
>   does not publish any hotplug or CXL memory ranges, and BIOS did not
>   find any large PCI devices at initial scan.
> 
>   In this case even the default 10 TB padding is overkill and more address
>   bits could be consumed for KASLR entropy.

Makes sense!

Reviewed-by: Balbir Singh <balbirs@nvidia.com>