From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752436AbdFOIDf (ORCPT ); Thu, 15 Jun 2017 04:03:35 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49366 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751979AbdFOIDe (ORCPT ); Thu, 15 Jun 2017 04:03:34 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 72E0B3D94E Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=bhe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 72E0B3D94E Date: Thu, 15 Jun 2017 16:03:29 +0800 From: Baoquan He To: linux-kernel@vger.kernel.org, izumi.taku@jp.fujitsu.com Cc: keescook@chromium.org, x86@kernel.org, fanc.fnst@cn.fujitsu.com, caoj.fnst@cn.fujitsu.com, douly.fnst@cn.fujitsu.com Subject: Re: [RFC][PATCH 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if existed Message-ID: <20170615080329.GB16181@x1> References: <1497513169-25283-1-git-send-email-bhe@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1497513169-25283-1-git-send-email-bhe@redhat.com> User-Agent: Mutt/1.7.0 (2016-08-17) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 15 Jun 2017 08:03:33 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Sorry, forget adding Taku to the list. Hi Taku, On 06/15/17 at 03:52pm, Baoquan He wrote: > Our customer reported that Kernel text may be located on non-mirror > region (movable zone) when both address range mirroring feature and > KASLR are enabled. > > The functions of address range mirroring feature are as follows. > - The physical memory region whose descriptors in EFI memory map have > EFI_MEMORY_MORE_RELIABLE attribute (bit: 16) are mirrored > - The function arranges such mirror region into normal zone and other region > into movable zone in order to locate kernel code and data on mirror region > > So we need restrict kernel to be located inside mirror region if it > is existed. > > The method is very simple. If efi is enabled, just iterate all efi > memory map and pick up mirror region to process for adding candidate > of slot. If efi disabled or no mirror region existed, still process > e820 memory map. This won't bring much efficiency loss, at worst we > just go through all efi memory maps and found no mirror. > > One question: > From code, though mirror regions are existed, they are meaningful only > if kernelcore=mirror kernel option is specified. Not sure if my understanding > is correct. Since you are the author of kernelcore=mirror related code and expert on mirror feature, could you help answer above question? Thanks Baoquan > > NOTE: > I haven't got a machine with efi mirror region enabled, so only test the > e820 map processing case and the case of no mirror region on efi machine. > So set this as a RFC patchset, will post formal one after above question > is made clear and mirror issue test passed. > > Baoquan He (2): > x86/boot/KASLR: Adapt process_e820_entry for all kinds of memory map > x86/boot/KASLR: Restrict kernel to be randomized in mirror regions if > existed > > arch/x86/boot/compressed/kaslr.c | 129 +++++++++++++++++++++++++++++++-------- > 1 file changed, 104 insertions(+), 25 deletions(-) > > -- > 2.5.5 >