lkml.org 
[lkml]   [2017]   [Jul]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v2 0/2] x86/boot/KASLR: Restrict kernel to be randomized in mirror regions
    Date
    Our customer reported that Kernel text may be located on non-mirror
    region (movable zone) when both address range mirroring feature and
    KASLR are enabled.

    The functions of address range mirroring feature are as follows.
    - The physical memory region whose descriptors in EFI memory map have
    EFI_MEMORY_MORE_RELIABLE attribute (bit: 16) are mirrored
    - The function arranges such mirror region into normal zone and other region
    into movable zone in order to locate kernel code and data on mirror region

    So we need restrict kernel to be located inside mirror regions if it
    is existed.

    The method is very simple. If efi is enabled, just iterate all efi
    memory map and pick mirror region to process for adding candidate
    of slot. If efi disabled or no mirror region existed, still process
    e820 memory map. This won't bring much efficiency loss, at worst we
    just go through all efi memory maps and found no mirror.

    v1->v2:
    Removed debug code.

    Taku suggested that we should put kernel to mirrored region always
    whether or not "kernelcore=mirror" is specified since kernel text is
    important and mirrored region is reliable.

    Change code according to kbuild report and Chao Fan's comment.

    Test:
    Chao has tested the v1 (RFC patchset) 100 times. And he said in the 100
    times, 50 times are with this patchset applied, 50 times are without it.
    The test result showed the v1 patchset works very well.

    Baoquan He (2):
    x86/boot/KASLR: Adapt process_e820_entry for any type of memory entry
    x86/boot/KASLR: Restrict kernel to be randomized in mirror regions

    arch/x86/boot/compressed/kaslr.c | 108 +++++++++++++++++++++++++++++----------
    1 file changed, 82 insertions(+), 26 deletions(-)

    --
    2.5.5

    \
     
     \ /
      Last update: 2017-07-04 10:05    [W:3.225 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site