From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6341BC3ABC3 for ; Fri, 9 May 2025 07:47:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6269D6B00A6; Fri, 9 May 2025 03:47:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E2AF76B00D2; Fri, 9 May 2025 03:47:22 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B1E346B00D1; Fri, 9 May 2025 03:47:22 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 1651D6B00A8 for ; Fri, 9 May 2025 03:47:21 -0400 (EDT) Received: from smtpin20.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 172441A1290 for ; Fri, 9 May 2025 07:47:21 +0000 (UTC) X-FDA: 83422589124.20.BBDAF36 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) by imf26.hostedemail.com (Postfix) with ESMTP id 40C9A140004 for ; Fri, 9 May 2025 07:47:20 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=4SWTh4Cb; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf26.hostedemail.com: domain of 3B7MdaAoKCCwKPIVOgcIVTOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--changyuanl.bounces.google.com designates 209.85.214.201 as permitted sender) smtp.mailfrom=3B7MdaAoKCCwKPIVOgcIVTOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--changyuanl.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1746776840; a=rsa-sha256; cv=none; b=XIwAAlsfOoQnZCKFPKVdfi8mklnm7/JSYpAZsPLSoeP2OGVU+RY6cDoiLa6BEhb4D5AInR Fi9NpHvjx9NbGKb6TTcSkDM4t+luUaVZ1LXdYi29SShxQZw0jkDYnokulpGNtGJVbTpO6P 9LArq+HH/diPToMOXm7AD0r91FrZciA= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=4SWTh4Cb; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf26.hostedemail.com: domain of 3B7MdaAoKCCwKPIVOgcIVTOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--changyuanl.bounces.google.com designates 209.85.214.201 as permitted sender) smtp.mailfrom=3B7MdaAoKCCwKPIVOgcIVTOWWOTM.KWUTQVcf-UUSdIKS.WZO@flex--changyuanl.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1746776840; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=/uG6GiCi+k4QeVIeYPGdrcHOaMWapGzdHMs1nMnrsrc=; b=AmuiQE78eWPriAQP1pDf8OlMzcAbW6JbSi9GDwzLZxQ5Bdz53oi19Sz9Fqm8sWnza5JFwQ x4hjLlVcmB4WQdUhMfh72359MCC2nDWM25XmYf0rGqGiVjVzgph75xXSq/A5dhejuQf01e eW/QGEgYEeBr7Xw/9oAPJDUymvCRt2c= Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-22e50d4f49bso24421025ad.1 for ; Fri, 09 May 2025 00:47:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1746776839; x=1747381639; darn=kvack.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=/uG6GiCi+k4QeVIeYPGdrcHOaMWapGzdHMs1nMnrsrc=; b=4SWTh4CbVyFaPY+Wo4GCfm2u4rnjSa2GjXopsGTu20Gvz2HmL2R7W9zX3ZSCdHfnA8 3Buh7S59XfPUcLSa+jqNV/w2MEemNWjW8aaaAwMiy2ub83EBwshrsy7+q+Vu5PooCcfW KVUcdQ8v8K6OZ2E1N4/kI418c9FJaeZAg7IrPk3a7DyeBmX6YkTf40ITC/Lvdf/49uZ/ FPIu8qI7aDuMURUvrFWWMonRKmT4aQ/xg2HzUGMQApr+59qRbtZQG7fodeg3J/zn4+Cn 1z+tlWKuOpNojmHGYmvN3xJaGRCbUvPJX0Lle4maHVOkWS7TNiGTfGkMXrK+It22MyAu Xnbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746776839; x=1747381639; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/uG6GiCi+k4QeVIeYPGdrcHOaMWapGzdHMs1nMnrsrc=; b=Pa7tQYoMXueBx+rZ3WGPKK6ah9VHb+2Vb7hhQRvschkvy0FSb6LcODcEifiKO9MVnJ 1iZuWqVzX9P67kHmxzPhMTchKtQ8xx8t2AysUYSRfbfRSVQoT7/2R/hd0v1Ia1Gu85FT O/QZDFWi1N6C/KyCyIksq/vUC4BqDDuDRuSxHaai1m/4ym5zFZ97aY1yVNrT9dIdeMjW CBpoulCH5gKMHzScz/M8wmK1n2qvCeswbYmAAPNGnxFLGyW30zTWu0lcWAHzPFcKp6f3 vxJJzN+4XcbaWq2Z1U97ScPEzX4eSf3Y5OjLj8IvtX5Tuk34br/x1hhiE5xe6iodY9A8 A1zg== X-Forwarded-Encrypted: i=1; AJvYcCW5uehp4K2532CtfJKkpx+ofpIyEIvi1EvTWSpGIjCw/AysU7Qpmq6zpms0i3wlxnTn9k0Ya2T1jg==@kvack.org X-Gm-Message-State: AOJu0Yxk6IdXLMbdORF7wh4lfboruUt67AhP09DE4/hKCaLVnZmxLnjU kOpaZX51z4+5HNjspRvG71yNC5YC3dnEeTSk3byzKDEWos6shFDBIoGjzdMfqcUMHzosOESAinI cA0C8p/T5bKk+dHjMBQ== X-Google-Smtp-Source: AGHT+IEtYvgMQD/fc6wFPgnt6KgYb8JeNInbNpZgGejD3McBZNxXkmne49Y8Hn9OW1r//Ao+vz75n4rLQVAMCRw5 X-Received: from plnr4.prod.google.com ([2002:a17:903:1904:b0:22e:4a61:5545]) (user=changyuanl job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:3ba7:b0:224:c76:5e57 with SMTP id d9443c01a7336-22fc8e99d3fmr26734465ad.39.1746776839015; Fri, 09 May 2025 00:47:19 -0700 (PDT) Date: Fri, 9 May 2025 00:46:31 -0700 In-Reply-To: <20250509074635.3187114-1-changyuanl@google.com> Mime-Version: 1.0 References: <20250509074635.3187114-1-changyuanl@google.com> X-Mailer: git-send-email 2.49.0.1015.ga840276032-goog Message-ID: <20250509074635.3187114-14-changyuanl@google.com> Subject: [PATCH v8 13/17] x86/boot: make sure KASLR does not step over KHO preserved memory From: Changyuan Lyu To: akpm@linux-foundation.org, linux-kernel@vger.kernel.org Cc: anthony.yznaga@oracle.com, arnd@arndb.de, ashish.kalra@amd.com, benh@kernel.crashing.org, bp@alien8.de, catalin.marinas@arm.com, corbet@lwn.net, dave.hansen@linux.intel.com, devicetree@vger.kernel.org, dwmw2@infradead.org, ebiederm@xmission.com, graf@amazon.com, hpa@zytor.com, jgowans@amazon.com, kexec@lists.infradead.org, krzk@kernel.org, linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, luto@kernel.org, mark.rutland@arm.com, mingo@redhat.com, pasha.tatashin@soleen.com, pbonzini@redhat.com, peterz@infradead.org, ptyadav@amazon.de, robh@kernel.org, rostedt@goodmis.org, rppt@kernel.org, saravanak@google.com, skinsburskii@linux.microsoft.com, tglx@linutronix.de, thomas.lendacky@amd.com, will@kernel.org, x86@kernel.org, Changyuan Lyu Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 40C9A140004 X-Stat-Signature: sdoe5dhebeh5noh798tekez6gg8k4akg X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1746776840-434728 X-HE-Meta: U2FsdGVkX1/j8qDEILQCMVaIbVJehcaUvfcg/ukJkypEnlIMNjhQYF1KVrolwLt1J3tiF3leTiQC92tlEnCXq6fg2rXo6b17bDRX/pvGs0Cb1r2VY31QKtsgUjfav/IukwdMjM1uUS8KHkRwB9SsqRLuRr49cs2rwtAMOK/V9JZ1NI4nNT6Zl1HCgQ/jVAo6W8Vw4ru1EDfjZKKqzoNEDr40l90Nxa99NW2jMLBPD/S3f6X5ObJqygmhIH27oYuiGc+HEjHQeH4/vE1vi6nioI76AtJBjz3TlVTmx9Nh2jNxcZZHv/HDydG0TrBemPTNspMDs6ltNuGq+b16FOjGMDYrpqhv2PFGlVvMleyeDbxewU2N6fPVcOWQd7eChE0Og0qFKBzzCMISUAwwoUOi7zzOiSY2LOyzfSRn30KeMnDLVY5+N/bNuBvVQRl6pSppFso5aLIhQpotSvT09eVFkK2ofpqRwkBjUbaaIiIVg3ro5wr7qBFaYamYYfJRiqhV/GGAITTwGBCeu/a5MpM+5v2vlpOJ8C+ouzc2eljoGPRKwqzY7G4JB9o5tV9wIwc3XrtYZAeFRflxIbgX1Rms6iUaKL/IoTvAtluiLvUr54EU7UpfDKWauDMWA1O1rRBEXrXzkuYhGpMqT+7PPx8uGAPWNfHnn43l9TgpFuCO3qxIc4PcsD/7H2C0RQr1AoCMTirShwugaO81p0ilUXmEYubXO+PdagKA9LoYUA8M4d6I91EgBANk2N6mmeHOJdAhzlwflYhjPCJS+o6xRFDBB6XtP2FVdDyCR3x/WWcwcRnIlHvgyRrEEbcO/jyGVHCZLu0bo4JSZXWF3JjCW9JWZI3GBiOZxvG0RX21rJ+wjhdAoviKDBIwQ3wVE2UWkwlLRdj2RTQnUbsZQQyHuztK3d84HZVpk3eFU8HTZkUp29rYYvWZm903DqGt1o8tI0IOJdxTUPYwl39gjrBFeRT L7HJkpSB CpoPM2+WsACpLzVlhZk8ol4TsSDO64CBSVtA7XeHdCD4+EfnVnHNJNHQ0t4qmHKcXw5+etRyGN6SyuvLzmcGwgKaYgmjielPdEB/oIGPRaLvpaa0ruD46bM1+05c5UvoTni9L6ikQ2vkrS/pDY6reXdgmDFFLrS80huLsMktsKOX65neDqHKPhYJJy4ox2HY6RQtydWzNmG4RN3oLljXYSl444B6iDcf1om2YNKt+U8PmYWAcg1KRm6ATN92Dh3VqcGjRAz7VWRIZUGmw/dikL6BYX1jFqgnYyROW X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Alexander Graf During kexec handover (KHO) memory contains data that should be preserved and this data would be consumed by kexec'ed kernel. To make sure that the preserved memory is not overwritten, KHO uses "scratch regions" to bootstrap kexec'ed kernel. These regions are guaranteed to not have any memory that KHO would preserve and are used as the only memory the kernel sees during the early boot. The scratch regions are passed in the setup_data by the first kernel with other KHO parameters. If the setup_data contains the KHO parameters, limit randomization to scratch areas only to make sure preserved memory won't get overwritten. Since all the pointers in setup_data are represented by u64, they require double casting (first to unsigned long and then to the actual pointer type) to compile on 32-bits. This looks goofy out of context, but it is unfortunately the way that this is handled across the tree. There are at least a dozen instances of casting like this. Signed-off-by: Alexander Graf Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Mike Rapoport (Microsoft) Co-developed-by: Changyuan Lyu Signed-off-by: Changyuan Lyu --- arch/x86/boot/compressed/kaslr.c | 50 +++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c index f03d59ea6e40f..3b0948ad449f9 100644 --- a/arch/x86/boot/compressed/kaslr.c +++ b/arch/x86/boot/compressed/kaslr.c @@ -760,6 +760,49 @@ static void process_e820_entries(unsigned long minimum, } } +/* + * If KHO is active, only process its scratch areas to ensure we are not + * stepping onto preserved memory. + */ +static bool process_kho_entries(unsigned long minimum, unsigned long image_size) +{ + struct kho_scratch *kho_scratch; + struct setup_data *ptr; + struct kho_data *kho; + int i, nr_areas = 0; + + if (!IS_ENABLED(CONFIG_KEXEC_HANDOVER)) + return false; + + ptr = (struct setup_data *)(unsigned long)boot_params_ptr->hdr.setup_data; + while (ptr) { + if (ptr->type == SETUP_KEXEC_KHO) { + kho = (struct kho_data *)(unsigned long)ptr->data; + kho_scratch = (void *)(unsigned long)kho->scratch_addr; + nr_areas = kho->scratch_size / sizeof(*kho_scratch); + break; + } + + ptr = (struct setup_data *)(unsigned long)ptr->next; + } + + if (!nr_areas) + return false; + + for (i = 0; i < nr_areas; i++) { + struct kho_scratch *area = &kho_scratch[i]; + struct mem_vector region = { + .start = area->addr, + .size = area->size, + }; + + if (process_mem_region(®ion, minimum, image_size)) + break; + } + + return true; +} + static unsigned long find_random_phys_addr(unsigned long minimum, unsigned long image_size) { @@ -775,7 +818,12 @@ static unsigned long find_random_phys_addr(unsigned long minimum, return 0; } - if (!process_efi_entries(minimum, image_size)) + /* + * During kexec handover only process KHO scratch areas that are known + * not to contain any data that must be preserved. + */ + if (!process_kho_entries(minimum, image_size) && + !process_efi_entries(minimum, image_size)) process_e820_entries(minimum, image_size); phys_addr = slots_fetch_random(); -- 2.49.0.1015.ga840276032-goog