From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81846C4332F for ; Mon, 23 May 2022 01:18:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id F2F476B0005; Sun, 22 May 2022 21:18:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EB77A6B0006; Sun, 22 May 2022 21:18:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D7E876B0007; Sun, 22 May 2022 21:18:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id C31EF6B0005 for ; Sun, 22 May 2022 21:18:44 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 8BEE320DB4 for ; Mon, 23 May 2022 01:18:44 +0000 (UTC) X-FDA: 79495248168.23.29C0CDF Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by imf26.hostedemail.com (Postfix) with ESMTP id E0B1B140012 for ; Mon, 23 May 2022 01:18:39 +0000 (UTC) Received: from dggpemm500022.china.huawei.com (unknown [172.30.72.56]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4L5zvX1KQDz1JC5q; Mon, 23 May 2022 09:17:12 +0800 (CST) Received: from dggpemm500014.china.huawei.com (7.185.36.153) by dggpemm500022.china.huawei.com (7.185.36.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 23 May 2022 09:18:39 +0800 Received: from [10.174.178.120] (10.174.178.120) by dggpemm500014.china.huawei.com (7.185.36.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 23 May 2022 09:18:37 +0800 Message-ID: <7a1ce182-343a-75f9-5447-f7ca12cb0c36@huawei.com> Date: Mon, 23 May 2022 09:18:37 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.8.0 Subject: Re: [PATCH 0/2] Add support to relocate kernel image to mirrored region To: CC: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , References: <20220419070150.254377-1-mawupeng1@huawei.com> <7058b8d8-c0cb-108e-0db9-2fdf5fb154cf@huawei.com> From: mawupeng In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [10.174.178.120] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm500014.china.huawei.com (7.185.36.153) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: E0B1B140012 X-Stat-Signature: ien6od6nsregt4d7adfsisgysakub1b3 X-Rspam-User: Authentication-Results: imf26.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf26.hostedemail.com: domain of mawupeng1@huawei.com designates 45.249.212.255 as permitted sender) smtp.mailfrom=mawupeng1@huawei.com X-HE-Tag: 1653268719-947794 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: 在 2022/5/20 14:52, Ard Biesheuvel 写道: > On Thu, 19 May 2022 at 13:09, mawupeng wrote: >> >> >> >> 在 2022/5/7 17:28, mawupeng 写道: >>> >>> >>> 在 2022/5/3 17:58, Ard Biesheuvel 写道: >>>> On Tue, 19 Apr 2022 at 08:43, Wupeng Ma wrote: >>>>> >>>>> From: Ma Wupeng >>>>> >>>>> Now system image will perfer to be located to mirrored regions both KASLR >>>>> on and off. >>>>> >>>> >>>> Hello Ma Wupeng, >>>> >>>> I wonder if we could simplify this as follows: >>>> - ignore the non-KASLR case for now, and rely on the bootloader > load the image into mirrored memory if it exists; >>> >>> In grub, memory for static image is allocated via the following path: >>> >>> grub_cmd_linux >>> kernel = grub_malloc(filelen) >>> kernel_alloc_addr = grub_efi_allocate_any_pages (kernel_alloc_pages) >>> grub_memcpy (kernel_addr, kernel, grub_min(filelen, kernel_size)) >>> grub_loader_set (grub_linux_boot, grub_linux_unload, 0) >>> >>> Can we get memory from mirrored region by the following steps: >>> 1. get memory map by calling grub_efi_get_memory_map() >>> 2. iter all memory map to find a suitable mirrored memory area >>> 3. locate kernel image to this area >>> >>> So, if kaslr is not enabled >>> - grub will load kernel into mirrored region >>> else >>> - arm64-stub.c will relocate kernel image to mirrored region >>> >>> Is this feasible? >> >> Is this a feasible proposal to relocate the static kernel image itself >> into more reliable memory? >> > > I'm not sure, it all depends on the firmware. > > When GRUB calls LoadImage(), the firmware will reallocate the image > and unpack it there. So it is really the firmware's job to ensure that > the image is loaded into a suitable location. > > I have some code here that implements a EFI based decompressor, and > which loads the kernel image into mirrored memory if it exists, > without the need to move it again. It could trivially be modified to > deal with non-randomized loads as well. > > But the bottom line is that UEFI should expose the ability to target > mirrored memory, hacking around it like this is not a sustainable > approach. Since firmware is responsible for put kernel static image into mirrored region and kernel is responsible for relocate this image into mirrored region if kaslr is enabled. There is no conflict between these two. Can we integrate the kernel part(introduce mirrored support to arm64) first? > .