From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 648BAC7EE2A for ; Mon, 8 May 2023 07:31:47 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0199E6B0078; Mon, 8 May 2023 03:31:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EE5546B007D; Mon, 8 May 2023 03:31:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D861F6B007E; Mon, 8 May 2023 03:31:46 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id BFE986B0078 for ; Mon, 8 May 2023 03:31:46 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 98F5F1C7426 for ; Mon, 8 May 2023 07:31:46 +0000 (UTC) X-FDA: 80766268212.18.02BEA4A Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf08.hostedemail.com (Postfix) with ESMTP id B3957160007 for ; Mon, 8 May 2023 07:31:44 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fkTnobG1; spf=pass (imf08.hostedemail.com: domain of ardb@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=ardb@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1683531104; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=RPD3Suyo6KsLvU9zOycpjPvye6DVpLuE/f/1QIDkUA0=; b=a0Q5u6fwNdcAjfh5kpvitSXdX4Lp6qBssixvlB2wIL9cnrmgpn4ykSjDieGUDYtbwuQ/U7 VKMUZVm9fdO52Maas4+321Gi4sMd4/H1uF6OGMurQC2/Eo4IIdNSMITEzg3+7KeXkTTpWq iXtJ1Giys1sbjs/mXuJdyi5q09ibZt0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1683531104; a=rsa-sha256; cv=none; b=CluOcAV0glfmh1uysMv//U3bOocc7B5cqjrF/QI4XM110oqG14UYFsh9VIAf/1VEdBcqmd n6dHRn6ibkMWNmP6KJGQvUeMffJP8FgH1cI8jkHjJWaOM3zbntdw4VgksIqt96oyKEM8Oc NAdZmFxUdNW/t9elReCtHjWuCA+XLIA= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fkTnobG1; spf=pass (imf08.hostedemail.com: domain of ardb@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=ardb@kernel.org; dmarc=pass (policy=none) header.from=kernel.org Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D122961A95 for ; Mon, 8 May 2023 07:31:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42879C433A4 for ; Mon, 8 May 2023 07:31:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1683531103; bh=ta0vub5XjOzQQ417e8iblal3NekaozYwNhO75CzHH1Q=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=fkTnobG1NIDgfxCWkqyfJ67NOlEdMAvnnmypLUc25cyKGnnE1RVsEifJryA5XdyFx WpFLS2sTdc+5BYD920I7gHTmAJ0di8NT1AnJmKTUEY1ADA9vnJrETKi/XW2mkdfxYQ 0M/M8rQ3IpfcmV8P8JSvmkYeGXYTMxxn+9pFp26vz4GDSnP+UH4B0UmK/DjKnh+FV4 rrBRJAh5cSaG3z7yFLSa9WqwqKlmrElIN4GQmwfXr8rd69lEr7sYZnRu0iwA8gRKTS 0hBcHeRHQRV5M24ILkU8zzJJmeZ0gqLiW78mvhwkUT893onJ6cT+hVY+hQk31JeUsY LsNBo6gJmvONg== Received: by mail-lf1-f45.google.com with SMTP id 2adb3069b0e04-4f24ceae142so1190740e87.3 for ; Mon, 08 May 2023 00:31:43 -0700 (PDT) X-Gm-Message-State: AC+VfDwqY2PEd3mkTp1MYcV9iqXNiAtgCotNhqnDM9/Ws9G6E+nTA7MD AQjLWBWZH/X9eNC8vDOD9mVPNV8f4MGLCadIlL8= X-Google-Smtp-Source: ACHHUZ5y7vA1tqWcne6emiRXv9HEK6nUTcGdP8LdbT0ZnVt6cAKzfTkXfRslaz3IMtMcQB05xvbksw36RX5AdY4j0Y4= X-Received: by 2002:ac2:47e5:0:b0:4ef:ec94:9678 with SMTP id b5-20020ac247e5000000b004efec949678mr2695408lfp.20.1683531101267; Mon, 08 May 2023 00:31:41 -0700 (PDT) MIME-Version: 1.0 References: <20230507234618.18067-1-kirill.shutemov@linux.intel.com> <20230507234618.18067-6-kirill.shutemov@linux.intel.com> In-Reply-To: <20230507234618.18067-6-kirill.shutemov@linux.intel.com> From: Ard Biesheuvel Date: Mon, 8 May 2023 09:31:29 +0200 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCHv10 05/11] x86/boot/compressed: Handle unaccepted memory To: "Kirill A. Shutemov" Cc: Borislav Petkov , Andy Lutomirski , Dave Hansen , Sean Christopherson , Andrew Morton , Joerg Roedel , Andi Kleen , Kuppuswamy Sathyanarayanan , David Rientjes , Vlastimil Babka , Tom Lendacky , Thomas Gleixner , Peter Zijlstra , Paolo Bonzini , Ingo Molnar , Dario Faggioli , Mike Rapoport , David Hildenbrand , Mel Gorman , marcelo.cerri@canonical.com, tim.gardner@canonical.com, khalid.elmously@canonical.com, philip.cox@canonical.com, aarcange@redhat.com, peterx@redhat.com, x86@kernel.org, linux-mm@kvack.org, linux-coco@lists.linux.dev, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: pewmoopwqripad5gq7kd43j5fjjfwmis X-Rspamd-Server: rspam03 X-Rspam-User: X-Rspamd-Queue-Id: B3957160007 X-HE-Tag: 1683531104-340166 X-HE-Meta: U2FsdGVkX1+bWWadeFou49CWqXA3PmBPIUwSjxjpn8jJJOMgATJ8GqhOmaSeA4pHEvl1mKXUuTQJl59PXpkPmFUWn3HETrXjcHAU5KBhgf6+1W9bsdB2RFcxlCpeLg84dWNfXauhGacncPTtQa9nwqcEMsxUhsTI8IJEs/LwfzsZC8PUYkf7w9Y/3z6T8UbYEP/Jwvrzgy5miCYpaYAcgsuJH0xqjk25cLQG3zJC0L436C7jBduan1Xq9cLssZ+TZJdJuVVoxJH+ug4jz6NCM8EVkI0QFNFtWMoP6by543k4yKPLEnXV6EOe6k8Bwsa3DBxXw8AN329Oo9hY/7cTr9Q+dkwBf1uy1RMKA5xOnA22Fg/8nU1e5JOue0hVYhv422NOavIlj2CEHziCBHw2kaEF+RSiORh4C7hRolZP4pahca9ss5F3a/uydudMD8nSDZqozRk3IAMXTr54UiepWUCa6RAD0Nw084W1UPFb6hfo5U5fUUnAwcMVJ/lnyBrkZ5bp1dD+JIA9JUnpzjCnLOUezDiYMT8pndg3ANlmHRdL9Z1W5Mnlu4QeK1aB3SE5Ve34kvjDJyL38AQCafUbSvJW3GgQVlC7a13bd8v6sOY2iHGsLFhL39mg8geADYyEGuHn4zlAyZ8pe/WVmQIbfdioQQ+drfmUoDZna+z5yAHsVi1+pDiBH6Oxu0DD1ufhHv5Y6nD20pVzBVsLgNfMdbxdwlwAun34TrQPxC/22lcE3s2qs3/LyiTzT+J7swZK+DSOiXfKoQZiCpyW8mhIfty1sKVO3KFEhABv9rvJXMd4eP7nMZ23f+5ZwUCB0azOeBVuXLVlB29LUSktavLT6mzf1f+tsFeati0Ffui/7JR+qmY4SvJJHJQKKZa5aNVY6CTLoehXHzNiBLjPVo/IuVKqy5NBtmZlPFsRSFtRpg4Tg7FqOqyBSATaNYKkiVTt2aI3cAHdQWKzighpQxj OrybVxyb ToHQLc3S30s58Zgw6STVQhlydbw/smMbbCkZcMpXbX336P9BfRYs7XP4Beog2ww9uMmOa8Tlt5X0HNqTmV3axy4/9wBSNGmCi4L76CrrcI9bvMpgxVzk9R6NWx3wDMCE7QJPfQjysHsVyOI+YQ/b5YnWE/JgiK0DaU3lYnDZ6C53eP8Dy3/o2aVq5j0ZNURa6S119PgGkVw+aG6XPGDRfXaphzWj0zULMTR6gSKBOxY1w0kOUdOPdd8DXcOQNLZ2aZeqyXaQU6P8tLFXK6WVmY+tDSBMfi936La8Xag9thY/1auLsXxAG0/D0l7efSPG0f2ZCNmxlWw5uKgY5F0CWSiwrS0vPY3YOUZLhGw36Ul60pqq/SoyG3rOzCsy6dh3wz0QJsB4m7nBpabbIDHL9K5bLVQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 8 May 2023 at 01:46, Kirill A. Shutemov wrote: > > The firmware will pre-accept the memory used to run the stub. But, the > stub is responsible for accepting the memory into which it decompresses > the main kernel. Accept memory just before decompression starts. > > The stub is also responsible for choosing a physical address in which to > place the decompressed kernel image. The KASLR mechanism will randomize > this physical address. Since the unaccepted memory region is relatively > small, KASLR would be quite ineffective if it only used the pre-accepted > area (EFI_CONVENTIONAL_MEMORY). Ensure that KASLR randomizes among the > entire physical address space by also including EFI_UNACCEPTED_MEMORY. > > Signed-off-by: Kirill A. Shutemov Acked-by: Ard Biesheuvel > --- > arch/x86/boot/compressed/Makefile | 2 +- > arch/x86/boot/compressed/efi.h | 1 + > arch/x86/boot/compressed/kaslr.c | 35 ++++++++++++++++-------- > arch/x86/boot/compressed/mem.c | 18 ++++++++++++ > arch/x86/boot/compressed/misc.c | 6 ++++ > arch/x86/boot/compressed/misc.h | 6 ++++ > arch/x86/include/asm/unaccepted_memory.h | 2 ++ > 7 files changed, 57 insertions(+), 13 deletions(-) > > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > index f62c02348f9a..74f7adee46ad 100644 > --- a/arch/x86/boot/compressed/Makefile > +++ b/arch/x86/boot/compressed/Makefile > @@ -107,7 +107,7 @@ endif > > vmlinux-objs-$(CONFIG_ACPI) += $(obj)/acpi.o > vmlinux-objs-$(CONFIG_INTEL_TDX_GUEST) += $(obj)/tdx.o $(obj)/tdcall.o > -vmlinux-objs-$(CONFIG_UNACCEPTED_MEMORY) += $(obj)/bitmap.o $(obj)/mem.o > +vmlinux-objs-$(CONFIG_UNACCEPTED_MEMORY) += $(obj)/bitmap.o $(obj)/find.o $(obj)/mem.o > > vmlinux-objs-$(CONFIG_EFI) += $(obj)/efi.o > vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_mixed.o > diff --git a/arch/x86/boot/compressed/efi.h b/arch/x86/boot/compressed/efi.h > index 7db2f41b54cd..cf475243b6d5 100644 > --- a/arch/x86/boot/compressed/efi.h > +++ b/arch/x86/boot/compressed/efi.h > @@ -32,6 +32,7 @@ typedef struct { > } efi_table_hdr_t; > > #define EFI_CONVENTIONAL_MEMORY 7 > +#define EFI_UNACCEPTED_MEMORY 15 > > #define EFI_MEMORY_MORE_RELIABLE \ > ((u64)0x0000000000010000ULL) /* higher reliability */ > diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c > index 454757fbdfe5..749f0fe7e446 100644 > --- a/arch/x86/boot/compressed/kaslr.c > +++ b/arch/x86/boot/compressed/kaslr.c > @@ -672,6 +672,28 @@ static bool process_mem_region(struct mem_vector *region, > } > > #ifdef CONFIG_EFI > + > +/* > + * Only EFI_CONVENTIONAL_MEMORY and EFI_UNACCEPTED_MEMORY (if supported) are > + * guaranteed to be free. > + * > + * It is more conservative in picking free memory than the EFI spec allows: > + * > + * According to the spec, EFI_BOOT_SERVICES_{CODE|DATA} are also free memory > + * and thus available to place the kernel image into, but in practice there's > + * firmware where using that memory leads to crashes. > + */ > +static inline bool memory_type_is_free(efi_memory_desc_t *md) > +{ > + if (md->type == EFI_CONVENTIONAL_MEMORY) > + return true; > + > + if (md->type == EFI_UNACCEPTED_MEMORY) > + return IS_ENABLED(CONFIG_UNACCEPTED_MEMORY); > + > + return false; > +} > + > /* > * Returns true if we processed the EFI memmap, which we prefer over the E820 > * table if it is available. > @@ -716,18 +738,7 @@ process_efi_entries(unsigned long minimum, unsigned long image_size) > for (i = 0; i < nr_desc; i++) { > md = efi_early_memdesc_ptr(pmap, e->efi_memdesc_size, i); > > - /* > - * Here we are more conservative in picking free memory than > - * the EFI spec allows: > - * > - * According to the spec, EFI_BOOT_SERVICES_{CODE|DATA} are also > - * free memory and thus available to place the kernel image into, > - * but in practice there's firmware where using that memory leads > - * to crashes. > - * > - * Only EFI_CONVENTIONAL_MEMORY is guaranteed to be free. > - */ > - if (md->type != EFI_CONVENTIONAL_MEMORY) > + if (!memory_type_is_free(md)) > continue; > > if (efi_soft_reserve_enabled() && > diff --git a/arch/x86/boot/compressed/mem.c b/arch/x86/boot/compressed/mem.c > index 6b15a0ed8b54..de858a5180b6 100644 > --- a/arch/x86/boot/compressed/mem.c > +++ b/arch/x86/boot/compressed/mem.c > @@ -3,12 +3,15 @@ > #include "../cpuflags.h" > #include "bitmap.h" > #include "error.h" > +#include "find.h" > #include "math.h" > > #define PMD_SHIFT 21 > #define PMD_SIZE (_AC(1, UL) << PMD_SHIFT) > #define PMD_MASK (~(PMD_SIZE - 1)) > > +extern struct boot_params *boot_params; > + > static inline void __accept_memory(phys_addr_t start, phys_addr_t end) > { > /* Platform-specific memory-acceptance call goes here */ > @@ -71,3 +74,18 @@ void process_unaccepted_memory(struct boot_params *params, u64 start, u64 end) > bitmap_set((unsigned long *)params->unaccepted_memory, > start / PMD_SIZE, (end - start) / PMD_SIZE); > } > + > +void accept_memory(phys_addr_t start, phys_addr_t end) > +{ > + unsigned long range_start, range_end; > + unsigned long *bitmap, bitmap_size; > + > + bitmap = (unsigned long *)boot_params->unaccepted_memory; > + range_start = start / PMD_SIZE; > + bitmap_size = DIV_ROUND_UP(end, PMD_SIZE); > + > + for_each_set_bitrange_from(range_start, range_end, bitmap, bitmap_size) { > + __accept_memory(range_start * PMD_SIZE, range_end * PMD_SIZE); > + bitmap_clear(bitmap, range_start, range_end - range_start); > + } > +} > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c > index 014ff222bf4b..186bfd53e042 100644 > --- a/arch/x86/boot/compressed/misc.c > +++ b/arch/x86/boot/compressed/misc.c > @@ -455,6 +455,12 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap, > #endif > > debug_putstr("\nDecompressing Linux... "); > + > + if (boot_params->unaccepted_memory) { > + debug_putstr("Accepting memory... "); > + accept_memory(__pa(output), __pa(output) + needed_size); > + } > + > __decompress(input_data, input_len, NULL, NULL, output, output_len, > NULL, error); > entry_offset = parse_elf(output); > diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h > index 2f155a0e3041..9663d1839f54 100644 > --- a/arch/x86/boot/compressed/misc.h > +++ b/arch/x86/boot/compressed/misc.h > @@ -247,4 +247,10 @@ static inline unsigned long efi_find_vendor_table(struct boot_params *bp, > } > #endif /* CONFIG_EFI */ > > +#ifdef CONFIG_UNACCEPTED_MEMORY > +void accept_memory(phys_addr_t start, phys_addr_t end); > +#else > +static inline void accept_memory(phys_addr_t start, phys_addr_t end) {} > +#endif > + > #endif /* BOOT_COMPRESSED_MISC_H */ > diff --git a/arch/x86/include/asm/unaccepted_memory.h b/arch/x86/include/asm/unaccepted_memory.h > index df0736d32858..41fbfc798100 100644 > --- a/arch/x86/include/asm/unaccepted_memory.h > +++ b/arch/x86/include/asm/unaccepted_memory.h > @@ -7,4 +7,6 @@ struct boot_params; > > void process_unaccepted_memory(struct boot_params *params, u64 start, u64 num); > > +void accept_memory(phys_addr_t start, phys_addr_t end); > + > #endif > -- > 2.39.3 >