From patchwork Tue Mar 14 10:13:43 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Evgeniy Baskov X-Patchwork-Id: 69461 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1677674wrd; Tue, 14 Mar 2023 03:36:36 -0700 (PDT) X-Google-Smtp-Source: AK7set+faFZz0vPhLWzILgeMIkBnSQSbDMQvMQOYiKadEi02p4IosMIeVKgssMXkKeVzDrB9XVLZ X-Received: by 2002:aa7:9622:0:b0:622:c601:c0e6 with SMTP id r2-20020aa79622000000b00622c601c0e6mr7257682pfg.16.1678790196507; Tue, 14 Mar 2023 03:36:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1678790196; cv=none; d=google.com; s=arc-20160816; b=yLUud50FCBEs2Q9qNuD4D8i93Su6IfW+x0NglkDtI1PUSk7Ki/TjkgqFhiQPRbHHsQ 6+XzrZ7G39rub7W9553H09aXE56YsbLPpJp5+dTBDBgCG9+kLv3dE01eScqlFHnJ4qEj hd5a6gMueqaZ0+hNurqTUbcxztHSmM67p/ssc52oRqr9sIz2+P55GIvT+3u1HKBr94fg DXtg7uAFiec2g0f29nLcA8j8ClBwLxXXLONx3qRDyzT2R5Fctl0/CLyOTCToW1Y3RIRC sCM3w2qkwXpVeftM0aKx2nDi63BIQcv/zLUzrpLx15J36vZ60P+zlrAfkcJGTwiVEK8e ot8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature:dkim-filter; bh=TGo4XV8+4rYhPXDaghQExWmkbcLCrUD/7A+lIMbYivo=; b=w0ODKv3ZBMjPGxOtJBEZVZTp1bxOjdwHM/n86KG/VWAgAc/gD30zwgu7J9TfYMsPbE tx3ZcYHYNQaTQvhTeb6751du8/sfMKKA0aJ0nFMGQXrZ/VM69ocBkxcwpp6GKj/cxbSg 9DBbyrjoGHRNPv9DtktDF6HeaoUBYq1pVWEwDfT9K7qFttNA5uvnSMaYBL8aRedxSrsd cgYrwKgd8h9q2KSLnBVpMThf9cfP4OxI3z4xIBHuKOLYmj2F9ULC30OtbknMiwKGMN29 SNoVf33PldFvR+WwO8oh2ZRv7/fdDvWvdb2gCbj5HYmOxRxguy7qpOP+6j1DcuKkoH1U QAoQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=DinlFVoZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t190-20020a625fc7000000b005a8d7971a99si1982055pfb.97.2023.03.14.03.36.24; Tue, 14 Mar 2023 03:36:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=DinlFVoZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229842AbjCNKUX (ORCPT + 99 others); Tue, 14 Mar 2023 06:20:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230035AbjCNKTp (ORCPT ); Tue, 14 Mar 2023 06:19:45 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D03747B98A; Tue, 14 Mar 2023 03:19:11 -0700 (PDT) Received: from localhost.localdomain (unknown [83.149.199.65]) by mail.ispras.ru (Postfix) with ESMTPSA id 09D0C4076B51; Tue, 14 Mar 2023 10:18:04 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 09D0C4076B51 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1678789084; bh=TGo4XV8+4rYhPXDaghQExWmkbcLCrUD/7A+lIMbYivo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DinlFVoZPtOfiUrfZLz2HeYSH7RAVDDFhltsS7dtCieoqHQpcphDbfmqFesJNJgVw 8ycZ7pWdCvXpHhrWXRLbfAmXx67RPiTByKTod9FpOFjD2eenBKyGUdBjhKr2xTiGX7 528XoSo853o76fvBIgzLR8VDp6Nd6A7swa/y8yGA= From: Evgeniy Baskov To: Ard Biesheuvel Cc: Evgeniy Baskov , Borislav Petkov , Andy Lutomirski , Dave Hansen , Ingo Molnar , Peter Zijlstra , Thomas Gleixner , Alexey Khoroshilov , Peter Jones , Gerd Hoffmann , "Limonciello, Mario" , joeyli , lvc-project@linuxtesting.org, x86@kernel.org, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v5 16/27] x86/boot: Reduce lower limit of physical KASLR Date: Tue, 14 Mar 2023 13:13:43 +0300 Message-Id: <5a05045877c25c9ed08287e3ed829332de0ac667.1678785672.git.baskov@ispras.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1760339108835922405?= X-GMAIL-MSGID: =?utf-8?q?1760339108835922405?= Set lower limit of physical KASLR to 64M. Previously is was set to 512M when kernel is loaded higher than that. That prevented physical KASLR from being performed on x86_32, where upper limit is also set to 512M. The limit is pretty arbitrary, and the most important is to set it above the ISA hole, i.e. higher than 16M. It was not that important before, but now kernel is not getting relocated to the lower address when booting via EFI, exposing the KASLR failures. Tested-by: Mario Limonciello Signed-off-by: Evgeniy Baskov --- arch/x86/boot/compressed/kaslr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c index 69966481b82d..806df3912396 100644 --- a/arch/x86/boot/compressed/kaslr.c +++ b/arch/x86/boot/compressed/kaslr.c @@ -850,10 +850,10 @@ void choose_random_location(unsigned long input, /* * Low end of the randomization range should be the - * smaller of 512M or the initial kernel image + * smaller of 64M or the initial kernel image * location: */ - min_addr = min(*output, 512UL << 20); + min_addr = min(*output, 64UL << 20); /* Make sure minimum is aligned. */ min_addr = ALIGN(min_addr, CONFIG_PHYSICAL_ALIGN);