Commit 269031b1 authored by Dan Williams's avatar Dan Williams Committed by Dave Jiang
Browse files

x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers 



Commit 7ffb7914 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
is too narrow. The effect being mitigated in that commit is caused by
ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general,
lets any physical address be added to the direct-map. I.e. not only ACPI
hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but
also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update
the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases.

Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of
this problem is limited to the PCI_P2PDMA=n case.

A potential path to recover entropy would be to walk ACPI and determine the
limits for hotplug and PCI MMIO before kernel_randomize_memory(). On
smaller systems that could yield some KASLR address bits. This needs
additional investigation to determine if some limited ACPI table scanning
can happen this early without an open coded solution like
arch/x86/boot/compressed/acpi.c needs to deploy.

Cc: Ingo Molnar <mingo@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Logan Gunthorpe <logang@deltatee.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Fixes: 7ffb7914 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
Reviewed-by: default avatarBalbir Singh <balbirs@nvidia.com>
Tested-by: default avatarYasunori Goto <y-goto@fujitsu.com>
Acked-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Link: http://patch.msgid.link/692e08b2516d4_261c1100a3@dwillia2-mobl4.notmuch


Signed-off-by: default avatarDave Jiang <dave.jiang@intel.com>
parent 9ace4753

arch/x86/mm/kaslr.c

+5 −5
Original line number Diff line number Diff line
@@ -115,12 +115,12 @@ void __init kernel_randomize_memory(void) 


	/*

	 * Adapt physical memory region size based on available memory,

	 * except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the

	 * device BAR space assuming the direct map space is large enough

	 * for creating a ZONE_DEVICE mapping in the direct map corresponding

	 * to the physical BAR address.

	 * except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map

	 * any physical address into the direct-map. KASLR wants to reliably

	 * steal some physical address bits. Those design choices are in direct

	 * conflict.

	 */

	if (!IS_ENABLED(CONFIG_PCI_P2PDMA) && (memory_tb < kaslr_regions[0].size_tb))

	if (!IS_ENABLED(CONFIG_ZONE_DEVICE) && (memory_tb < kaslr_regions[0].size_tb))

		kaslr_regions[0].size_tb = memory_tb;



	/*

drivers/pci/Kconfig

+0 −6
Original line number Diff line number Diff line
@@ -225,12 +225,6 @@ config PCI_P2PDMA 
	  P2P DMA transactions must be between devices behind the same root

	  port.



	  Enabling this option will reduce the entropy of x86 KASLR memory

	  regions. For example - on a 46 bit system, the entropy goes down

	  from 16 bits to 15 bits. The actual reduction in entropy depends

	  on the physical address bits, on processor features, kernel config

	  (5 level page table) and physical memory present on the system.



	  If unsure, say N.



config PCI_LABEL

mm/Kconfig

+8 −4
Original line number Diff line number Diff line
@@ -1220,10 +1220,14 @@ config ZONE_DEVICE 
	  Device memory hotplug support allows for establishing pmem,

	  or other device driver discovered memory regions, in the

	  memmap. This allows pfn_to_page() lookups of otherwise

	  "device-physical" addresses which is needed for using a DAX

	  mapping in an O_DIRECT operation, among other things.



	  If FS_DAX is enabled, then say Y.

	  "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and

	  DEVICE_PRIVATE features among others.



	  Enabling this option will reduce the entropy of x86 KASLR memory

	  regions. For example - on a 46 bit system, the entropy goes down

	  from 16 bits to 15 bits. The actual reduction in entropy depends

	  on the physical address bits, on processor features, kernel config

	  (5 level page table) and physical memory present on the system.



#

# Helpers to mirror range of the CPU page tables of a process into device page