efi: stub: prefer mirrored memory for randomized allocations
Subsystems (2)
Ard Biesheuvel
maintainerPATCH 1/1 efi: stub: prefer mirrored memory for randomized allocations
If the system exposes memory regions with the EFI_MORE_RELIABLE attribute, it is implied that it is intended to be used for allocations that are relatively important, such as the kernel's static image.
Since efi_random_alloc() is mostly (only) used for allocating space for the kernel image, let's update it to take this into account, and disregard all memory without the EFI_MORE_RELIABLE attribute if there is sufficient memory available that does have this attribute.
Note that this change only affects booting with randomization enabled. In other cases, the EFI stub runs the kernel image in place unless its placement is unsuitable for some reason (i.e., misaligned, or its BSS overlaps with another allocation), and it is left to the bootloader to ensure that the kernel was loaded into EFI_MORE_RELIABLE memory if this is desired.
--- drivers/firmware/efi/libstub/randomalloc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/firmware/efi/libstub/randomalloc.c +11 -0
@@ -56,6 +56,7 @@ efi_status_t efi_random_alloc(unsigned long size, unsigned long random_seed) {unsigned long map_size, desc_size, total_slots =0 , target_slot; +unsigned long total_mirrored_slots =0 ;unsigned long buff_size;efi_status_t status;efi_memory_desc_t *memory_map;
@@ -86,8 +87,14 @@ efi_status_t efi_random_alloc(unsigned long size, slots =get_entry_num_slots (md, size,ilog2 (align));MD_NUM_SLOTS (md) = slots; total_slots += slots; +if (md->attribute &EFI_MEMORY_MORE_RELIABLE ) + total_mirrored_slots += slots; } +/* only consider mirrored slots for randomization if any exist */ +if (total_mirrored_slots >0 ) + total_slots = total_mirrored_slots; +/* find a random number between 0 and total_slots */ target_slot = (total_slots * (u64)(random_seed &U32_MAX )) >>32 ;
@@ -107,6 +114,10 @@ efi_status_t efi_random_alloc(unsigned long size,efi_physical_addr_t target;unsigned long pages; +if (total_mirrored_slots >0 && + !(md->attribute &EFI_MEMORY_MORE_RELIABLE )) +continue ; +if (target_slot >=MD_NUM_SLOTS (md)) { target_slot -=MD_NUM_SLOTS (md);continue ;
Signature · 1 line
2.30.2
Quoted 35 lines · Ard Biesheuvel
If the system exposes memory regions with the
EFI_MORE_RELIABLEattribute, it is implied that it is intended to be used for allocations that are relatively important, such as the kernel's static image.Since
efi_random_alloc()is mostly (only) used for allocating space for the kernel image, let's update it to take this into account, and disregard all memory without theEFI_MORE_RELIABLEattribute if there is sufficient memory available that does have this attribute.Note that this change only affects booting with randomization enabled. In other cases, the EFI stub runs the kernel image in place unless its placement is unsuitable for some reason (i.e., misaligned, or its BSS overlaps with another allocation), and it is left to the bootloader to ensure that the kernel was loaded into
EFI_MORE_RELIABLEmemory if this is desired.Signed-off-by Ard Biesheuvel <[email protected]>--- drivers/firmware/efi/libstub/randomalloc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)drivers/firmware/efi/libstub/randomalloc.c +1
-0@@ -56,6 +56,7 @@ efi_status_t efi_random_alloc(unsigned long size, unsigned long random_seed) {unsigned long map_size, desc_size, total_slots =0 , target_slot; +unsigned long total_mirrored_slots =0 ;unsigned long buff_size;efi_status_t status;efi_memory_desc_t *memory_map;@@ -86,8 +87,14 @@ efi_status_t efi_random_alloc(unsigned long size, slots =get_entry_num_slots (md, size,ilog2 (align));
drivers/firmware/efi/libstub/randomalloc.c efi_status_t efi_random_alloc(unsigned long size, · line 97
Quoted 10 lines
drivers/firmware/efi/libstub/randomalloc.c +6
-0MD_NUM_SLOTS (md) = slots; total_slots += slots; +if (md->attribute &EFI_MEMORY_MORE_RELIABLE ) + total_mirrored_slots += slots; } +/* only consider mirrored slots for randomization if any exist */ +if (total_mirrored_slots >0 ) + total_slots = total_mirrored_slots; +
The kernel will check 4G lower limit to enable kernelcore=mirror feature.
Do we need some fallback mechanism in case of small mirror slots which
leads to fail allocation for Image?
Quoted 14 lines
drivers/firmware/efi/libstub/randomalloc.c +4
-0/* find a random number between 0 and total_slots */ target_slot = (total_slots * (u64)(random_seed &U32_MAX )) >>32 ;@@ -107,6 +114,10 @@ efi_status_t efi_random_alloc(unsigned long size,efi_physical_addr_t target;unsigned long pages; +if (total_mirrored_slots >0 && + !(md->attribute &EFI_MEMORY_MORE_RELIABLE )) +continue ; +if (target_slot >=MD_NUM_SLOTS (md)) { target_slot -=MD_NUM_SLOTS (md);continue ;
Ard Biesheuvel
maintainerQuoted 44 lines · Kefeng Wang
Quoted 41 lines · Ard Biesheuvel
If the system exposes memory regions with the
EFI_MORE_RELIABLEattribute, it is implied that it is intended to be used for allocations that are relatively important, such as the kernel's static image.Since
efi_random_alloc()is mostly (only) used for allocating space for the kernel image, let's update it to take this into account, and disregard all memory without theEFI_MORE_RELIABLEattribute if there is sufficient memory available that does have this attribute.Note that this change only affects booting with randomization enabled. In other cases, the EFI stub runs the kernel image in place unless its placement is unsuitable for some reason (i.e., misaligned, or its BSS overlaps with another allocation), and it is left to the bootloader to ensure that the kernel was loaded into
EFI_MORE_RELIABLEmemory if this is desired.Signed-off-by Ard Biesheuvel <[email protected]>--- drivers/firmware/efi/libstub/randomalloc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)drivers/firmware/efi/libstub/randomalloc.c +3
-0@@ -56,6 +56,7 @@ efi_status_t efi_random_alloc(unsigned long size, unsigned long random_seed) {unsigned long map_size, desc_size, total_slots =0 , target_slot; +unsigned long total_mirrored_slots =0 ;unsigned long buff_size;efi_status_t status;efi_memory_desc_t *memory_map;@@ -86,8 +87,14 @@ efi_status_t efi_random_alloc(unsigned long size, slots =get_entry_num_slots (md, size,ilog2 (align));MD_NUM_SLOTS (md) = slots; total_slots += slots; +if (md->attribute &EFI_MEMORY_MORE_RELIABLE ) + total_mirrored_slots += slots; }
Quoted 7 lines
drivers/firmware/efi/libstub/randomalloc.c efi_status_t efi_random_alloc(unsigned long size, · line 97
Quoted 4 lines
drivers/firmware/efi/libstub/randomalloc.c +4
-0+/* only consider mirrored slots for randomization if any exist */ +if (total_mirrored_slots >0 ) + total_slots = total_mirrored_slots; +The kernel will check 4G lower limit to enable kernelcore=mirror feature.
Why? I mean, why is 4G a magic number also on arm64?
Quoted 4 lines
Do we need some fallback mechanism in case of small mirror slots which
leads to fail allocation for Image?
This code only counts slots that are large enough to hold the Image so this can never happen. If total_mirrored_slots > 0, there is at least one possible placement of the kernel where it falls entirely inside a EFI_MORE_RELIABLE region.
Quoted 15 lines
Quoted 15 lines
drivers/firmware/efi/libstub/randomalloc.c +4
-0/* find a random number between 0 and total_slots */ target_slot = (total_slots * (u64)(random_seed &U32_MAX )) >>32 ;@@ -107,6 +114,10 @@ efi_status_t efi_random_alloc(unsigned long size,efi_physical_addr_t target;unsigned long pages; +if (total_mirrored_slots >0 && + !(md->attribute &EFI_MEMORY_MORE_RELIABLE )) +continue ; +if (target_slot >=MD_NUM_SLOTS (md)) { target_slot -=MD_NUM_SLOTS (md);continue ;
Kefeng Wang
Reviewed-byQuoted 44 lines · Ard Biesheuvel
Quoted 43 lines · Kefeng Wang
Quoted 41 lines · Ard Biesheuvel
If the system exposes memory regions with the
EFI_MORE_RELIABLEattribute, it is implied that it is intended to be used for allocations that are relatively important, such as the kernel's static image.Since
efi_random_alloc()is mostly (only) used for allocating space for the kernel image, let's update it to take this into account, and disregard all memory without theEFI_MORE_RELIABLEattribute if there is sufficient memory available that does have this attribute.Note that this change only affects booting with randomization enabled. In other cases, the EFI stub runs the kernel image in place unless its placement is unsuitable for some reason (i.e., misaligned, or its BSS overlaps with another allocation), and it is left to the bootloader to ensure that the kernel was loaded into
EFI_MORE_RELIABLEmemory if this is desired.Signed-off-by Ard Biesheuvel <[email protected]>--- drivers/firmware/efi/libstub/randomalloc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)drivers/firmware/efi/libstub/randomalloc.c +3
-0@@ -56,6 +56,7 @@ efi_status_t efi_random_alloc(unsigned long size, unsigned long random_seed) {unsigned long map_size, desc_size, total_slots =0 , target_slot; +unsigned long total_mirrored_slots =0 ;unsigned long buff_size;efi_status_t status;efi_memory_desc_t *memory_map;@@ -86,8 +87,14 @@ efi_status_t efi_random_alloc(unsigned long size, slots =get_entry_num_slots (md, size,ilog2 (align));MD_NUM_SLOTS (md) = slots; total_slots += slots; +if (md->attribute &EFI_MEMORY_MORE_RELIABLE ) + total_mirrored_slots += slots; }
Quoted 7 lines
Quoted 6 lines
drivers/firmware/efi/libstub/randomalloc.c efi_status_t efi_random_alloc(unsigned long size, · line 97
Quoted 4 lines
drivers/firmware/efi/libstub/randomalloc.c +4
-0+/* only consider mirrored slots for randomization if any exist */ +if (total_mirrored_slots >0 ) + total_slots = total_mirrored_slots; +The kernel will check 4G lower limit to enable kernelcore=mirror feature.
Why? I mean, why is 4G a magic number also on arm64?
Please ignore this, replied in the previous email.
Quoted 9 lines
Quoted 5 lines
Do we need some fallback mechanism in case of small mirror slots which
leads to fail allocation for Image?
This code only counts slots that are large enough to hold the Image so this can never happen. If
total_mirrored_slots> 0, there is at least one possible placement of the kernel where it falls entirely inside aEFI_MORE_RELIABLEregion.
I see, slots = get_entry_num_slots(md, *size*, ilog2(align));
Thanks.
Quoted 16 lines
Quoted 8 lines
Quoted 8 lines
drivers/firmware/efi/libstub/randomalloc.c +0
-0/* find a random number between 0 and total_slots */ target_slot = (total_slots * (u64)(random_seed &U32_MAX )) >>32 ;@@ -107,6 +114,10 @@ efi_status_t efi_random_alloc(unsigned long size,efi_physical_addr_t target;unsigned long pages;Quoted 7 lines
drivers/firmware/efi/libstub/randomalloc.c efi_status_t efi_random_alloc(unsigned long size, · line 123
Quoted 7 lines
drivers/firmware/efi/libstub/randomalloc.c +4
-0+if (total_mirrored_slots >0 && + !(md->attribute &EFI_MEMORY_MORE_RELIABLE )) +continue ; +if (target_slot >=MD_NUM_SLOTS (md)) { target_slot -=MD_NUM_SLOTS (md);continue ;.
Ard Biesheuvel
maintainerQuoted 65 lines · Kefeng Wang
Quoted 44 lines · Ard Biesheuvel
Quoted 43 lines · Kefeng Wang
Quoted 41 lines · Ard Biesheuvel
If the system exposes memory regions with the
EFI_MORE_RELIABLEattribute, it is implied that it is intended to be used for allocations that are relatively important, such as the kernel's static image.Since
efi_random_alloc()is mostly (only) used for allocating space for the kernel image, let's update it to take this into account, and disregard all memory without theEFI_MORE_RELIABLEattribute if there is sufficient memory available that does have this attribute.Note that this change only affects booting with randomization enabled. In other cases, the EFI stub runs the kernel image in place unless its placement is unsuitable for some reason (i.e., misaligned, or its BSS overlaps with another allocation), and it is left to the bootloader to ensure that the kernel was loaded into
EFI_MORE_RELIABLEmemory if this is desired.Signed-off-by Ard Biesheuvel <[email protected]>--- drivers/firmware/efi/libstub/randomalloc.c | 11 +++++++++++ 1 file changed, 11 insertions(+)drivers/firmware/efi/libstub/randomalloc.c +3
-0@@ -56,6 +56,7 @@ efi_status_t efi_random_alloc(unsigned long size, unsigned long random_seed) {unsigned long map_size, desc_size, total_slots =0 , target_slot; +unsigned long total_mirrored_slots =0 ;unsigned long buff_size;efi_status_t status;efi_memory_desc_t *memory_map;@@ -86,8 +87,14 @@ efi_status_t efi_random_alloc(unsigned long size, slots =get_entry_num_slots (md, size,ilog2 (align));MD_NUM_SLOTS (md) = slots; total_slots += slots; +if (md->attribute &EFI_MEMORY_MORE_RELIABLE ) + total_mirrored_slots += slots; }Quoted 7 lines
Quoted 6 lines
drivers/firmware/efi/libstub/randomalloc.c efi_status_t efi_random_alloc(unsigned long size, · line 97
Quoted 4 lines
drivers/firmware/efi/libstub/randomalloc.c +4
-0+/* only consider mirrored slots for randomization if any exist */ +if (total_mirrored_slots >0 ) + total_slots = total_mirrored_slots; +The kernel will check 4G lower limit to enable kernelcore=mirror feature.
Why? I mean, why is 4G a magic number also on arm64?
Please ignore this, replied in the previous email.
Quoted 9 lines
Quoted 5 lines
Do we need some fallback mechanism in case of small mirror slots which
leads to fail allocation for Image?
This code only counts slots that are large enough to hold the Image so this can never happen. If
total_mirrored_slots> 0, there is at least one possible placement of the kernel where it falls entirely inside aEFI_MORE_RELIABLEregion.
Quoted 6 lines
I see, slots =
get_entry_num_slots(md, *size*, ilog2(align));Thanks.
Reviewed-by Kefeng Wang <[email protected]>
Thank you. I have queued this up now.
Quoted 40 lines · Kefeng Wang
Quoted 38 lines · Ard Biesheuvel
If the system exposes memory regions with the
EFI_MORE_RELIABLEattribute, it is implied that it is intended to be used for allocations that are relatively important, such as the kernel's static image.Since
efi_random_alloc()is mostly (only) used for allocating space for the kernel image, let's update it to take this into account, and disregard all memory without theEFI_MORE_RELIABLEattribute if there is sufficient memory available that does have this attribute.Note that this change only affects booting with randomization enabled. In other cases, the EFI stub runs the kernel image in place unless its placement is unsuitable for some reason (i.e., misaligned, or its BSS overlaps with another allocation), and it is left to the bootloader to ensure that the kernel was loaded into
EFI_MORE_RELIABLEmemory if this is desired.Signed-off-by Ard Biesheuvel <[email protected]>---
drivers/firmware/efi/libstub/randomalloc.c| 11 +++++++++++1 file changed, 11 insertions(+)drivers/firmware/efi/libstub/randomalloc.c +2
-0@@ -56,6 +56,7 @@ efi_status_t efi_random_alloc(unsigned long size, unsigned long random_seed) { unsigned long map_size, desc_size, total_slots = 0, target_slot; + unsigned long total_mirrored_slots = 0; unsigned long buff_size; efi_status_t status; efi_memory_desc_t *memory_map;@@ -86,8 +87,14 @@ efi_status_t efi_random_alloc(unsigned long size, slots = get_entry_num_slots(md, size, ilog2(align)); MD_NUM_SLOTS(md) = slots; total_slots += slots; + if (md->attribute & EFI_MEMORY_MORE_RELIABLE)
Quoted 8 lines
Quoted 6 lines
drivers/firmware/efi/libstub/randomalloc.c +1
-0+ total_mirrored_slots += slots; }+ /* only consider mirrored slots for randomization if any exist */ + if (
total_mirrored_slots> 0)
+total_slots=total_mirrored_slots;
+The kernel will check 4G lower limit to enable kernelcore=mirror feature.
Please ignore this, the kernel only check whether the memory below 4G are
all mirrored memory or not.
Quoted 19 lines
Do we need some fallback mechanism in case of small mirror slots which
leads to fail allocation for Image?
Quoted 12 lines
/* find a random number between 0 and
total_slots*/target_slot= (total_slots* (u64)(random_seed &U32_MAX)) >> 32; @@ -107,6 +114,10 @@efi_status_tefi_random_alloc(unsigned long size,efi_physical_addr_ttarget;
unsigned long pages;
+ if (total_mirrored_slots> 0 &&
+ !(md->attribute &EFI_MEMORY_MORE_RELIABLE))
+ continue;
+
if (target_slot>=MD_NUM_SLOTS(md)) {
target_slot-=MD_NUM_SLOTS(md);
continue;