From patchwork Sun Aug 7 01:03:26 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Rafael J. Wysocki" X-Patchwork-Id: 9266153 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0444960839 for ; Sun, 7 Aug 2016 00:58:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E863627F88 for ; Sun, 7 Aug 2016 00:58:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DC0DB2840A; Sun, 7 Aug 2016 00:58:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id C5D3F27F88 for ; Sun, 7 Aug 2016 00:58:24 +0000 (UTC) Received: (qmail 1939 invoked by uid 550); 7 Aug 2016 00:58:22 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: kernel-hardening@lists.openwall.com Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 1921 invoked from network); 7 Aug 2016 00:58:21 -0000 From: "Rafael J. Wysocki" To: Yinghai Lu , Thomas Garnier Cc: "Rafael J. Wysocki" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Kees Cook , Pavel Machek , the arch/x86 maintainers , Linux Kernel Mailing List , Linux PM list , kernel-hardening@lists.openwall.com Date: Sun, 07 Aug 2016 03:03:26 +0200 Message-ID: <2213000.eZV9GAcFWG@vostro.rjw.lan> User-Agent: KMail/4.11.5 (Linux/4.5.0-rc1+; KDE/4.11.5; x86_64; ; ) In-Reply-To: References: <1470071280-78706-1-git-send-email-thgarnie@google.com> <20160803182308.19227-1-yinghai@kernel.org> MIME-Version: 1.0 Subject: [kernel-hardening] Re: [PATCH v2] x86/power/64: Support unaligned addresses for temporary mapping X-Virus-Scanned: ClamAV using ClamSMTP On Wednesday, August 03, 2016 11:28:48 PM Rafael J. Wysocki wrote: > On Wed, Aug 3, 2016 at 8:23 PM, Yinghai Lu wrote: > > From: Thomas Garnier > > > > Correctly setup the temporary mapping for hibernation. Previous > > implementation assumed the offset between KVA and PA was aligned on the PGD level. > > With KASLR memory randomization enabled, the offset is randomized on the PUD > > level. This change supports unaligned up to PMD. > > > > Signed-off-by: Thomas Garnier > > [yinghai: change loop to virtual address] > > Signed-off-by: Yinghai Lu > > Acked-by: Rafael J. Wysocki On a second thought, it seems to be better to follow your suggestion to simply provide a special version of kernel_ident_mapping_init() for hibernation, because it is sufficiently distinct from the other users of the code in ident_map.c. The patch below does just that (lightly tested). Thomas, can you please test this one too? Thanks, Rafael --- From: Rafael J. Wysocki Subject: [PATCH] x86/power/64: Always create temporary identity mapping correctly The low-level resume-from-hibernation code on x86-64 uses kernel_ident_mapping_init() to create the temoprary identity mapping, but that function assumes that the offset between kernel virtual addresses and physical addresses is aligned on the PGD level. However, with a randomized identity mapping base, it may be aligned on the PUD level and if that happens, the temporary identity mapping created by set_up_temporary_mappings() will not reflect the actual kernel identity mapping and the image restoration will fail as a result (leading to a kernel panic most of the time). To fix this problem, provide simplified routines for creating the temporary identity mapping during resume from hibernation on x86-64 that support unaligned offsets between KVA and PA up to the PMD level. Although kernel_ident_mapping_init() might be made work in that case too, using hibernation-specific code for that is way simpler. Reported-by: Thomas Garnier Suggested-by: Yinghai Lu Signed-off-by: Rafael J. Wysocki --- arch/x86/power/hibernate_64.c | 61 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 53 insertions(+), 8 deletions(-) Index: linux-pm/arch/x86/power/hibernate_64.c =================================================================== --- linux-pm.orig/arch/x86/power/hibernate_64.c +++ linux-pm/arch/x86/power/hibernate_64.c @@ -77,18 +77,63 @@ static int set_up_temporary_text_mapping return 0; } -static void *alloc_pgt_page(void *context) +static void ident_pmd_init(pmd_t *pmd, unsigned long addr, unsigned long end) { - return (void *)get_safe_page(GFP_ATOMIC); + for (; addr < end; addr += PMD_SIZE) + set_pmd(pmd + pmd_index(addr), + __pmd((addr - __PAGE_OFFSET) | __PAGE_KERNEL_LARGE_EXEC)); +} + +static int ident_pud_init(pud_t *pud, unsigned long addr, unsigned long end) +{ + unsigned long next; + + for (; addr < end; addr = next) { + pmd_t *pmd; + + pmd = (pmd_t *)get_safe_page(GFP_ATOMIC); + if (!pmd) + return -ENOMEM; + + next = (addr & PUD_MASK) + PUD_SIZE; + if (next > end) + next = end; + + ident_pmd_init(pmd, addr & PMD_MASK, next); + set_pud(pud + pud_index(addr), __pud(__pa(pmd) | _KERNPG_TABLE)); + } + return 0; +} + +static int ident_mapping_init(pgd_t *pgd, unsigned long mstart, unsigned long mend) +{ + unsigned long addr = mstart + __PAGE_OFFSET; + unsigned long end = mend + __PAGE_OFFSET; + unsigned long next; + + for (; addr < end; addr = next) { + pud_t *pud; + int result; + + pud = (pud_t *)get_safe_page(GFP_ATOMIC); + if (!pud) + return -ENOMEM; + + next = (addr & PGDIR_MASK) + PGDIR_SIZE; + if (next > end) + next = end; + + result = ident_pud_init(pud, addr, next); + if (result) + return result; + + set_pgd(pgd + pgd_index(addr), __pgd(__pa(pud) | _KERNPG_TABLE)); + } + return 0; } static int set_up_temporary_mappings(void) { - struct x86_mapping_info info = { - .alloc_pgt_page = alloc_pgt_page, - .pmd_flag = __PAGE_KERNEL_LARGE_EXEC, - .kernel_mapping = true, - }; unsigned long mstart, mend; pgd_t *pgd; int result; @@ -108,7 +153,7 @@ static int set_up_temporary_mappings(voi mstart = pfn_mapped[i].start << PAGE_SHIFT; mend = pfn_mapped[i].end << PAGE_SHIFT; - result = kernel_ident_mapping_init(&info, pgd, mstart, mend); + result = ident_mapping_init(pgd, mstart, mend); if (result) return result; }