linux-kernel - [PATCH] x86/efi: page align EFI ROM image ranges

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c9cbe39f-8ad6-790e-5ce2-6363b034b2ef@gmail.com>
Date:   Wed, 2 Aug 2017 11:28:49 -0500
From:   Stuart Hayes <stuart.w.hayes@...il.com>
To:     Matt Fleming <matt@...eblueprint.co.u>
Cc:     linux-kernel@...r.kernel.org, linux-efi@...r.kernel.org,
        x86@...nel.org, Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        "H. Peter Anvin" <hpa@...or.com>
Subject: [PATCH] x86/efi: page align EFI ROM image ranges

The kernel's EFI stub locates and copies EFI ROM images into memory, which it allocates using the byte-granular EFI allocate_pool function.  These memory ranges are then added to setup_data, and later to e820 (in e820__reserve_setup_data()).  The e820 ranges are parsed to create nosave regions (in e820__register_nosave_regions()), but when non-page-aligned e820 regions are parsed, a nosave page is added at the beginning and end of each non-page-aligned region, which results in data not getting saved or restored during a hibernate/resume.  This can result in random failures after a hibernate/resume.

Round up the allocation size to a whole number of pages, and use EFI allocate_pages to ensure that the EFI ROM copy regions are page-aligned.

On a system with six EFI ROM images, before the patch:

e820: update [mem 0x64866020-0x6486e05f] usable ==> usable
e820: update [mem 0x6147a020-0x61499c5f] usable ==> usable
e820: update [mem 0x60fff020-0x6105785f] usable ==> usable
e820: update [mem 0x60fa6020-0x60ffe85f] usable ==> usable
e820: update [mem 0x60f4d020-0x60fa585f] usable ==> usable
e820: update [mem 0x60ef4020-0x60f4c85f] usable ==> usable
...
PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
PM: Registered nosave memory: [mem 0x000a0000-0x000fffff]
PM: Registered nosave memory: [mem 0x60ef4000-0x60ef4fff]
PM: Registered nosave memory: [mem 0x60f4c000-0x60f4cfff]
PM: Registered nosave memory: [mem 0x60f4d000-0x60f4dfff]
PM: Registered nosave memory: [mem 0x60fa5000-0x60fa5fff]
PM: Registered nosave memory: [mem 0x60fa6000-0x60fa6fff]
PM: Registered nosave memory: [mem 0x60ffe000-0x60ffefff]
PM: Registered nosave memory: [mem 0x60fff000-0x60ffffff]
PM: Registered nosave memory: [mem 0x61057000-0x61057fff]
PM: Registered nosave memory: [mem 0x6147a000-0x6147afff]
PM: Registered nosave memory: [mem 0x61499000-0x61499fff]
PM: Registered nosave memory: [mem 0x64866000-0x64866fff]
PM: Registered nosave memory: [mem 0x6486e000-0x6486efff]
PM: Registered nosave memory: [mem 0x6cf6e000-0x6f3ccfff]

After the patch:

e820: update [mem 0x64866000-0x6486efff] usable ==> usable
e820: update [mem 0x6147a000-0x61499fff] usable ==> usable
e820: update [mem 0x60fff000-0x61057fff] usable ==> usable
e820: update [mem 0x60fa6000-0x60ffefff] usable ==> usable
e820: update [mem 0x60f4d000-0x60fa5fff] usable ==> usable
e820: update [mem 0x60ef4000-0x60f4cfff] usable ==> usable
...
PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
PM: Registered nosave memory: [mem 0x000a0000-0x000fffff]
PM: Registered nosave memory: [mem 0x6cf6e000-0x6f3ccfff]

Signed-off-by: Stuart Hayes <stuart.w.hayes@...il.com>
---

--- linux-4.13-rc2/arch/x86/boot/compressed/eboot.c.orig	2017-08-01 12:12:04.696049106 -0400
+++ linux-4.13-rc2/arch/x86/boot/compressed/eboot.c	2017-08-01 12:11:33.120182236 -0400
@@ -235,7 +235,12 @@ __setup_efi_pci64(efi_pci_io_protocol_64

 	size = pci->romsize + sizeof(*rom);

-	status = efi_call_early(allocate_pool, EFI_LOADER_DATA, size, &rom);
+	/*
+	 * Get whole pages because this will be added to e820.
+	 */
+	size = PAGE_ALIGN(size);
+	status = efi_call_early(allocate_pages, EFI_ALLOCATE_ANY_PAGES,
+				EFI_LOADER_DATA, (size >> PAGE_SHIFT), &rom);
 	if (status != EFI_SUCCESS) {
 		efi_printk(sys_table, "Failed to alloc mem for rom\n");
 		return status;