From patchwork Mon Aug 14 12:54:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 9898851 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 17818602BA for ; Mon, 14 Aug 2017 12:59:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0BF0B206AC for ; Mon, 14 Aug 2017 12:59:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F2D2D2223E; Mon, 14 Aug 2017 12:59:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 267E9206AC for ; Mon, 14 Aug 2017 12:59:07 +0000 (UTC) Received: (qmail 28556 invoked by uid 550); 14 Aug 2017 12:56:05 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 27765 invoked from network); 14 Aug 2017 12:55:56 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Hm8prTksgb4hi6FQfX0jzzPYJDeptcTrjNQLZwywGa0=; b=S0Y2d5mnFKN6FegNXglSDaud69t5gVaYk/FJdVwNJ42Rp/be5lJCI7BrTt6sZL3n62 3x846vMsu9xaD4PTHJYV+SrDtEAx8UAVPFGn4aSRt6OH1BWZclQ4w+ljNzFe9Dualsfs LCQrP/0Reb3OYj/k6pAr25j+RA3kthorDmTMI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Hm8prTksgb4hi6FQfX0jzzPYJDeptcTrjNQLZwywGa0=; b=SdgTqbKLnaoj5WWn/TwzVBZ3BapC5LyTSfGZW8/gpfSJNXZdn/MFm5EI3xScuETG/3 zvVSVJ18mLcDfYf55lzHWTlIiambFw53vqnrqR4FS3zKMxAItiXMfk5sRf5nkBZodROz pjpOCWFOSD0IJEoq7ktYDMSNrzz2Y9CJ2c1nse+kCXtagQ6jb+AUruwjdCRNUkgWVKip OVg7Gir1FU7azpitMfIPBltEruWuqCZusVvsL1COpxTYgJitXWXl68VTW28kbIdLifY0 tvSw2a4atT25WzyTDTy+uVmvNRD8WkCxVSgikuuU0uT+6lI4sMeS1nzBsy5/MBYHNHj8 Yiqw== X-Gm-Message-State: AHYfb5iWT5EQVcgcaiFdOxgzSBrGEFnaJFw1MBGsCsBCztg1Q75LFyd5 Qf9Sj8LsojU0WrDLwwAvcg== X-Received: by 10.223.182.168 with SMTP id j40mr18748487wre.122.1502715344447; Mon, 14 Aug 2017 05:55:44 -0700 (PDT) From: Ard Biesheuvel To: kernel-hardening@lists.openwall.com Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Arnd Bergmann , Nicolas Pitre , Russell King , Kees Cook , Thomas Garnier , Marc Zyngier , Mark Rutland , Tony Lindgren , Matt Fleming , Dave Martin Date: Mon, 14 Aug 2017 13:54:05 +0100 Message-Id: <20170814125411.22604-25-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170814125411.22604-1-ard.biesheuvel@linaro.org> References: <20170814125411.22604-1-ard.biesheuvel@linaro.org> Subject: [kernel-hardening] [PATCH 24/30] ARM: decompressor: explicitly map decompressor binary cacheable X-Virus-Scanned: ClamAV using ClamSMTP When randomizing the kernel load address, there may be a large distance in memory between the decompressor binary and its payload and the destination area in memory. Ensure that the decompressor itself is mapped cacheable in this case, by tweaking the existing routine that takes care of this for XIP decompressors. Cc: Russell King Signed-off-by: Ard Biesheuvel --- arch/arm/boot/compressed/head.S | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S index 5884e8151376..583cc6899d98 100644 --- a/arch/arm/boot/compressed/head.S +++ b/arch/arm/boot/compressed/head.S @@ -706,20 +706,24 @@ __setup_mmu: sub r3, r4, #16384 @ Page directory size teq r0, r2 bne 1b /* - * If ever we are running from Flash, then we surely want the cache - * to be enabled also for our execution instance... We map 2MB of it - * so there is no map overlap problem for up to 1 MB compressed kernel. - * If the execution is in RAM then we would only be duplicating the above. + * Make sure our entire executable image (including payload) is mapped + * cacheable, in case it is located outside the region we covered above. + * (This may be the case if running from flash or with randomization enabled) + * If the regions happen to overlap, we just duplicate some of the above. */ orr r1, r6, #0x04 @ ensure B is set for this orr r1, r1, #3 << 10 mov r2, pc + adr_l r9, _end mov r2, r2, lsr #20 + mov r9, r9, lsr #20 orr r1, r1, r2, lsl #20 add r0, r3, r2, lsl #2 - str r1, [r0], #4 + add r9, r3, r9, lsl #2 +0: str r1, [r0], #4 add r1, r1, #1048576 - str r1, [r0] + cmp r0, r9 + bls 0b mov pc, lr ENDPROC(__setup_mmu)