1*4882a593SmuzhiyunFrom d48ec5e1a5fb7907520dee71b1d94045486a0c29 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Alexander Kamensky <alexander.kamensky42@gmail.com> 3*4882a593SmuzhiyunDate: Thu, 12 Nov 2020 12:56:46 -0800 4*4882a593SmuzhiyunSubject: [PATCH] arm64: kexec: disabled check if kaslr-seed dtb property was 5*4882a593Smuzhiyun wiped 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunKexec when loading arm64 kernel checks if chosen/kaslr-seed dtb property is 8*4882a593Smuzhiyunwiped. It's a good assertion to verify proper behavior of kernel. However, 9*4882a593Smuzhiyunif bootloader creates and fills kaslr-seed property and kernel is not 10*4882a593Smuzhiyunconfigured with CONFIG_RANDOMIZE_BASE then logic of reading and wiping 11*4882a593Smuzhiyunkaslr-seed does not run. As a result kaslr-seed property is not zero and when 12*4882a593Smuzhiyunkexec tries to load secondary kernel it fails with the following message: 13*4882a593Smuzhiyun 14*4882a593Smuzhiyunsetup_2nd_dtb: kaslr-seed is not wiped to 0. 15*4882a593Smuzhiyunkexec: setup_2nd_dtb failed. 16*4882a593Smuzhiyunkexec: load failed. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunThis was observed on Yocto Project on qemuarm64 machine with 5.8 kernel, 19*4882a593Smuzhiyunqemu 5.1.0. Qemu created kaslr-seed property but kernel was not configured 20*4882a593Smuzhiyunwith CONFIG_RANDOMIZE_BASE. 21*4882a593Smuzhiyun 22*4882a593SmuzhiyunAlthough check has some value, there is a use-case where it breaks kexec, 23*4882a593Smuzhiyunthis patch removes it. 24*4882a593Smuzhiyun 25*4882a593SmuzhiyunNote in described use-case the fact that kaslr-seed is not wiped and user 26*4882a593Smuzhiyunreadable through /sys/firmware/fdt or 27*4882a593Smuzhiyun/sys/firmware/devicetree/base/chosen/kaslr-seed is not a security problem 28*4882a593Smuzhiyunas kaslr is disabled anyway. 29*4882a593Smuzhiyun 30*4882a593SmuzhiyunSigned-off-by: Alexander Kamensky <alexander.kamensky42@gmail.com> 31*4882a593SmuzhiyunUpstream-Status: Submitted [http://lists.infradead.org/pipermail/kexec/2020-November/021740.html] 32*4882a593Smuzhiyun--- 33*4882a593Smuzhiyun kexec/arch/arm64/kexec-arm64.c | 14 +------------- 34*4882a593Smuzhiyun 1 file changed, 1 insertion(+), 13 deletions(-) 35*4882a593Smuzhiyun 36*4882a593SmuzhiyunIndex: kexec-tools-2.0.20/kexec/arch/arm64/kexec-arm64.c 37*4882a593Smuzhiyun=================================================================== 38*4882a593Smuzhiyun--- kexec-tools-2.0.20.orig/kexec/arch/arm64/kexec-arm64.c 39*4882a593Smuzhiyun+++ kexec-tools-2.0.20/kexec/arch/arm64/kexec-arm64.c 40*4882a593Smuzhiyun@@ -428,7 +428,7 @@ static int setup_2nd_dtb(struct dtb *dtb 41*4882a593Smuzhiyun int len, range_len; 42*4882a593Smuzhiyun int nodeoffset; 43*4882a593Smuzhiyun int new_size; 44*4882a593Smuzhiyun- int result, kaslr_seed; 45*4882a593Smuzhiyun+ int result; 46*4882a593Smuzhiyun 47*4882a593Smuzhiyun result = fdt_check_header(dtb->buf); 48*4882a593Smuzhiyun 49*4882a593Smuzhiyun@@ -499,18 +499,6 @@ static int setup_2nd_dtb(struct dtb *dtb 50*4882a593Smuzhiyun return result; 51*4882a593Smuzhiyun } 52*4882a593Smuzhiyun } else { 53*4882a593Smuzhiyun- kaslr_seed = fdt64_to_cpu(*prop); 54*4882a593Smuzhiyun- 55*4882a593Smuzhiyun- /* kaslr_seed must be wiped clean by primary 56*4882a593Smuzhiyun- * kernel during boot 57*4882a593Smuzhiyun- */ 58*4882a593Smuzhiyun- if (kaslr_seed != 0) { 59*4882a593Smuzhiyun- dbgprintf("%s: kaslr-seed is not wiped to 0.\n", 60*4882a593Smuzhiyun- __func__); 61*4882a593Smuzhiyun- result = -EINVAL; 62*4882a593Smuzhiyun- goto on_error; 63*4882a593Smuzhiyun- } 64*4882a593Smuzhiyun- 65*4882a593Smuzhiyun /* 66*4882a593Smuzhiyun * Invoke the getrandom system call with 67*4882a593Smuzhiyun * GRND_NONBLOCK, to make sure we 68