[PATCH OLK-6.6 v2 0/8] kaslr: ppc64: Introduce KASLR for PPC64
This patchset introduces KASLR for PowerPC64 chips. v2: Replaced bugzilla in commit messages. GUO Zihua (2): powerpc/fsl_booke/kaslr: Provide correct r5 value for relocated kernel powerpc/fsl_booke/kaslr: Fix preserved memory size for int-vectors issue Jason Yan (6): powerpc/fsl_booke/kaslr: refactor kaslr_legal_offset() and kaslr_early_init() powerpc/fsl_booke/64: introduce reloc_kernel_entry() helper powerpc/fsl_booke/64: implement KASLR for fsl_booke64 powerpc/fsl_booke/64: do not clear the BSS for the second pass powerpc/fsl_booke/64: clear the original kernel if randomized powerpc/fsl_booke/kaslr: rename kaslr-booke32.rst to kaslr-booke.rst and add 64bit part Documentation/powerpc/index.rst | 2 +- .../{kaslr-booke32.rst => kaslr-booke.rst} | 35 ++++++- arch/powerpc/Kconfig | 5 +- arch/powerpc/kernel/exceptions-64e.S | 27 ++++++ arch/powerpc/kernel/head_64.S | 22 +++++ arch/powerpc/kernel/prom.c | 8 +- arch/powerpc/kernel/setup_64.c | 3 + arch/powerpc/mm/mmu_decl.h | 25 ++--- arch/powerpc/mm/nohash/kaslr_booke.c | 91 +++++++++++++------ 9 files changed, 169 insertions(+), 49 deletions(-) rename Documentation/powerpc/{kaslr-booke32.rst => kaslr-booke.rst} (59%) -- 2.34.1
From: Jason Yan <yanaijie@huawei.com> maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-... ------------------------------------------------- Some code refactor in kaslr_legal_offset() and kaslr_early_init(). No functional change. This is a preparation for KASLR fsl_booke64. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/mm/nohash/kaslr_booke.c | 34 +++++++++++++++------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 2fb3edafe9ab..08b5b90653ce 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -24,6 +24,7 @@ struct regions { unsigned long pa_start; unsigned long pa_end; unsigned long kernel_size; + unsigned long linear_sz; unsigned long dtb_start; unsigned long dtb_end; unsigned long initrd_start; @@ -254,11 +255,23 @@ static __init void get_cell_sizes(const void *fdt, int node, int *addr_cells, *size_cells = fdt32_to_cpu(*prop); } -static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long index, - unsigned long offset) +static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long random) { unsigned long koffset = 0; unsigned long start; + unsigned long index; + unsigned long offset; + + /* + * Decide which 64M we want to start + * Only use the low 8 bits of the random seed + */ + index = random & 0xFF; + index %= regions.linear_sz / SZ_64M; + + /* Decide offset inside 64M */ + offset = random % (SZ_64M - regions.kernel_size); + offset = round_down(offset, SZ_16K); while ((long)index >= 0) { offset = memstart_addr + index * SZ_64M + offset; @@ -283,10 +296,9 @@ static inline __init bool kaslr_disabled(void) static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size, unsigned long kernel_sz) { - unsigned long offset, random; + unsigned long random; unsigned long ram, linear_sz; u64 seed; - unsigned long index; kaslr_get_cmdline(dt_ptr); if (kaslr_disabled()) @@ -327,22 +339,12 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size regions.dtb_start = __pa(dt_ptr); regions.dtb_end = __pa(dt_ptr) + fdt_totalsize(dt_ptr); regions.kernel_size = kernel_sz; + regions.linear_sz = linear_sz; get_initrd_range(dt_ptr); get_crash_kernel(dt_ptr, ram); - /* - * Decide which 64M we want to start - * Only use the low 8 bits of the random seed - */ - index = random & 0xFF; - index %= linear_sz / SZ_64M; - - /* Decide offset inside 64M */ - offset = random % (SZ_64M - kernel_sz); - offset = round_down(offset, SZ_16K); - - return kaslr_legal_offset(dt_ptr, index, offset); + return kaslr_legal_offset(dt_ptr, random); } /* -- 2.34.1
From: Jason Yan <yanaijie@huawei.com> maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-... ------------------------------------------------- Like the 32bit code, we introduce reloc_kernel_entry() helper to prepare for the KASLR 64bit version. And move the C declaration of this function out of CONFIG_PPC32 and use long instead of int for the parameter 'addr'. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> Reviewed-by: Christophe Leroy <christophe.leroy@c-s.fr> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/kernel/exceptions-64e.S | 13 +++++++++++++ arch/powerpc/mm/mmu_decl.h | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 7ab4c8c0f1ab..175d83c366e0 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1554,3 +1554,16 @@ _GLOBAL(setup_ehv_ivors) _GLOBAL(setup_lrat_ivor) SET_IVOR(42, 0x340) /* LRAT Error */ blr + +/* + * Return to the start of the relocated kernel and run again + * r3 - virtual address of fdt + * r4 - entry of the kernel + */ +_GLOBAL(reloc_kernel_entry) + mfmsr r7 + rlwinm r7, r7, 0, ~(MSR_IS | MSR_DS) + + mtspr SPRN_SRR0,r4 + mtspr SPRN_SRR1,r7 + rfi diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h index 7f9ff0640124..a071825d5d8e 100644 --- a/arch/powerpc/mm/mmu_decl.h +++ b/arch/powerpc/mm/mmu_decl.h @@ -120,10 +120,11 @@ extern void adjust_total_lowmem(void); extern int switch_to_as1(void); extern void restore_to_as0(int esel, int offset, void *dt_ptr, int bootcpu); void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); -void reloc_kernel_entry(void *fdt, int addr); void relocate_init(u64 dt_ptr, phys_addr_t start); extern int is_second_reloc; #endif + +void reloc_kernel_entry(void *fdt, long addr); extern void loadcam_entry(unsigned int index); extern void loadcam_multi(int first_idx, int num, int tmp_idx); -- 2.34.1
From: Jason Yan <yanaijie@huawei.com> maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-... ------------------------------------------------- The implementation for Freescale BookE64 is similar as BookE32. One difference is that Freescale BookE64 set up a TLB mapping of 1G during booting. Another difference is that ppc64 needs the kernel to be 64K-aligned. So we can randomize the kernel in this 1G mapping and make it 64K-aligned. This can save some code to creat another TLB map at early boot. The disadvantage is that we only have about 1G/64K = 16384 slots to put the kernel in. To support secondary cpu boot up, a variable __kaslr_offset was added in first_256B section. This can help secondary cpu get the kaslr offset before the 1:1 mapping has been setup. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/Kconfig | 5 +- arch/powerpc/kernel/exceptions-64e.S | 10 ++++ arch/powerpc/kernel/head_64.S | 6 +++ arch/powerpc/kernel/setup_64.c | 3 ++ arch/powerpc/mm/mmu_decl.h | 22 ++++---- arch/powerpc/mm/nohash/kaslr_booke.c | 75 +++++++++++++++++++--------- 6 files changed, 86 insertions(+), 35 deletions(-) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index d5d5388973ac..c253be653876 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -660,14 +660,15 @@ config RELOCATABLE config RANDOMIZE_BASE bool "Randomize the address of the kernel image" - depends on PPC_85xx && FLATMEM + depends on PPC_E500 && FLATMEM depends on RELOCATABLE + default n help Randomizes the virtual address at which the kernel image is loaded, as a security feature that deters exploit attempts relying on knowledge of the location of kernel internals. - If unsure, say Y. + If unsure, say N. config RELOCATABLE_TEST bool "Test relocatable kernel" diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 175d83c366e0..422971ca9322 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1249,6 +1249,7 @@ skpinv: addi r6,r6,1 /* Increment */ 1: mflr r6 addi r6,r6,(2f - 1b) tovirt(r6,r6) + add r6,r6,r19 lis r7,MSR_KERNEL@h ori r7,r7,MSR_KERNEL@l mtspr SPRN_SRR0,r6 @@ -1271,6 +1272,7 @@ skpinv: addi r6,r6,1 /* Increment */ /* We translate LR and return */ tovirt(r8,r8) + add r8,r8,r19 mtlr r8 blr @@ -1403,6 +1405,7 @@ a2_tlbinit_code_end: */ _GLOBAL(start_initialization_book3e) mflr r28 + li r19, 0 /* First, we need to setup some initial TLBs to map the kernel * text, data and bss at PAGE_OFFSET. We don't have a real mode @@ -1445,6 +1448,12 @@ _GLOBAL(book3e_secondary_core_init) cmplwi r4,0 bne 2f + li r19, 0 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __kaslr_offset) + ld r19,0(r19) + rlwinm r19,r19,0,0,5 +#endif /* Setup TLB for this core */ bl initial_tlb_book3e @@ -1477,6 +1486,7 @@ _GLOBAL(book3e_secondary_core_init) lis r3,PAGE_OFFSET@highest sldi r3,r3,32 or r28,r28,r3 + add r28,r28,r19 1: mtlr r28 blr diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 4690c219bfa4..41d5cbd1e003 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -116,6 +116,12 @@ __secondary_hold_acknowledge: .8byte 0x0 #ifdef CONFIG_RELOCATABLE +#ifdef CONFIG_RANDOMIZE_BASE + .globl __kaslr_offset +__kaslr_offset: + .8byte 0x0 +#endif + /* This flag is set to 1 by a loader if the kernel should run * at the loaded address instead of the linked address. This * is used by kexec-tools to keep the kdump kernel in the diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c index 246201d0d879..15ece83ab7ac 100644 --- a/arch/powerpc/kernel/setup_64.c +++ b/arch/powerpc/kernel/setup_64.c @@ -70,6 +70,7 @@ #include <asm/early_ioremap.h> #include <asm/pgalloc.h> +#include <mm/mmu_decl.h> #include "setup.h" int spinning_secondaries; @@ -380,6 +381,8 @@ void __init early_setup(unsigned long dt_ptr) /* Enable early debugging if any specified (see udbg.h) */ udbg_early_init(); + kaslr_early_init(__va(dt_ptr), 0); + udbg_printf(" -> %s(), dt_ptr: 0x%lx\n", __func__, dt_ptr); /* diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h index a071825d5d8e..ba9d507999cd 100644 --- a/arch/powerpc/mm/mmu_decl.h +++ b/arch/powerpc/mm/mmu_decl.h @@ -119,23 +119,17 @@ extern unsigned long map_mem_in_cams(unsigned long ram, int max_cam_idx, extern void adjust_total_lowmem(void); extern int switch_to_as1(void); extern void restore_to_as0(int esel, int offset, void *dt_ptr, int bootcpu); -void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); void relocate_init(u64 dt_ptr, phys_addr_t start); -extern int is_second_reloc; #endif +void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); +extern int is_second_reloc; +extern unsigned long __kaslr_offset; +extern unsigned int __run_at_load; void reloc_kernel_entry(void *fdt, long addr); extern void loadcam_entry(unsigned int index); extern void loadcam_multi(int first_idx, int num, int tmp_idx); -#ifdef CONFIG_RANDOMIZE_BASE -void kaslr_early_init(void *dt_ptr, phys_addr_t size); -void kaslr_late_init(void); -#else -static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} -static inline void kaslr_late_init(void) {} -#endif - struct tlbcam { u32 MAS0; u32 MAS1; @@ -149,6 +143,14 @@ struct tlbcam { extern struct tlbcam TLBCAM[NUM_TLBCAMS]; #endif +#ifdef CONFIG_RANDOMIZE_BASE +void kaslr_early_init(void *dt_ptr, phys_addr_t size); +void kaslr_late_init(void); +#else +static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} +static inline void kaslr_late_init(void) {} +#endif + #if defined(CONFIG_PPC_BOOK3S_32) || defined(CONFIG_PPC_85xx) || defined(CONFIG_PPC_8xx) /* 6xx have BATS */ /* PPC_85xx have TLBCAM */ diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 08b5b90653ce..1cfeeff3b73d 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -222,10 +222,11 @@ static __init unsigned long get_usable_address(const void *fdt, unsigned long start, unsigned long offset) { + unsigned long unit = IS_ENABLED(CONFIG_PPC32) ? SZ_16K : SZ_64K; unsigned long pa; unsigned long pa_end; - for (pa = offset; (long)pa > (long)start; pa -= SZ_16K) { + for (pa = offset; (long)pa > (long)start; pa -= unit) { pa_end = pa + regions.kernel_size; if (overlaps_region(fdt, pa, pa_end)) continue; @@ -262,24 +263,34 @@ static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long rando unsigned long index; unsigned long offset; - /* - * Decide which 64M we want to start - * Only use the low 8 bits of the random seed - */ - index = random & 0xFF; - index %= regions.linear_sz / SZ_64M; - - /* Decide offset inside 64M */ - offset = random % (SZ_64M - regions.kernel_size); - offset = round_down(offset, SZ_16K); + if (IS_ENABLED(CONFIG_PPC32)) { + /* + * Decide which 64M we want to start + * Only use the low 8 bits of the random seed + */ + index = random & 0xFF; + index %= regions.linear_sz / SZ_64M; + + /* Decide offset inside 64M */ + offset = random % (SZ_64M - regions.kernel_size); + offset = round_down(offset, SZ_16K); + + while ((long)index >= 0) { + offset = memstart_addr + index * SZ_64M + offset; + start = memstart_addr + index * SZ_64M; + koffset = get_usable_address(dt_ptr, start, offset); + if (koffset) + break; + index--; + } + } else { + /* Decide kernel offset inside 1G */ + offset = random % (regions.linear_sz - regions.kernel_size); + offset = round_down(offset, SZ_64K); - while ((long)index >= 0) { - offset = memstart_addr + index * SZ_64M + offset; - start = memstart_addr + index * SZ_64M; + start = memstart_addr; + offset = memstart_addr + offset; koffset = get_usable_address(dt_ptr, start, offset); - if (koffset) - break; - index--; } if (koffset != 0) @@ -319,6 +330,7 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size else pr_warn("KASLR: No safe seed for randomizing the kernel base.\n"); +#ifdef CONFIG_PPC32 ram = min_t(phys_addr_t, __max_low_memory, size); ram = map_mem_in_cams(ram, CONFIG_LOWMEM_CAM_NUM, true, true); linear_sz = min_t(unsigned long, ram, SZ_512M); @@ -326,6 +338,10 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size /* If the linear size is smaller than 64M, do not randomize */ if (linear_sz < SZ_64M) return 0; +#else + ram = size; + linear_sz = min_t(unsigned long, size, SZ_1G); +#endif /* check for a reserved-memory node and record its cell sizes */ regions.reserved_mem = fdt_path_offset(dt_ptr, "/reserved-memory"); @@ -359,6 +375,14 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) unsigned long offset; unsigned long kernel_sz; + if (IS_ENABLED(CONFIG_PPC64)) { + if (__run_at_load == 1) + return; + + /* Get the first memblock size */ + early_get_first_memblock_info(dt_ptr, &size); + } + kernel_sz = (unsigned long)_end - (unsigned long)_stext; offset = kaslr_choose_location(dt_ptr, size, kernel_sz); @@ -368,14 +392,19 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) kernstart_virt_addr += offset; kernstart_addr += offset; - is_second_reloc = 1; + if (IS_ENABLED(CONFIG_PPC32)) { + is_second_reloc = 1; - if (offset >= SZ_64M) { - tlb_virt = round_down(kernstart_virt_addr, SZ_64M); - tlb_phys = round_down(kernstart_addr, SZ_64M); + if (offset >= SZ_64M) { + tlb_virt = round_down(kernstart_virt_addr, SZ_64M); + tlb_phys = round_down(kernstart_addr, SZ_64M); - /* Create kernel map to relocate in */ - create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + /* Create kernel map to relocate in */ + create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + } + } else { + __kaslr_offset = kernstart_virt_addr - KERNELBASE; + __run_at_load = 1; } /* Copy the kernel to it's new location and run */ -- 2.34.1
From: Jason Yan <yanaijie@huawei.com> maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200306064033.3398-... ------------------------------------------------- The BSS section has already cleared out in the first pass. No need to clear it again. This can save some time when booting with KASLR enabled. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/kernel/head_64.S | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 41d5cbd1e003..68592eec0e70 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -958,6 +958,13 @@ start_here_multiplatform: /* Adjust TOC for moved kernel. Could adjust when moving it instead. */ bl relative_toc + /* Do not clear the BSS for the second pass if randomized */ + LOAD_REG_ADDR(r3, kernstart_virt_addr) + ld r3,0(r3) + LOAD_REG_IMMEDIATE(r4, KERNELBASE) + cmpd r3,r4 + bne 4f + /* Clear out the BSS. It may have been done in prom_init, * already but that's irrelevant since prom_init will soon * be detached from the kernel completely. Besides, we need -- 2.34.1
From: Jason Yan <yanaijie@huawei.com> maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-... ------------------------------------------------- The original kernel still exists in the memory, clear it now. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/mm/nohash/kaslr_booke.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 1cfeeff3b73d..12c5b0926e2e 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -376,8 +376,10 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) unsigned long kernel_sz; if (IS_ENABLED(CONFIG_PPC64)) { - if (__run_at_load == 1) + if (__run_at_load == 1) { + kaslr_late_init(); return; + } /* Get the first memblock size */ early_get_first_memblock_info(dt_ptr, &size); -- 2.34.1
From: Jason Yan <yanaijie@huawei.com> maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: 109306 CVE: NA Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-... ------------------------------------------------- Now we support both 32 and 64 bit KASLR for fsl booke. Add document for 64 bit part and rename kaslr-booke32.rst to kaslr-booke.rst. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: GUO Zihua <guozihua@huawei.com> --- Documentation/powerpc/index.rst | 2 +- .../{kaslr-booke32.rst => kaslr-booke.rst} | 35 ++++++++++++++++--- 2 files changed, 32 insertions(+), 5 deletions(-) rename Documentation/powerpc/{kaslr-booke32.rst => kaslr-booke.rst} (59%) diff --git a/Documentation/powerpc/index.rst b/Documentation/powerpc/index.rst index a50834798454..5eae95a56f6e 100644 --- a/Documentation/powerpc/index.rst +++ b/Documentation/powerpc/index.rst @@ -24,7 +24,7 @@ powerpc hvcs imc isa-versions - kaslr-booke32 + kaslr-booke mpc52xx papr_hcalls pci_iov_resource_on_powernv diff --git a/Documentation/powerpc/kaslr-booke32.rst b/Documentation/powerpc/kaslr-booke.rst similarity index 59% rename from Documentation/powerpc/kaslr-booke32.rst rename to Documentation/powerpc/kaslr-booke.rst index 5681c1d1b65b..a908a42c457e 100644 --- a/Documentation/powerpc/kaslr-booke32.rst +++ b/Documentation/powerpc/kaslr-booke.rst @@ -1,15 +1,18 @@ .. SPDX-License-Identifier: GPL-2.0 -=========================== -KASLR for Freescale BookE32 -=========================== +========================= +KASLR for Freescale BookE +========================= The word KASLR stands for Kernel Address Space Layout Randomization. This document tries to explain the implementation of the KASLR for -Freescale BookE32. KASLR is a security feature that deters exploit +Freescale BookE. KASLR is a security feature that deters exploit attempts relying on knowledge of the location of kernel internals. +KASLR for Freescale BookE32 +------------------------- + Since CONFIG_RELOCATABLE has already supported, what we need to do is map or copy kernel to a proper place and relocate. Freescale Book-E parts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1 @@ -38,5 +41,29 @@ bit of the entropy to decide the index of the 64M zone. Then we chose a kernstart_virt_addr + +KASLR for Freescale BookE64 +--------------------------- + +The implementation for Freescale BookE64 is similar to BookE32. One +difference is that Freescale BookE64 set up a TLB mapping of 1G during +booting. Another difference is that ppc64 needs the kernel to be +64K-aligned. So we can randomize the kernel in this 1G mapping and make +it 64K-aligned. This can save some code to creat another TLB map at early +boot. The disadvantage is that we only have about 1G/64K = 16384 slots to +put the kernel in:: + + KERNELBASE + + 64K |--> kernel <--| + | | | + +--+--+--+ +--+--+--+--+--+--+--+--+--+ +--+--+ + | | | |....| | | | | | | | | |....| | | + +--+--+--+ +--+--+--+--+--+--+--+--+--+ +--+--+ + | | 1G + |-----> offset <-----| + + kernstart_virt_addr + To enable KASLR, set CONFIG_RANDOMIZE_BASE = y. If KASLR is enabled and you want to disable it at runtime, add "nokaslr" to the kernel cmdline. -- 2.34.1
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ -------------------------------- Value stored in r5 is an indication on whether the system is booted from PROM Of-type client-interface. It's value must be preserved and provided when booting relocated kernel. Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/kernel/exceptions-64e.S | 4 ++++ arch/powerpc/kernel/head_64.S | 9 +++++++++ 2 files changed, 13 insertions(+) diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 422971ca9322..be6e1fa07c21 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1576,4 +1576,8 @@ _GLOBAL(reloc_kernel_entry) mtspr SPRN_SRR0,r4 mtspr SPRN_SRR1,r7 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __is_prom) + lwz r5,0(r19) +#endif rfi diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 68592eec0e70..8ac22d56132b 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -120,6 +120,9 @@ __secondary_hold_acknowledge: .globl __kaslr_offset __kaslr_offset: .8byte 0x0 + .globl __is_prom +__is_prom: + .8byte 0x0 #endif /* This flag is set to 1 by a loader if the kernel should run @@ -541,6 +544,12 @@ __start_initialization_multiplatform: /* Poison TOC */ li r2,-1 +#ifdef CONFIG_RANDOMIZE_BASE + /* Store value in r5 for relocation */ + LOAD_REG_ADDR_PIC(r19, __is_prom) + stw r5,0(r19) +#endif + /* * Are we booted from a PROM Of-type client-interface ? */ -- 2.34.1
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ -------------------------------- The first 32k of memory is reserved for interrupt vectors, however for powerpc64 this is not enough. Fix this by reserving the real size of interrupt vectors. Signed-off-by: GUO Zihua <guozihua@huawei.com> --- arch/powerpc/kernel/prom.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c index 0b5878c3125b..e2e4b261e142 100644 --- a/arch/powerpc/kernel/prom.c +++ b/arch/powerpc/kernel/prom.c @@ -758,6 +758,7 @@ static inline void save_fscr_to_task(void) {} void __init early_init_devtree(void *params) { phys_addr_t limit; + size_t int_vector_size; DBG(" -> early_init_devtree(%px)\n", params); @@ -810,9 +811,12 @@ void __init early_init_devtree(void *params) setup_initial_memory_limit(memstart_addr, first_memblock_size); /* Reserve MEMBLOCK regions used by kernel, initrd, dt, etc... */ memblock_reserve(PHYSICAL_START, __pa(_end) - PHYSICAL_START); - /* If relocatable, reserve first 32k for interrupt vectors etc. */ + /* If relocatable, reserve at least 32k for interrupt vectors etc. */ + int_vector_size = (size_t)((uintptr_t)__end_interrupts - + (uintptr_t)_stext); + int_vector_size = max_t(size_t, 0x8000, int_vector_size); if (PHYSICAL_START > MEMORY_START) - memblock_reserve(MEMORY_START, 0x8000); + memblock_reserve(MEMORY_START, int_vector_size); reserve_kdump_trampoline(); #if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP) /* -- 2.34.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/3472 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/3472 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6...
participants (2)
-
GUO Zihua -
patchwork bot