From: Jason Yan yanaijie@huawei.com
maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: 109306 CVE: NA
Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-...
-------------------------------------------------
The implementation for Freescale BookE64 is similar as BookE32. One difference is that Freescale BookE64 set up a TLB mapping of 1G during booting. Another difference is that ppc64 needs the kernel to be 64K-aligned. So we can randomize the kernel in this 1G mapping and make it 64K-aligned. This can save some code to creat another TLB map at early boot. The disadvantage is that we only have about 1G/64K = 16384 slots to put the kernel in.
To support secondary cpu boot up, a variable __kaslr_offset was added in first_256B section. This can help secondary cpu get the kaslr offset before the 1:1 mapping has been setup.
Signed-off-by: Jason Yan yanaijie@huawei.com Cc: Scott Wood oss@buserror.net Cc: Diana Craciun diana.craciun@nxp.com Cc: Michael Ellerman mpe@ellerman.id.au Cc: Christophe Leroy christophe.leroy@c-s.fr Cc: Benjamin Herrenschmidt benh@kernel.crashing.org Cc: Paul Mackerras paulus@samba.org Cc: Nicholas Piggin npiggin@gmail.com Cc: Kees Cook keescook@chromium.org Signed-off-by: Cui GaoSheng cuigaosheng1@huawei.com Signed-off-by: GUO Zihua guozihua@huawei.com --- arch/powerpc/Kconfig | 5 +- arch/powerpc/kernel/exceptions-64e.S | 10 ++++ arch/powerpc/kernel/head_64.S | 6 +++ arch/powerpc/kernel/setup_64.c | 3 ++ arch/powerpc/mm/mmu_decl.h | 22 ++++---- arch/powerpc/mm/nohash/kaslr_booke.c | 75 +++++++++++++++++++--------- 6 files changed, 86 insertions(+), 35 deletions(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index d5d5388973ac..c253be653876 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -660,14 +660,15 @@ config RELOCATABLE
config RANDOMIZE_BASE bool "Randomize the address of the kernel image" - depends on PPC_85xx && FLATMEM + depends on PPC_E500 && FLATMEM depends on RELOCATABLE + default n help Randomizes the virtual address at which the kernel image is loaded, as a security feature that deters exploit attempts relying on knowledge of the location of kernel internals.
- If unsure, say Y. + If unsure, say N.
config RELOCATABLE_TEST bool "Test relocatable kernel" diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 175d83c366e0..422971ca9322 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1249,6 +1249,7 @@ skpinv: addi r6,r6,1 /* Increment */ 1: mflr r6 addi r6,r6,(2f - 1b) tovirt(r6,r6) + add r6,r6,r19 lis r7,MSR_KERNEL@h ori r7,r7,MSR_KERNEL@l mtspr SPRN_SRR0,r6 @@ -1271,6 +1272,7 @@ skpinv: addi r6,r6,1 /* Increment */
/* We translate LR and return */ tovirt(r8,r8) + add r8,r8,r19 mtlr r8 blr
@@ -1403,6 +1405,7 @@ a2_tlbinit_code_end: */ _GLOBAL(start_initialization_book3e) mflr r28 + li r19, 0
/* First, we need to setup some initial TLBs to map the kernel * text, data and bss at PAGE_OFFSET. We don't have a real mode @@ -1445,6 +1448,12 @@ _GLOBAL(book3e_secondary_core_init) cmplwi r4,0 bne 2f
+ li r19, 0 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __kaslr_offset) + ld r19,0(r19) + rlwinm r19,r19,0,0,5 +#endif /* Setup TLB for this core */ bl initial_tlb_book3e
@@ -1477,6 +1486,7 @@ _GLOBAL(book3e_secondary_core_init) lis r3,PAGE_OFFSET@highest sldi r3,r3,32 or r28,r28,r3 + add r28,r28,r19 1: mtlr r28 blr
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 4690c219bfa4..41d5cbd1e003 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -116,6 +116,12 @@ __secondary_hold_acknowledge: .8byte 0x0
#ifdef CONFIG_RELOCATABLE +#ifdef CONFIG_RANDOMIZE_BASE + .globl __kaslr_offset +__kaslr_offset: + .8byte 0x0 +#endif + /* This flag is set to 1 by a loader if the kernel should run * at the loaded address instead of the linked address. This * is used by kexec-tools to keep the kdump kernel in the diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c index 246201d0d879..15ece83ab7ac 100644 --- a/arch/powerpc/kernel/setup_64.c +++ b/arch/powerpc/kernel/setup_64.c @@ -70,6 +70,7 @@ #include <asm/early_ioremap.h> #include <asm/pgalloc.h>
+#include <mm/mmu_decl.h> #include "setup.h"
int spinning_secondaries; @@ -380,6 +381,8 @@ void __init early_setup(unsigned long dt_ptr) /* Enable early debugging if any specified (see udbg.h) */ udbg_early_init();
+ kaslr_early_init(__va(dt_ptr), 0); + udbg_printf(" -> %s(), dt_ptr: 0x%lx\n", __func__, dt_ptr);
/* diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h index a071825d5d8e..ba9d507999cd 100644 --- a/arch/powerpc/mm/mmu_decl.h +++ b/arch/powerpc/mm/mmu_decl.h @@ -119,23 +119,17 @@ extern unsigned long map_mem_in_cams(unsigned long ram, int max_cam_idx, extern void adjust_total_lowmem(void); extern int switch_to_as1(void); extern void restore_to_as0(int esel, int offset, void *dt_ptr, int bootcpu); -void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); void relocate_init(u64 dt_ptr, phys_addr_t start); -extern int is_second_reloc; #endif +void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); +extern int is_second_reloc; +extern unsigned long __kaslr_offset; +extern unsigned int __run_at_load;
void reloc_kernel_entry(void *fdt, long addr); extern void loadcam_entry(unsigned int index); extern void loadcam_multi(int first_idx, int num, int tmp_idx);
-#ifdef CONFIG_RANDOMIZE_BASE -void kaslr_early_init(void *dt_ptr, phys_addr_t size); -void kaslr_late_init(void); -#else -static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} -static inline void kaslr_late_init(void) {} -#endif - struct tlbcam { u32 MAS0; u32 MAS1; @@ -149,6 +143,14 @@ struct tlbcam { extern struct tlbcam TLBCAM[NUM_TLBCAMS]; #endif
+#ifdef CONFIG_RANDOMIZE_BASE +void kaslr_early_init(void *dt_ptr, phys_addr_t size); +void kaslr_late_init(void); +#else +static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} +static inline void kaslr_late_init(void) {} +#endif + #if defined(CONFIG_PPC_BOOK3S_32) || defined(CONFIG_PPC_85xx) || defined(CONFIG_PPC_8xx) /* 6xx have BATS */ /* PPC_85xx have TLBCAM */ diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 08b5b90653ce..1cfeeff3b73d 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -222,10 +222,11 @@ static __init unsigned long get_usable_address(const void *fdt, unsigned long start, unsigned long offset) { + unsigned long unit = IS_ENABLED(CONFIG_PPC32) ? SZ_16K : SZ_64K; unsigned long pa; unsigned long pa_end;
- for (pa = offset; (long)pa > (long)start; pa -= SZ_16K) { + for (pa = offset; (long)pa > (long)start; pa -= unit) { pa_end = pa + regions.kernel_size; if (overlaps_region(fdt, pa, pa_end)) continue; @@ -262,24 +263,34 @@ static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long rando unsigned long index; unsigned long offset;
- /* - * Decide which 64M we want to start - * Only use the low 8 bits of the random seed - */ - index = random & 0xFF; - index %= regions.linear_sz / SZ_64M; - - /* Decide offset inside 64M */ - offset = random % (SZ_64M - regions.kernel_size); - offset = round_down(offset, SZ_16K); + if (IS_ENABLED(CONFIG_PPC32)) { + /* + * Decide which 64M we want to start + * Only use the low 8 bits of the random seed + */ + index = random & 0xFF; + index %= regions.linear_sz / SZ_64M; + + /* Decide offset inside 64M */ + offset = random % (SZ_64M - regions.kernel_size); + offset = round_down(offset, SZ_16K); + + while ((long)index >= 0) { + offset = memstart_addr + index * SZ_64M + offset; + start = memstart_addr + index * SZ_64M; + koffset = get_usable_address(dt_ptr, start, offset); + if (koffset) + break; + index--; + } + } else { + /* Decide kernel offset inside 1G */ + offset = random % (regions.linear_sz - regions.kernel_size); + offset = round_down(offset, SZ_64K);
- while ((long)index >= 0) { - offset = memstart_addr + index * SZ_64M + offset; - start = memstart_addr + index * SZ_64M; + start = memstart_addr; + offset = memstart_addr + offset; koffset = get_usable_address(dt_ptr, start, offset); - if (koffset) - break; - index--; }
if (koffset != 0) @@ -319,6 +330,7 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size else pr_warn("KASLR: No safe seed for randomizing the kernel base.\n");
+#ifdef CONFIG_PPC32 ram = min_t(phys_addr_t, __max_low_memory, size); ram = map_mem_in_cams(ram, CONFIG_LOWMEM_CAM_NUM, true, true); linear_sz = min_t(unsigned long, ram, SZ_512M); @@ -326,6 +338,10 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size /* If the linear size is smaller than 64M, do not randomize */ if (linear_sz < SZ_64M) return 0; +#else + ram = size; + linear_sz = min_t(unsigned long, size, SZ_1G); +#endif
/* check for a reserved-memory node and record its cell sizes */ regions.reserved_mem = fdt_path_offset(dt_ptr, "/reserved-memory"); @@ -359,6 +375,14 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) unsigned long offset; unsigned long kernel_sz;
+ if (IS_ENABLED(CONFIG_PPC64)) { + if (__run_at_load == 1) + return; + + /* Get the first memblock size */ + early_get_first_memblock_info(dt_ptr, &size); + } + kernel_sz = (unsigned long)_end - (unsigned long)_stext;
offset = kaslr_choose_location(dt_ptr, size, kernel_sz); @@ -368,14 +392,19 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) kernstart_virt_addr += offset; kernstart_addr += offset;
- is_second_reloc = 1; + if (IS_ENABLED(CONFIG_PPC32)) { + is_second_reloc = 1;
- if (offset >= SZ_64M) { - tlb_virt = round_down(kernstart_virt_addr, SZ_64M); - tlb_phys = round_down(kernstart_addr, SZ_64M); + if (offset >= SZ_64M) { + tlb_virt = round_down(kernstart_virt_addr, SZ_64M); + tlb_phys = round_down(kernstart_addr, SZ_64M);
- /* Create kernel map to relocate in */ - create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + /* Create kernel map to relocate in */ + create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + } + } else { + __kaslr_offset = kernstart_virt_addr - KERNELBASE; + __run_at_load = 1; }
/* Copy the kernel to it's new location and run */