From: Jason Yan yanaijie@huawei.com

maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA

Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-...

-------------------------------------------------

Some code refactor in kaslr_legal_offset() and kaslr_early_init(). No functional change. This is a preparation for KASLR fsl_booke64.

Signed-off-by: Jason Yan yanaijie@huawei.com Cc: Scott Wood oss@buserror.net Cc: Diana Craciun diana.craciun@nxp.com Cc: Michael Ellerman mpe@ellerman.id.au Cc: Christophe Leroy christophe.leroy@c-s.fr Cc: Benjamin Herrenschmidt benh@kernel.crashing.org Cc: Paul Mackerras paulus@samba.org Cc: Nicholas Piggin npiggin@gmail.com Cc: Kees Cook keescook@chromium.org Signed-off-by: Cui GaoSheng cuigaosheng1@huawei.com Signed-off-by: GUO Zihua guozihua@huawei.com --- arch/powerpc/mm/nohash/kaslr_booke.c | 34 +++++++++++++++------------- 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 2fb3edafe9ab..08b5b90653ce 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -24,6 +24,7 @@ struct regions { unsigned long pa_start; unsigned long pa_end; unsigned long kernel_size; + unsigned long linear_sz; unsigned long dtb_start; unsigned long dtb_end; unsigned long initrd_start; @@ -254,11 +255,23 @@ static __init void get_cell_sizes(const void *fdt, int node, int *addr_cells, *size_cells = fdt32_to_cpu(*prop); }

-static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long index, - unsigned long offset) +static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long random) { unsigned long koffset = 0; unsigned long start; + unsigned long index; + unsigned long offset; + + /* + * Decide which 64M we want to start + * Only use the low 8 bits of the random seed + */ + index = random & 0xFF; + index %= regions.linear_sz / SZ_64M; + + /* Decide offset inside 64M */ + offset = random % (SZ_64M - regions.kernel_size); + offset = round_down(offset, SZ_16K);

while ((long)index >= 0) { offset = memstart_addr + index * SZ_64M + offset; @@ -283,10 +296,9 @@ static inline __init bool kaslr_disabled(void) static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size, unsigned long kernel_sz) { - unsigned long offset, random; + unsigned long random; unsigned long ram, linear_sz; u64 seed; - unsigned long index;

kaslr_get_cmdline(dt_ptr); if (kaslr_disabled()) @@ -327,22 +339,12 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size regions.dtb_start = __pa(dt_ptr); regions.dtb_end = __pa(dt_ptr) + fdt_totalsize(dt_ptr); regions.kernel_size = kernel_sz; + regions.linear_sz = linear_sz;

get_initrd_range(dt_ptr); get_crash_kernel(dt_ptr, ram);

- /* - * Decide which 64M we want to start - * Only use the low 8 bits of the random seed - */ - index = random & 0xFF; - index %= linear_sz / SZ_64M; - - /* Decide offset inside 64M */ - offset = random % (SZ_64M - kernel_sz); - offset = round_down(offset, SZ_16K); - - return kaslr_legal_offset(dt_ptr, index, offset); + return kaslr_legal_offset(dt_ptr, random); }

/*

From: Jason Yan yanaijie@huawei.com

maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA

Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-...

-------------------------------------------------

The implementation for Freescale BookE64 is similar as BookE32. One difference is that Freescale BookE64 set up a TLB mapping of 1G during booting. Another difference is that ppc64 needs the kernel to be 64K-aligned. So we can randomize the kernel in this 1G mapping and make it 64K-aligned. This can save some code to creat another TLB map at early boot. The disadvantage is that we only have about 1G/64K = 16384 slots to put the kernel in.

To support secondary cpu boot up, a variable __kaslr_offset was added in first_256B section. This can help secondary cpu get the kaslr offset before the 1:1 mapping has been setup.

Signed-off-by: Jason Yan yanaijie@huawei.com Cc: Scott Wood oss@buserror.net Cc: Diana Craciun diana.craciun@nxp.com Cc: Michael Ellerman mpe@ellerman.id.au Cc: Christophe Leroy christophe.leroy@c-s.fr Cc: Benjamin Herrenschmidt benh@kernel.crashing.org Cc: Paul Mackerras paulus@samba.org Cc: Nicholas Piggin npiggin@gmail.com Cc: Kees Cook keescook@chromium.org Signed-off-by: Cui GaoSheng cuigaosheng1@huawei.com Signed-off-by: GUO Zihua guozihua@huawei.com --- arch/powerpc/Kconfig | 5 +- arch/powerpc/kernel/exceptions-64e.S | 10 ++++ arch/powerpc/kernel/head_64.S | 6 +++ arch/powerpc/kernel/setup_64.c | 3 ++ arch/powerpc/mm/mmu_decl.h | 22 ++++---- arch/powerpc/mm/nohash/kaslr_booke.c | 75 +++++++++++++++++++--------- 6 files changed, 86 insertions(+), 35 deletions(-)

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index d5d5388973ac..c253be653876 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -660,14 +660,15 @@ config RELOCATABLE

config RANDOMIZE_BASE bool "Randomize the address of the kernel image" - depends on PPC_85xx && FLATMEM + depends on PPC_E500 && FLATMEM depends on RELOCATABLE + default n help Randomizes the virtual address at which the kernel image is loaded, as a security feature that deters exploit attempts relying on knowledge of the location of kernel internals.

- If unsure, say Y. + If unsure, say N.

config RELOCATABLE_TEST bool "Test relocatable kernel" diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 175d83c366e0..422971ca9322 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1249,6 +1249,7 @@ skpinv: addi r6,r6,1 /* Increment */ 1: mflr r6 addi r6,r6,(2f - 1b) tovirt(r6,r6) + add r6,r6,r19 lis r7,MSR_KERNEL@h ori r7,r7,MSR_KERNEL@l mtspr SPRN_SRR0,r6 @@ -1271,6 +1272,7 @@ skpinv: addi r6,r6,1 /* Increment */

/* We translate LR and return */ tovirt(r8,r8) + add r8,r8,r19 mtlr r8 blr

@@ -1403,6 +1405,7 @@ a2_tlbinit_code_end: */ _GLOBAL(start_initialization_book3e) mflr r28 + li r19, 0

/* First, we need to setup some initial TLBs to map the kernel * text, data and bss at PAGE_OFFSET. We don't have a real mode @@ -1445,6 +1448,12 @@ _GLOBAL(book3e_secondary_core_init) cmplwi r4,0 bne 2f

+ li r19, 0 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __kaslr_offset) + ld r19,0(r19) + rlwinm r19,r19,0,0,5 +#endif /* Setup TLB for this core */ bl initial_tlb_book3e

@@ -1477,6 +1486,7 @@ _GLOBAL(book3e_secondary_core_init) lis r3,PAGE_OFFSET@highest sldi r3,r3,32 or r28,r28,r3 + add r28,r28,r19 1: mtlr r28 blr

diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 4690c219bfa4..41d5cbd1e003 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -116,6 +116,12 @@ __secondary_hold_acknowledge: .8byte 0x0

#ifdef CONFIG_RELOCATABLE +#ifdef CONFIG_RANDOMIZE_BASE + .globl __kaslr_offset +__kaslr_offset: + .8byte 0x0 +#endif + /* This flag is set to 1 by a loader if the kernel should run * at the loaded address instead of the linked address. This * is used by kexec-tools to keep the kdump kernel in the diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c index 246201d0d879..15ece83ab7ac 100644 --- a/arch/powerpc/kernel/setup_64.c +++ b/arch/powerpc/kernel/setup_64.c @@ -70,6 +70,7 @@ #include <asm/early_ioremap.h> #include <asm/pgalloc.h>

+#include <mm/mmu_decl.h> #include "setup.h"

int spinning_secondaries; @@ -380,6 +381,8 @@ void __init early_setup(unsigned long dt_ptr) /* Enable early debugging if any specified (see udbg.h) */ udbg_early_init();

+ kaslr_early_init(__va(dt_ptr), 0); + udbg_printf(" -> %s(), dt_ptr: 0x%lx\n", __func__, dt_ptr);

/* diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h index a071825d5d8e..ba9d507999cd 100644 --- a/arch/powerpc/mm/mmu_decl.h +++ b/arch/powerpc/mm/mmu_decl.h @@ -119,23 +119,17 @@ extern unsigned long map_mem_in_cams(unsigned long ram, int max_cam_idx, extern void adjust_total_lowmem(void); extern int switch_to_as1(void); extern void restore_to_as0(int esel, int offset, void *dt_ptr, int bootcpu); -void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); void relocate_init(u64 dt_ptr, phys_addr_t start); -extern int is_second_reloc; #endif +void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); +extern int is_second_reloc; +extern unsigned long __kaslr_offset; +extern unsigned int __run_at_load;

void reloc_kernel_entry(void *fdt, long addr); extern void loadcam_entry(unsigned int index); extern void loadcam_multi(int first_idx, int num, int tmp_idx);

-#ifdef CONFIG_RANDOMIZE_BASE -void kaslr_early_init(void *dt_ptr, phys_addr_t size); -void kaslr_late_init(void); -#else -static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} -static inline void kaslr_late_init(void) {} -#endif - struct tlbcam { u32 MAS0; u32 MAS1; @@ -149,6 +143,14 @@ struct tlbcam { extern struct tlbcam TLBCAM[NUM_TLBCAMS]; #endif

+#ifdef CONFIG_RANDOMIZE_BASE +void kaslr_early_init(void *dt_ptr, phys_addr_t size); +void kaslr_late_init(void); +#else +static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} +static inline void kaslr_late_init(void) {} +#endif + #if defined(CONFIG_PPC_BOOK3S_32) || defined(CONFIG_PPC_85xx) || defined(CONFIG_PPC_8xx) /* 6xx have BATS */ /* PPC_85xx have TLBCAM */ diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 08b5b90653ce..1cfeeff3b73d 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -222,10 +222,11 @@ static __init unsigned long get_usable_address(const void *fdt, unsigned long start, unsigned long offset) { + unsigned long unit = IS_ENABLED(CONFIG_PPC32) ? SZ_16K : SZ_64K; unsigned long pa; unsigned long pa_end;

- for (pa = offset; (long)pa > (long)start; pa -= SZ_16K) { + for (pa = offset; (long)pa > (long)start; pa -= unit) { pa_end = pa + regions.kernel_size; if (overlaps_region(fdt, pa, pa_end)) continue; @@ -262,24 +263,34 @@ static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long rando unsigned long index; unsigned long offset;

- /* - * Decide which 64M we want to start - * Only use the low 8 bits of the random seed - */ - index = random & 0xFF; - index %= regions.linear_sz / SZ_64M; - - /* Decide offset inside 64M */ - offset = random % (SZ_64M - regions.kernel_size); - offset = round_down(offset, SZ_16K); + if (IS_ENABLED(CONFIG_PPC32)) { + /* + * Decide which 64M we want to start + * Only use the low 8 bits of the random seed + */ + index = random & 0xFF; + index %= regions.linear_sz / SZ_64M; + + /* Decide offset inside 64M */ + offset = random % (SZ_64M - regions.kernel_size); + offset = round_down(offset, SZ_16K); + + while ((long)index >= 0) { + offset = memstart_addr + index * SZ_64M + offset; + start = memstart_addr + index * SZ_64M; + koffset = get_usable_address(dt_ptr, start, offset); + if (koffset) + break; + index--; + } + } else { + /* Decide kernel offset inside 1G */ + offset = random % (regions.linear_sz - regions.kernel_size); + offset = round_down(offset, SZ_64K);

- while ((long)index >= 0) { - offset = memstart_addr + index * SZ_64M + offset; - start = memstart_addr + index * SZ_64M; + start = memstart_addr; + offset = memstart_addr + offset; koffset = get_usable_address(dt_ptr, start, offset); - if (koffset) - break; - index--; }

if (koffset != 0) @@ -319,6 +330,7 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size else pr_warn("KASLR: No safe seed for randomizing the kernel base.\n");

+#ifdef CONFIG_PPC32 ram = min_t(phys_addr_t, __max_low_memory, size); ram = map_mem_in_cams(ram, CONFIG_LOWMEM_CAM_NUM, true, true); linear_sz = min_t(unsigned long, ram, SZ_512M); @@ -326,6 +338,10 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size /* If the linear size is smaller than 64M, do not randomize */ if (linear_sz < SZ_64M) return 0; +#else + ram = size; + linear_sz = min_t(unsigned long, size, SZ_1G); +#endif

/* check for a reserved-memory node and record its cell sizes */ regions.reserved_mem = fdt_path_offset(dt_ptr, "/reserved-memory"); @@ -359,6 +375,14 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) unsigned long offset; unsigned long kernel_sz;

+ if (IS_ENABLED(CONFIG_PPC64)) { + if (__run_at_load == 1) + return; + + /* Get the first memblock size */ + early_get_first_memblock_info(dt_ptr, &size); + } + kernel_sz = (unsigned long)_end - (unsigned long)_stext;

offset = kaslr_choose_location(dt_ptr, size, kernel_sz); @@ -368,14 +392,19 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) kernstart_virt_addr += offset; kernstart_addr += offset;

- is_second_reloc = 1; + if (IS_ENABLED(CONFIG_PPC32)) { + is_second_reloc = 1;

- if (offset >= SZ_64M) { - tlb_virt = round_down(kernstart_virt_addr, SZ_64M); - tlb_phys = round_down(kernstart_addr, SZ_64M); + if (offset >= SZ_64M) { + tlb_virt = round_down(kernstart_virt_addr, SZ_64M); + tlb_phys = round_down(kernstart_addr, SZ_64M);

- /* Create kernel map to relocate in */ - create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + /* Create kernel map to relocate in */ + create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + } + } else { + __kaslr_offset = kernstart_virt_addr - KERNELBASE; + __run_at_load = 1; }

/* Copy the kernel to it's new location and run */

From: Jason Yan yanaijie@huawei.com

maillist inclusion category: feature feature: PowerPC64 kaslr support bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ CVE: NA

Reference: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/20200330022023.3691-...

-------------------------------------------------

The original kernel still exists in the memory, clear it now.

Signed-off-by: Jason Yan yanaijie@huawei.com Cc: Scott Wood oss@buserror.net Cc: Diana Craciun diana.craciun@nxp.com Cc: Michael Ellerman mpe@ellerman.id.au Cc: Christophe Leroy christophe.leroy@c-s.fr Cc: Benjamin Herrenschmidt benh@kernel.crashing.org Cc: Paul Mackerras paulus@samba.org Cc: Nicholas Piggin npiggin@gmail.com Cc: Kees Cook keescook@chromium.org Signed-off-by: Cui GaoSheng cuigaosheng1@huawei.com Signed-off-by: GUO Zihua guozihua@huawei.com --- arch/powerpc/mm/nohash/kaslr_booke.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 1cfeeff3b73d..12c5b0926e2e 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -376,8 +376,10 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) unsigned long kernel_sz;

if (IS_ENABLED(CONFIG_PPC64)) { - if (__run_at_load == 1) + if (__run_at_load == 1) { + kaslr_late_init(); return; + }

/* Get the first memblock size */ early_get_first_memblock_info(dt_ptr, &size);

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8OHAZ

--------------------------------

Value stored in r5 is an indication on whether the system is booted from PROM Of-type client-interface. It's value must be preserved and provided when booting relocated kernel.

Signed-off-by: GUO Zihua guozihua@huawei.com --- arch/powerpc/kernel/exceptions-64e.S | 4 ++++ arch/powerpc/kernel/head_64.S | 9 +++++++++ 2 files changed, 13 insertions(+)

diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 422971ca9322..be6e1fa07c21 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1576,4 +1576,8 @@ _GLOBAL(reloc_kernel_entry)

mtspr SPRN_SRR0,r4 mtspr SPRN_SRR1,r7 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __is_prom) + lwz r5,0(r19) +#endif rfi diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 68592eec0e70..8ac22d56132b 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -120,6 +120,9 @@ __secondary_hold_acknowledge: .globl __kaslr_offset __kaslr_offset: .8byte 0x0 + .globl __is_prom +__is_prom: + .8byte 0x0 #endif

/* This flag is set to 1 by a loader if the kernel should run @@ -541,6 +544,12 @@ __start_initialization_multiplatform: /* Poison TOC */ li r2,-1

+#ifdef CONFIG_RANDOMIZE_BASE + /* Store value in r5 for relocation */ + LOAD_REG_ADDR_PIC(r19, __is_prom) + stw r5,0(r19) +#endif + /* * Are we booted from a PROM Of-type client-interface ? */