From patchwork Tue Feb 7 14:28:22 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xi Ruoyao X-Patchwork-Id: 53949 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:2388:b0:96:219d:e725 with SMTP id i8csp4046369dyf; Tue, 7 Feb 2023 06:35:35 -0800 (PST) X-Google-Smtp-Source: AK7set/wcsjsBrO85yrzFUs5E0suYLs1HcfSX/T//iUUpIiiCtHjmKZ437u/D8vul7MLBzNxL5P7 X-Received: by 2002:a17:902:ecc4:b0:199:2a8d:d682 with SMTP id a4-20020a170902ecc400b001992a8dd682mr3132734plh.51.1675780535731; Tue, 07 Feb 2023 06:35:35 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1675780535; cv=none; d=google.com; s=arc-20160816; b=TupnFEGGmrXjnNteYwVMMYl6qetNBvxq1SZ1QlSdzZSjzGFzWXkQvGgkHb8jMWIrmw Rg6r3PQmlqAlX0CO3k0R0FxJEY5UeI/z/WI5qRp3iTOCXjnmyUqLS0z0QMD9Sitfe8Jt b6u/JIZ8x4tb38qlMOZm6uTAzvtuEaJjKrQ5X02kjFgcylnyeLxyLcbVu8XjTX6m//Q0 ikXZ77B2yd3QCot6fBYa/dMADuEDptMv0KrV7xUtEYIY+oiqtexvo4UIQSst0RelkmkY h1b15xVykwhF+X7bO03wcFjuuRaDL2aeoWivg9z2y0ONbmxfqK2jPiZ2Kalh0fAD/0iU gHYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=1AP7xvkusJnzoxNcI5s3wu8i1VRenhY8iS7tvcJR7fY=; b=aTcg/fmQiGpNgrZmw/egdxzbq86JaVQSECjeTMTpvON0RubVi9nKPdKUune8JAVQ60 K+7KDyZHKbtqidZaS3/aUm6/6oVdazcacLGPrtXIp1jBcwy+fk/P1Tz4ISWegyuFTnOE lyS6/UUyW16Lkjw0LVe+MpOjLMb+7AAp2QT9EUiy/j9Dzu3Fu7K8+dkvWQMfdKumGDxA C4JQ4R03uRjyLS6MnKVC7n0yIyZTo4AqF+1i+6KqpovJGkWkJ/6f+LTA8y8oALWXhOBM C15Yz+7JVvijOhChghxdzXPmv1wVlSMEM4gpNGgDumT6cnhrP96SctYZpPk6tHfm/cKm P0EA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@xry111.site header.s=default header.b="DB6T/rgR"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=xry111.site Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q3-20020a17090311c300b00188a7401d89si16468316plh.481.2023.02.07.06.35.22; Tue, 07 Feb 2023 06:35:35 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@xry111.site header.s=default header.b="DB6T/rgR"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=xry111.site Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232781AbjBGOdn (ORCPT + 99 others); Tue, 7 Feb 2023 09:33:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232782AbjBGOcy (ORCPT ); Tue, 7 Feb 2023 09:32:54 -0500 Received: from xry111.site (xry111.site [89.208.246.23]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3164A3E635 for ; Tue, 7 Feb 2023 06:30:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=xry111.site; s=default; t=1675780204; bh=bYU8i2vMnFWlU7t8bvGKvgBRgI3/rqYbEk0nKv8UPc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DB6T/rgR/D1PBLoQu7/6ZZbYa/q0dP02qSY3OZG9phC2MLiiZyOF0873zkMOum+z8 lf9WSbzcAb549qBYJ3WzJujD2HV7Zqh+tGeaen2GREHF3tGNcxmutODkeunmMAGgE6 UXXrQLjnRWYL54jd8O3nagbsw+oGbkVABQKWs6eo= Received: from xry111-x57s1.. (unknown [IPv6:240e:358:11cc:4100:dc73:854d:832e:2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (Client did not present a certificate) (Authenticated sender: xry111@xry111.site) by xry111.site (Postfix) with ESMTPSA id A369E65DC6; Tue, 7 Feb 2023 09:29:57 -0500 (EST) From: Xi Ruoyao To: Youling Tang , Huacai Chen , Jinyang He Cc: Xuerui Wang , loongarch@lists.linux.dev, linux-kernel@vger.kernel.org, Xi Ruoyao Subject: [PATCH v2 5/5] LoongArch: Add support for kernel address space layout randomization (KASLR) Date: Tue, 7 Feb 2023 22:28:22 +0800 Message-Id: <20230207142822.52172-6-xry111@xry111.site> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230207142822.52172-1-xry111@xry111.site> References: <20230207142822.52172-1-xry111@xry111.site> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1757183251076088034?= X-GMAIL-MSGID: =?utf-8?q?1757183251076088034?= From: Youling Tang This patch adds support for relocating the kernel to a random address. Entropy is derived from the banner, which will change every build and random_get_entropy() which should provide additional runtime entropy. The kernel is relocated by up to RANDOMIZE_BASE_MAX_OFFSET bytes from its link address. Because relocation happens so early in the kernel boot, the amount of physical memory has not yet been determined. This means the only way to limit relocation within the available memory is via Kconfig. Limit the maximum value of RANDOMIZE_BASE_MAX_OFFSET to 256M(0x10000000) because our memory layout has many holes. KERNELOFFSET (kaslr_offset) is added to vmcoreinfo in the future, for crash --kaslr support. Signed-off-by: Youling Tang Signed-off-by: Xi Ruoyao # Use arch_initcall --- arch/loongarch/Kconfig | 22 ++++++ arch/loongarch/include/asm/page.h | 6 ++ arch/loongarch/kernel/relocate.c | 115 ++++++++++++++++++++++++++++++ arch/loongarch/kernel/setup.c | 3 + 4 files changed, 146 insertions(+) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index db83f71ba1c0..4ceb16ce080a 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -489,6 +489,28 @@ config RELOCATABLE kernel binary at runtime to a different virtual address than the address it was linked at. +config RANDOMIZE_BASE + bool "Randomize the address of the kernel image (KASLR)" + depends on RELOCATABLE + help + Randomizes the physical and virtual address at which the + kernel image is loaded, as a security feature that + deters exploit attempts relying on knowledge of the location + of kernel internals. + + The kernel will be offset by up to RANDOMIZE_BASE_MAX_OFFSET. + + If unsure, say N. + +config RANDOMIZE_BASE_MAX_OFFSET + hex "Maximum KASLR offset" if EXPERT + depends on RANDOMIZE_BASE + range 0x0 0x10000000 if 64BIT + default "0x01000000" + help + When KASLR is active, this provides the maximum offset that will + be applied to the kernel image. + config SECCOMP bool "Enable seccomp to safely compute untrusted bytecode" depends on PROC_FS diff --git a/arch/loongarch/include/asm/page.h b/arch/loongarch/include/asm/page.h index 53f284a96182..6dda0d6271ca 100644 --- a/arch/loongarch/include/asm/page.h +++ b/arch/loongarch/include/asm/page.h @@ -106,6 +106,12 @@ extern int __virt_addr_valid(volatile void *kaddr); ((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \ VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) +extern unsigned long __kaslr_offset; +static inline unsigned long kaslr_offset(void) +{ + return __kaslr_offset; +} + #include #include diff --git a/arch/loongarch/kernel/relocate.c b/arch/loongarch/kernel/relocate.c index 9c61e03d3e91..351168b70b7a 100644 --- a/arch/loongarch/kernel/relocate.c +++ b/arch/loongarch/kernel/relocate.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include @@ -19,6 +20,70 @@ extern long __rela_dyn_start; extern long __rela_dyn_end; +#ifdef CONFIG_RANDOMIZE_BASE + +static inline __init unsigned long rotate_xor(unsigned long hash, + const void *area, size_t size) +{ + size_t i; + unsigned long *ptr = (unsigned long *)area; + + for (i = 0; i < size / sizeof(hash); i++) { + /* Rotate by odd number of bits and XOR. */ + hash = (hash << ((sizeof(hash) * 8) - 7)) | (hash >> 7); + hash ^= ptr[i]; + } + + return hash; +} + +static inline __init unsigned long get_random_boot(void) +{ + unsigned long entropy = random_get_entropy(); + unsigned long hash = 0; + + /* Attempt to create a simple but unpredictable starting entropy. */ + hash = rotate_xor(hash, linux_banner, strlen(linux_banner)); + + /* Add in any runtime entropy we can get */ + hash = rotate_xor(hash, &entropy, sizeof(entropy)); + + return hash; +} + +static inline __init bool kaslr_disabled(void) +{ + char *str; + + str = strstr(boot_command_line, "nokaslr"); + if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' ')) + return true; + + return false; +} + +/* Choose a new address for the kernel */ +static inline void __init *determine_relocation_address(void) +{ + unsigned long kernel_length; + void *dest = _text; + unsigned long offset; + + if (kaslr_disabled()) + return dest; + + kernel_length = (long)_end - (long)_text; + + offset = get_random_boot() << 16; + offset &= (CONFIG_RANDOMIZE_BASE_MAX_OFFSET - 1); + if (offset < kernel_length) + offset += ALIGN(kernel_length, 0xffff); + + return RELOCATED(dest); +} + +#else + /* * Choose a new address for the kernel, for now we'll hard * code the destination. @@ -28,6 +93,8 @@ static inline void __init *determine_relocation_address(void) return (void *)(CACHE_BASE + 0x02000000); } +#endif + static inline int __init relocation_addr_valid(void *loc_new) { if ((unsigned long)loc_new & 0x0000ffff) { @@ -41,6 +108,13 @@ static inline int __init relocation_addr_valid(void *loc_new) return 1; } +static inline void __init update_kaslr_offset(unsigned long *addr, long offset) +{ + unsigned long *new_addr = (unsigned long *)RELOCATED(addr); + + *new_addr = (unsigned long)offset; +} + void *__init relocate_kernel(void) { Elf64_Rela *rela, *rela_end; @@ -49,6 +123,10 @@ void *__init relocate_kernel(void) long offset = 0; /* Default to original kernel entry point */ void *kernel_entry = start_kernel; + char *cmdline = early_ioremap(fw_arg1, COMMAND_LINE_SIZE); + + /* Boot command line was passed in fw_arg1 */ + strscpy(boot_command_line, cmdline, COMMAND_LINE_SIZE); kernel_length = (long)(_end) - (long)(_text); @@ -90,7 +168,44 @@ void *__init relocate_kernel(void) /* Return the new kernel's entry point */ kernel_entry = RELOCATED(start_kernel); + + /* Error may occur before, so keep it at last */ + update_kaslr_offset(&__kaslr_offset, offset); } return kernel_entry; } + +/* + * Show relocation information on panic. + */ +static void show_kernel_relocation(const char *level) +{ + if (__kaslr_offset > 0) { + printk(level); + pr_cont("Kernel relocated offset @ 0x%lx\n", __kaslr_offset); + pr_cont(" .text @ 0x%lx\n", (unsigned long)&_text); + pr_cont(" .data @ 0x%lx\n", (unsigned long)&_sdata); + pr_cont(" .bss @ 0x%lx\n", (unsigned long)&__bss_start); + } +} + +static int kernel_location_notifier_fn(struct notifier_block *self, + unsigned long v, void *p) +{ + show_kernel_relocation(KERN_EMERG); + return NOTIFY_DONE; +} + +static struct notifier_block kernel_location_notifier = { + .notifier_call = kernel_location_notifier_fn +}; + +static int __init register_kernel_offset_dumper(void) +{ + atomic_notifier_chain_register(&panic_notifier_list, + &kernel_location_notifier); + return 0; +} + +arch_initcall(register_kernel_offset_dumper); diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c index 4344502c0b31..b2ba2741945c 100644 --- a/arch/loongarch/kernel/setup.c +++ b/arch/loongarch/kernel/setup.c @@ -82,6 +82,9 @@ static struct resource code_resource = { .name = "Kernel code", }; static struct resource data_resource = { .name = "Kernel data", }; static struct resource bss_resource = { .name = "Kernel bss", }; +unsigned long __kaslr_offset __ro_after_init; +EXPORT_SYMBOL(__kaslr_offset); + const char *get_system_type(void) { return "generic-loongson-machine";