From patchwork Tue Jun 6 12:32:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandre Ghiti X-Patchwork-Id: 103795 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp3368198vqr; Tue, 6 Jun 2023 05:50:32 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7pWlGx4KhrALCUko1EyvK8ILIMqY3SfvhigQdYeP4GgNyleWJSRUYwnIC/wyXsZrYdw0+E X-Received: by 2002:a05:6358:c61a:b0:129:b96c:1d2b with SMTP id fd26-20020a056358c61a00b00129b96c1d2bmr1519522rwb.28.1686055831921; Tue, 06 Jun 2023 05:50:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686055831; cv=none; d=google.com; s=arc-20160816; b=yz0PjsysyNJOcNd35MmmeXUhy+vMyV22L3XCd9ZgBgMjn5B1tv1Tx9piu5dWmnuZ2H mCLpQur1R9IChMbwOk87b/Eij+eMV5Yuv2qStZYE143DtwtI898MECDm47zoQgkmz4vD 7o//8QMt+s0590eDAPpjjOkEmurM1KtL3gsJRlLwxWhYxDKkdm4x1vjfQlg7RVOF8SmN MFdjrIiA+sWRYE26HXMQgZM9PvNdKKFRK9nR+kK54hhTsYnhACdPwWGPIHRQraxNop+r 48MSU6vwFC1Ru8JSKPLtbrO4HcbEEef2VaDi3qyr7Q9QpO2L+R522tZOcSjjP3ZWW6vd M57A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=BnN91fXmDihZm2BLm/f/mP83zFIlNhb/Ca5+/aWWSSg=; b=Z7Z8mm24OlVVJqwLhgHvbmqTd5YUl9iy3XbwfEGfTKd2f30qvTsYYFBndGIfFWPpyb K0bY2IKXIZnPlgfCZa2/XhF66lkVOFBheP1483zPyh/y6iO5nmfKgKOL+zoVRlksaQoi GNxImQwTjlNetKnTpwcXHW1u4kG7yUtaf3xgBnWdFzsNjpSDtWFK9x01BzLE7uS6nNst hfxrFn2c5RjibX+dECub4D869HMD6iDc0/sOqmWhQChRrOFQZPYlc0pcAMx4qMgeT686 9mFBY4R7x1AIvo62OieRTvmwLTgM0EgHipg978JMvcb3U1mcUygDr6VftWj+hHNHZDFO WCgg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@rivosinc-com.20221208.gappssmtp.com header.s=20221208 header.b=DjHNMYfn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id gm11-20020a17090b100b00b00252873f1500si8984636pjb.138.2023.06.06.05.50.19; Tue, 06 Jun 2023 05:50:31 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@rivosinc-com.20221208.gappssmtp.com header.s=20221208 header.b=DjHNMYfn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237279AbjFFMdv (ORCPT + 99 others); Tue, 6 Jun 2023 08:33:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34924 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235379AbjFFMdu (ORCPT ); Tue, 6 Jun 2023 08:33:50 -0400 Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EDC52E62 for ; Tue, 6 Jun 2023 05:33:48 -0700 (PDT) Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-30ae5f2ac94so6046313f8f.1 for ; Tue, 06 Jun 2023 05:33:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20221208.gappssmtp.com; s=20221208; t=1686054827; x=1688646827; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=BnN91fXmDihZm2BLm/f/mP83zFIlNhb/Ca5+/aWWSSg=; b=DjHNMYfnVKmIDhpjBDaOJLP5gcz6KrVkSS0at3qPu2HyrKf0xKyPT0aC2vW9EtAcEp B6ETpOAZdLtayPMOkfWOclcleWVFPVG2mla0roVmgdcq/WNwEc65awRGdQSZabnZjsgI MXsOHK09i3wUuVjgDkkzc2TuQzMBsa6YCzT2r8+4CjM0CxFj2+rofNtDGvWxA8GsUr+T VXNpoTEhH5lWIyWqzG5RPOHM/qguYywPrj/KhqGb5M8639RJciywAKFM1JZQiOJ1jB3q ai92KTWiHbWcq+lSpcSVM5daewIWjJoGC5ZAYHJtZyLIOpxTSGjrO/sTsuoEdb8w8MF4 akMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686054827; x=1688646827; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=BnN91fXmDihZm2BLm/f/mP83zFIlNhb/Ca5+/aWWSSg=; b=kXK24GLPJBqcGHbYkvOuDuVsfATcwjsGMvUs3pkK7c/CKl+/nwHHhsnGmDhYEqPpHY S+ePZRVuN+P7UEkAQ8npNFbWoQEBMBe8oQM8cd0aPI46pohyKbD+xHK7smIl9ev6iJXP KoBQi0rpaPVEpGvUIvSniCtcgzyez7qaRXmCUag+w+TQVBzucz4t4W0O0E+5NO5O8sHm WttfQapXEzzsRoaXmNjmy4SgqZ+S1+nog5G30Wng+HwjENBhpx3JYa3USsIeTJhUFJSw PMk6jao/cdXa+OM5RGrAHR+dxptdjhIq57VoEm1aqTJA0PEfakcUpOMDIc8FvISeSB2P Ra6A== X-Gm-Message-State: AC+VfDwwWUNJsWThVSQRxZxUybOdJ1oGQevczYpyHkWhR5EauHGrmIzN P0bA/IwfoV/usyiDQV3+Ls4+UqGhmzB5kxRpzCk= X-Received: by 2002:a05:6000:1972:b0:301:8551:446a with SMTP id da18-20020a056000197200b003018551446amr2020742wrb.2.1686054827418; Tue, 06 Jun 2023 05:33:47 -0700 (PDT) Received: from localhost.localdomain (amontpellier-656-1-456-62.w92-145.abo.wanadoo.fr. [92.145.124.62]) by smtp.gmail.com with ESMTPSA id k2-20020a5d4282000000b003047ea78b42sm12435513wrq.43.2023.06.06.05.33.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Jun 2023 05:33:47 -0700 (PDT) From: Alexandre Ghiti To: Paul Walmsley , Palmer Dabbelt , Albert Ou , Ard Biesheuvel , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: Alexandre Ghiti Subject: [PATCH v3 1/5] riscv: Introduce virtual kernel mapping KASLR Date: Tue, 6 Jun 2023 14:32:38 +0200 Message-Id: <20230606123242.20804-2-alexghiti@rivosinc.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230606123242.20804-1-alexghiti@rivosinc.com> References: <20230606123242.20804-1-alexghiti@rivosinc.com> MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767957680029838612?= X-GMAIL-MSGID: =?utf-8?q?1767957680029838612?= KASLR implementation relies on a relocatable kernel so that we can move the kernel mapping. The seed needed to virtually move the kernel is taken from the device tree, so we rely on the bootloader to provide a correct seed. Zkr could be used unconditionnally instead if implemented, but that's for another patch. Signed-off-by: Alexandre Ghiti --- arch/riscv/Kconfig | 19 +++++++++++++++ arch/riscv/include/asm/page.h | 3 +++ arch/riscv/kernel/pi/Makefile | 2 +- arch/riscv/kernel/pi/cmdline_early.c | 13 ++++++++++ arch/riscv/kernel/pi/fdt_early.c | 30 +++++++++++++++++++++++ arch/riscv/mm/init.c | 36 +++++++++++++++++++++++++++- 6 files changed, 101 insertions(+), 2 deletions(-) create mode 100644 arch/riscv/kernel/pi/fdt_early.c diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index 348c0fa1fc8c..c5d54f86fe5e 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -653,6 +653,25 @@ config RELOCATABLE If unsure, say N. +config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" + select RELOCATABLE + depends on MMU && 64BIT && !XIP_KERNEL + help + Randomizes the virtual address at which the kernel image is + loaded, as a security feature that deters exploit attempts + relying on knowledge of the location of kernel internals. + + It is the bootloader's job to provide entropy, by passing a + random u64 value in /chosen/kaslr-seed at kernel entry. + + When booting via the UEFI stub, it will invoke the firmware's + EFI_RNG_PROTOCOL implementation (if available) to supply entropy + to the kernel proper. In addition, it will randomise the physical + location of the kernel Image as well. + + If unsure, say N. + endmenu # "Kernel features" menu "Boot options" diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h index b55ba20903ec..5488ecc337b6 100644 --- a/arch/riscv/include/asm/page.h +++ b/arch/riscv/include/asm/page.h @@ -106,6 +106,7 @@ typedef struct page *pgtable_t; struct kernel_mapping { unsigned long page_offset; unsigned long virt_addr; + unsigned long virt_offset; uintptr_t phys_addr; uintptr_t size; /* Offset between linear mapping virtual address and kernel load address */ @@ -185,6 +186,8 @@ extern phys_addr_t __phys_addr_symbol(unsigned long x); #define sym_to_pfn(x) __phys_to_pfn(__pa_symbol(x)) +unsigned long kaslr_offset(void); + #endif /* __ASSEMBLY__ */ #define virt_addr_valid(vaddr) ({ \ diff --git a/arch/riscv/kernel/pi/Makefile b/arch/riscv/kernel/pi/Makefile index 7b593d44c712..07915dc9279e 100644 --- a/arch/riscv/kernel/pi/Makefile +++ b/arch/riscv/kernel/pi/Makefile @@ -35,5 +35,5 @@ $(obj)/string.o: $(srctree)/lib/string.c FORCE $(obj)/ctype.o: $(srctree)/lib/ctype.c FORCE $(call if_changed_rule,cc_o_c) -obj-y := cmdline_early.pi.o string.pi.o ctype.pi.o lib-fdt.pi.o lib-fdt_ro.pi.o +obj-y := cmdline_early.pi.o fdt_early.pi.o string.pi.o ctype.pi.o lib-fdt.pi.o lib-fdt_ro.pi.o extra-y := $(patsubst %.pi.o,%.o,$(obj-y)) diff --git a/arch/riscv/kernel/pi/cmdline_early.c b/arch/riscv/kernel/pi/cmdline_early.c index 05652d13c746..68e786c84c94 100644 --- a/arch/riscv/kernel/pi/cmdline_early.c +++ b/arch/riscv/kernel/pi/cmdline_early.c @@ -14,6 +14,7 @@ static char early_cmdline[COMMAND_LINE_SIZE]; * LLVM complain because the function is actually unused in this file). */ u64 set_satp_mode_from_cmdline(uintptr_t dtb_pa); +bool set_nokaslr_from_cmdline(uintptr_t dtb_pa); static char *get_early_cmdline(uintptr_t dtb_pa) { @@ -60,3 +61,15 @@ u64 set_satp_mode_from_cmdline(uintptr_t dtb_pa) return match_noXlvl(cmdline); } + +static bool match_nokaslr(char *cmdline) +{ + return strstr(cmdline, "nokaslr"); +} + +bool set_nokaslr_from_cmdline(uintptr_t dtb_pa) +{ + char *cmdline = get_early_cmdline(dtb_pa); + + return match_nokaslr(cmdline); +} diff --git a/arch/riscv/kernel/pi/fdt_early.c b/arch/riscv/kernel/pi/fdt_early.c new file mode 100644 index 000000000000..899610e042ab --- /dev/null +++ b/arch/riscv/kernel/pi/fdt_early.c @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include +#include +#include + +/* + * Declare the functions that are exported (but prefixed) here so that LLVM + * does not complain it lacks the 'static' keyword (which, if added, makes + * LLVM complain because the function is actually unused in this file). + */ +u64 get_kaslr_seed(uintptr_t dtb_pa); + +u64 get_kaslr_seed(uintptr_t dtb_pa) +{ + int node, len; + fdt64_t *prop; + u64 ret; + + node = fdt_path_offset((void *)dtb_pa, "/chosen"); + if (node < 0) + return 0; + + prop = fdt_getprop_w((void *)dtb_pa, node, "kaslr-seed", &len); + if (!prop || len != sizeof(u64)) + return 0; + + ret = fdt64_to_cpu(*prop); + *prop = 0; + return ret; +} diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c index 747e5b1ef02d..c61269853726 100644 --- a/arch/riscv/mm/init.c +++ b/arch/riscv/mm/init.c @@ -1011,11 +1011,45 @@ static void __init pt_ops_set_late(void) #endif } +#ifdef CONFIG_RANDOMIZE_BASE +extern bool __init __pi_set_nokaslr_from_cmdline(uintptr_t dtb_pa); +extern u64 __init __pi_get_kaslr_seed(uintptr_t dtb_pa); + +static int __init print_nokaslr(char *p) +{ + pr_info("Disabled KASLR"); + return 0; +} +early_param("nokaslr", print_nokaslr); + +unsigned long kaslr_offset(void) +{ + return kernel_map.virt_offset; +} +#endif + asmlinkage void __init setup_vm(uintptr_t dtb_pa) { pmd_t __maybe_unused fix_bmap_spmd, fix_bmap_epmd; - kernel_map.virt_addr = KERNEL_LINK_ADDR; +#ifdef CONFIG_RANDOMIZE_BASE + if (!__pi_set_nokaslr_from_cmdline(dtb_pa)) { + u64 kaslr_seed = __pi_get_kaslr_seed(dtb_pa); + u32 kernel_size = (uintptr_t)(&_end) - (uintptr_t)(&_start); + u32 nr_pos; + + /* + * Compute the number of positions available: we are limited + * by the early page table that only has one PUD and we must + * be aligned on PMD_SIZE. + */ + nr_pos = (PUD_SIZE - kernel_size) / PMD_SIZE; + + kernel_map.virt_offset = (kaslr_seed % nr_pos) * PMD_SIZE; + } +#endif + + kernel_map.virt_addr = KERNEL_LINK_ADDR + kernel_map.virt_offset; kernel_map.page_offset = _AC(CONFIG_PAGE_OFFSET, UL); #ifdef CONFIG_XIP_KERNEL