diff --git a/Documentation/powerpc/index.rst b/Documentation/powerpc/index.rst index a5083479845432d0e0d368dd6936e0d2d18a6836..5eae95a56f6e81c51ece3f6c95267086a6f8cc07 100644 --- a/Documentation/powerpc/index.rst +++ b/Documentation/powerpc/index.rst @@ -24,7 +24,7 @@ powerpc hvcs imc isa-versions - kaslr-booke32 + kaslr-booke mpc52xx papr_hcalls pci_iov_resource_on_powernv diff --git a/Documentation/powerpc/kaslr-booke32.rst b/Documentation/powerpc/kaslr-booke.rst similarity index 59% rename from Documentation/powerpc/kaslr-booke32.rst rename to Documentation/powerpc/kaslr-booke.rst index 5681c1d1b65b5de80ecc3b9b12e0d6cd8c78e448..a908a42c457ea3d34924e86603a94a6ec7c3d2ab 100644 --- a/Documentation/powerpc/kaslr-booke32.rst +++ b/Documentation/powerpc/kaslr-booke.rst @@ -1,15 +1,18 @@ .. SPDX-License-Identifier: GPL-2.0 -=========================== -KASLR for Freescale BookE32 -=========================== +========================= +KASLR for Freescale BookE +========================= The word KASLR stands for Kernel Address Space Layout Randomization. This document tries to explain the implementation of the KASLR for -Freescale BookE32. KASLR is a security feature that deters exploit +Freescale BookE. KASLR is a security feature that deters exploit attempts relying on knowledge of the location of kernel internals. +KASLR for Freescale BookE32 +------------------------- + Since CONFIG_RELOCATABLE has already supported, what we need to do is map or copy kernel to a proper place and relocate. Freescale Book-E parts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1 @@ -38,5 +41,29 @@ bit of the entropy to decide the index of the 64M zone. Then we chose a kernstart_virt_addr + +KASLR for Freescale BookE64 +--------------------------- + +The implementation for Freescale BookE64 is similar to BookE32. One +difference is that Freescale BookE64 set up a TLB mapping of 1G during +booting. Another difference is that ppc64 needs the kernel to be +64K-aligned. So we can randomize the kernel in this 1G mapping and make +it 64K-aligned. This can save some code to creat another TLB map at early +boot. The disadvantage is that we only have about 1G/64K = 16384 slots to +put the kernel in:: + + KERNELBASE + + 64K |--> kernel <--| + | | | + +--+--+--+ +--+--+--+--+--+--+--+--+--+ +--+--+ + | | | |....| | | | | | | | | |....| | | + +--+--+--+ +--+--+--+--+--+--+--+--+--+ +--+--+ + | | 1G + |-----> offset <-----| + + kernstart_virt_addr + To enable KASLR, set CONFIG_RANDOMIZE_BASE = y. If KASLR is enabled and you want to disable it at runtime, add "nokaslr" to the kernel cmdline. diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index d5d5388973ac7612fd8bbc5467d37ecf805b3f46..c253be653876b207e22d66f7cc798d8d89178afa 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -660,14 +660,15 @@ config RELOCATABLE config RANDOMIZE_BASE bool "Randomize the address of the kernel image" - depends on PPC_85xx && FLATMEM + depends on PPC_E500 && FLATMEM depends on RELOCATABLE + default n help Randomizes the virtual address at which the kernel image is loaded, as a security feature that deters exploit attempts relying on knowledge of the location of kernel internals. - If unsure, say Y. + If unsure, say N. config RELOCATABLE_TEST bool "Test relocatable kernel" diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S index 7ab4c8c0f1abcb1aaf0412b9bf9fe78cd24ea489..be6e1fa07c21199fbbf32418bc97135141298b2d 100644 --- a/arch/powerpc/kernel/exceptions-64e.S +++ b/arch/powerpc/kernel/exceptions-64e.S @@ -1249,6 +1249,7 @@ skpinv: addi r6,r6,1 /* Increment */ 1: mflr r6 addi r6,r6,(2f - 1b) tovirt(r6,r6) + add r6,r6,r19 lis r7,MSR_KERNEL@h ori r7,r7,MSR_KERNEL@l mtspr SPRN_SRR0,r6 @@ -1271,6 +1272,7 @@ skpinv: addi r6,r6,1 /* Increment */ /* We translate LR and return */ tovirt(r8,r8) + add r8,r8,r19 mtlr r8 blr @@ -1403,6 +1405,7 @@ a2_tlbinit_code_end: */ _GLOBAL(start_initialization_book3e) mflr r28 + li r19, 0 /* First, we need to setup some initial TLBs to map the kernel * text, data and bss at PAGE_OFFSET. We don't have a real mode @@ -1445,6 +1448,12 @@ _GLOBAL(book3e_secondary_core_init) cmplwi r4,0 bne 2f + li r19, 0 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __kaslr_offset) + ld r19,0(r19) + rlwinm r19,r19,0,0,5 +#endif /* Setup TLB for this core */ bl initial_tlb_book3e @@ -1477,6 +1486,7 @@ _GLOBAL(book3e_secondary_core_init) lis r3,PAGE_OFFSET@highest sldi r3,r3,32 or r28,r28,r3 + add r28,r28,r19 1: mtlr r28 blr @@ -1554,3 +1564,20 @@ _GLOBAL(setup_ehv_ivors) _GLOBAL(setup_lrat_ivor) SET_IVOR(42, 0x340) /* LRAT Error */ blr + +/* + * Return to the start of the relocated kernel and run again + * r3 - virtual address of fdt + * r4 - entry of the kernel + */ +_GLOBAL(reloc_kernel_entry) + mfmsr r7 + rlwinm r7, r7, 0, ~(MSR_IS | MSR_DS) + + mtspr SPRN_SRR0,r4 + mtspr SPRN_SRR1,r7 +#ifdef CONFIG_RANDOMIZE_BASE + LOAD_REG_ADDR_PIC(r19, __is_prom) + lwz r5,0(r19) +#endif + rfi diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 4690c219bfa4dfe72e65ec509acc0bf8841ee6e1..8ac22d56132b51202bb318eaf1dc12e83d2d7345 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -116,6 +116,15 @@ __secondary_hold_acknowledge: .8byte 0x0 #ifdef CONFIG_RELOCATABLE +#ifdef CONFIG_RANDOMIZE_BASE + .globl __kaslr_offset +__kaslr_offset: + .8byte 0x0 + .globl __is_prom +__is_prom: + .8byte 0x0 +#endif + /* This flag is set to 1 by a loader if the kernel should run * at the loaded address instead of the linked address. This * is used by kexec-tools to keep the kdump kernel in the @@ -535,6 +544,12 @@ __start_initialization_multiplatform: /* Poison TOC */ li r2,-1 +#ifdef CONFIG_RANDOMIZE_BASE + /* Store value in r5 for relocation */ + LOAD_REG_ADDR_PIC(r19, __is_prom) + stw r5,0(r19) +#endif + /* * Are we booted from a PROM Of-type client-interface ? */ @@ -952,6 +967,13 @@ start_here_multiplatform: /* Adjust TOC for moved kernel. Could adjust when moving it instead. */ bl relative_toc + /* Do not clear the BSS for the second pass if randomized */ + LOAD_REG_ADDR(r3, kernstart_virt_addr) + ld r3,0(r3) + LOAD_REG_IMMEDIATE(r4, KERNELBASE) + cmpd r3,r4 + bne 4f + /* Clear out the BSS. It may have been done in prom_init, * already but that's irrelevant since prom_init will soon * be detached from the kernel completely. Besides, we need diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c index 0b5878c3125b1cd67ff3f44cedf83d514478c262..e2e4b261e1424d8519a03e867bf8fdbb86959e3a 100644 --- a/arch/powerpc/kernel/prom.c +++ b/arch/powerpc/kernel/prom.c @@ -758,6 +758,7 @@ static inline void save_fscr_to_task(void) {} void __init early_init_devtree(void *params) { phys_addr_t limit; + size_t int_vector_size; DBG(" -> early_init_devtree(%px)\n", params); @@ -810,9 +811,12 @@ void __init early_init_devtree(void *params) setup_initial_memory_limit(memstart_addr, first_memblock_size); /* Reserve MEMBLOCK regions used by kernel, initrd, dt, etc... */ memblock_reserve(PHYSICAL_START, __pa(_end) - PHYSICAL_START); - /* If relocatable, reserve first 32k for interrupt vectors etc. */ + /* If relocatable, reserve at least 32k for interrupt vectors etc. */ + int_vector_size = (size_t)((uintptr_t)__end_interrupts - + (uintptr_t)_stext); + int_vector_size = max_t(size_t, 0x8000, int_vector_size); if (PHYSICAL_START > MEMORY_START) - memblock_reserve(MEMORY_START, 0x8000); + memblock_reserve(MEMORY_START, int_vector_size); reserve_kdump_trampoline(); #if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP) /* diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c index 246201d0d879eff5bff8d90df4e4d6b8f282b8ac..15ece83ab7ac60eb02dab75c67dba38914518567 100644 --- a/arch/powerpc/kernel/setup_64.c +++ b/arch/powerpc/kernel/setup_64.c @@ -70,6 +70,7 @@ #include #include +#include #include "setup.h" int spinning_secondaries; @@ -380,6 +381,8 @@ void __init early_setup(unsigned long dt_ptr) /* Enable early debugging if any specified (see udbg.h) */ udbg_early_init(); + kaslr_early_init(__va(dt_ptr), 0); + udbg_printf(" -> %s(), dt_ptr: 0x%lx\n", __func__, dt_ptr); /* diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h index 7f9ff0640124af711e6e662e5dfac1315386ead0..ba9d507999cd0d5dca2a41e9b5930d0c764ca6d1 100644 --- a/arch/powerpc/mm/mmu_decl.h +++ b/arch/powerpc/mm/mmu_decl.h @@ -119,22 +119,17 @@ extern unsigned long map_mem_in_cams(unsigned long ram, int max_cam_idx, extern void adjust_total_lowmem(void); extern int switch_to_as1(void); extern void restore_to_as0(int esel, int offset, void *dt_ptr, int bootcpu); -void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); -void reloc_kernel_entry(void *fdt, int addr); void relocate_init(u64 dt_ptr, phys_addr_t start); -extern int is_second_reloc; #endif +void create_kaslr_tlb_entry(int entry, unsigned long virt, phys_addr_t phys); +extern int is_second_reloc; +extern unsigned long __kaslr_offset; +extern unsigned int __run_at_load; + +void reloc_kernel_entry(void *fdt, long addr); extern void loadcam_entry(unsigned int index); extern void loadcam_multi(int first_idx, int num, int tmp_idx); -#ifdef CONFIG_RANDOMIZE_BASE -void kaslr_early_init(void *dt_ptr, phys_addr_t size); -void kaslr_late_init(void); -#else -static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} -static inline void kaslr_late_init(void) {} -#endif - struct tlbcam { u32 MAS0; u32 MAS1; @@ -148,6 +143,14 @@ struct tlbcam { extern struct tlbcam TLBCAM[NUM_TLBCAMS]; #endif +#ifdef CONFIG_RANDOMIZE_BASE +void kaslr_early_init(void *dt_ptr, phys_addr_t size); +void kaslr_late_init(void); +#else +static inline void kaslr_early_init(void *dt_ptr, phys_addr_t size) {} +static inline void kaslr_late_init(void) {} +#endif + #if defined(CONFIG_PPC_BOOK3S_32) || defined(CONFIG_PPC_85xx) || defined(CONFIG_PPC_8xx) /* 6xx have BATS */ /* PPC_85xx have TLBCAM */ diff --git a/arch/powerpc/mm/nohash/kaslr_booke.c b/arch/powerpc/mm/nohash/kaslr_booke.c index 2fb3edafe9ab65740ec1dcc7aefc55a71473a0bc..12c5b0926e2e8a9df3b5bcc4093c09ce6d373989 100644 --- a/arch/powerpc/mm/nohash/kaslr_booke.c +++ b/arch/powerpc/mm/nohash/kaslr_booke.c @@ -24,6 +24,7 @@ struct regions { unsigned long pa_start; unsigned long pa_end; unsigned long kernel_size; + unsigned long linear_sz; unsigned long dtb_start; unsigned long dtb_end; unsigned long initrd_start; @@ -221,10 +222,11 @@ static __init unsigned long get_usable_address(const void *fdt, unsigned long start, unsigned long offset) { + unsigned long unit = IS_ENABLED(CONFIG_PPC32) ? SZ_16K : SZ_64K; unsigned long pa; unsigned long pa_end; - for (pa = offset; (long)pa > (long)start; pa -= SZ_16K) { + for (pa = offset; (long)pa > (long)start; pa -= unit) { pa_end = pa + regions.kernel_size; if (overlaps_region(fdt, pa, pa_end)) continue; @@ -254,19 +256,41 @@ static __init void get_cell_sizes(const void *fdt, int node, int *addr_cells, *size_cells = fdt32_to_cpu(*prop); } -static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long index, - unsigned long offset) +static unsigned long __init kaslr_legal_offset(void *dt_ptr, unsigned long random) { unsigned long koffset = 0; unsigned long start; + unsigned long index; + unsigned long offset; + + if (IS_ENABLED(CONFIG_PPC32)) { + /* + * Decide which 64M we want to start + * Only use the low 8 bits of the random seed + */ + index = random & 0xFF; + index %= regions.linear_sz / SZ_64M; + + /* Decide offset inside 64M */ + offset = random % (SZ_64M - regions.kernel_size); + offset = round_down(offset, SZ_16K); + + while ((long)index >= 0) { + offset = memstart_addr + index * SZ_64M + offset; + start = memstart_addr + index * SZ_64M; + koffset = get_usable_address(dt_ptr, start, offset); + if (koffset) + break; + index--; + } + } else { + /* Decide kernel offset inside 1G */ + offset = random % (regions.linear_sz - regions.kernel_size); + offset = round_down(offset, SZ_64K); - while ((long)index >= 0) { - offset = memstart_addr + index * SZ_64M + offset; - start = memstart_addr + index * SZ_64M; + start = memstart_addr; + offset = memstart_addr + offset; koffset = get_usable_address(dt_ptr, start, offset); - if (koffset) - break; - index--; } if (koffset != 0) @@ -283,10 +307,9 @@ static inline __init bool kaslr_disabled(void) static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size, unsigned long kernel_sz) { - unsigned long offset, random; + unsigned long random; unsigned long ram, linear_sz; u64 seed; - unsigned long index; kaslr_get_cmdline(dt_ptr); if (kaslr_disabled()) @@ -307,6 +330,7 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size else pr_warn("KASLR: No safe seed for randomizing the kernel base.\n"); +#ifdef CONFIG_PPC32 ram = min_t(phys_addr_t, __max_low_memory, size); ram = map_mem_in_cams(ram, CONFIG_LOWMEM_CAM_NUM, true, true); linear_sz = min_t(unsigned long, ram, SZ_512M); @@ -314,6 +338,10 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size /* If the linear size is smaller than 64M, do not randomize */ if (linear_sz < SZ_64M) return 0; +#else + ram = size; + linear_sz = min_t(unsigned long, size, SZ_1G); +#endif /* check for a reserved-memory node and record its cell sizes */ regions.reserved_mem = fdt_path_offset(dt_ptr, "/reserved-memory"); @@ -327,22 +355,12 @@ static unsigned long __init kaslr_choose_location(void *dt_ptr, phys_addr_t size regions.dtb_start = __pa(dt_ptr); regions.dtb_end = __pa(dt_ptr) + fdt_totalsize(dt_ptr); regions.kernel_size = kernel_sz; + regions.linear_sz = linear_sz; get_initrd_range(dt_ptr); get_crash_kernel(dt_ptr, ram); - /* - * Decide which 64M we want to start - * Only use the low 8 bits of the random seed - */ - index = random & 0xFF; - index %= linear_sz / SZ_64M; - - /* Decide offset inside 64M */ - offset = random % (SZ_64M - kernel_sz); - offset = round_down(offset, SZ_16K); - - return kaslr_legal_offset(dt_ptr, index, offset); + return kaslr_legal_offset(dt_ptr, random); } /* @@ -357,6 +375,16 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) unsigned long offset; unsigned long kernel_sz; + if (IS_ENABLED(CONFIG_PPC64)) { + if (__run_at_load == 1) { + kaslr_late_init(); + return; + } + + /* Get the first memblock size */ + early_get_first_memblock_info(dt_ptr, &size); + } + kernel_sz = (unsigned long)_end - (unsigned long)_stext; offset = kaslr_choose_location(dt_ptr, size, kernel_sz); @@ -366,14 +394,19 @@ notrace void __init kaslr_early_init(void *dt_ptr, phys_addr_t size) kernstart_virt_addr += offset; kernstart_addr += offset; - is_second_reloc = 1; + if (IS_ENABLED(CONFIG_PPC32)) { + is_second_reloc = 1; - if (offset >= SZ_64M) { - tlb_virt = round_down(kernstart_virt_addr, SZ_64M); - tlb_phys = round_down(kernstart_addr, SZ_64M); + if (offset >= SZ_64M) { + tlb_virt = round_down(kernstart_virt_addr, SZ_64M); + tlb_phys = round_down(kernstart_addr, SZ_64M); - /* Create kernel map to relocate in */ - create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + /* Create kernel map to relocate in */ + create_kaslr_tlb_entry(1, tlb_virt, tlb_phys); + } + } else { + __kaslr_offset = kernstart_virt_addr - KERNELBASE; + __run_at_load = 1; } /* Copy the kernel to it's new location and run */