From patchwork Mon Mar 27 17:17:03 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 96090 Delivered-To: patch@linaro.org Received: by 10.140.89.233 with SMTP id v96csp1325056qgd; Mon, 27 Mar 2017 10:17:57 -0700 (PDT) X-Received: by 10.99.219.21 with SMTP id e21mr25387264pgg.70.1490635076992; Mon, 27 Mar 2017 10:17:56 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s2si1271299plj.119.2017.03.27.10.17.56; Mon, 27 Mar 2017 10:17:56 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org; spf=pass (google.com: best guess record for domain of linux-efi-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-efi-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751856AbdC0RRi (ORCPT + 2 others); Mon, 27 Mar 2017 13:17:38 -0400 Received: from mail-wr0-f177.google.com ([209.85.128.177]:36307 "EHLO mail-wr0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751851AbdC0RRh (ORCPT ); Mon, 27 Mar 2017 13:17:37 -0400 Received: by mail-wr0-f177.google.com with SMTP id w11so51509129wrc.3 for ; Mon, 27 Mar 2017 10:17:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=5rdv1TFtxxF5QzoaLiyKZycSLRkWaylcXdrrJLmZAq0=; b=XYqEtqHZhmLOv5lHzdUTnttOLJJbEUDfeUqakiT9cODaV1c/QTqiQg15MnMUNiXzMS BNC5OpUg6c6n9PuDMHUcbxFg3YcDhFp6xoXcIadkWpKSVYGWsbLWDYOhAZUBwS0Zy/9k 5VgEvTxiCKp1twKw0eaO+a//apW5tKMGqWxrk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=5rdv1TFtxxF5QzoaLiyKZycSLRkWaylcXdrrJLmZAq0=; b=ZNh2xB0QBoXCZxBTDqNlCN65H1ZzDleMbwoxxy/5EcjSWOhHib9Zu5GRZJlpmG36uA +bKyK2q2+yT58GH0aEaw6v6xao7jlnvWxPkyrHj8WWzup8q/+0+cn4vNJdieIFmDflUw ISAuUJRtIDGW07/BIQt+BJ5RkWZrQj1vqJKSDOG/2BzdQo5Ih/lIHlJmK+U9ZwIEcJPC NrSrEcj/0UIzpcQUqXwmTlEKemgY5VcwjC87lOsVaK6vnZ629p2tRIpGNCzZZNaopZ77 pWGeSDQ0LY4SWBii2Yy9yUy4rM6dpFK8oSnPk150Py12GEui12z+f9C3OmkgWwEx0y+E cmlw== X-Gm-Message-State: AFeK/H1dbxpxNt2XRtdjJJqi/VSlfesMkpSgI/XTTpr5844MQowsam9RrsPvaZ/+T33Wc87s X-Received: by 10.28.125.20 with SMTP id y20mr10808048wmc.123.1490635040565; Mon, 27 Mar 2017 10:17:20 -0700 (PDT) Received: from localhost.localdomain ([196.81.160.3]) by smtp.gmail.com with ESMTPSA id o31sm1488961wrc.27.2017.03.27.10.17.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Mar 2017 10:17:19 -0700 (PDT) From: Ard Biesheuvel To: linux-efi@vger.kernel.org, matt@codeblueprint.co.uk Cc: Ard Biesheuvel , Ingo Molnar , Borislav Petkov Subject: [PATCH v2 4/4] ef/libstub: arm/arm64: randomize the base of the UEFI rt services region Date: Mon, 27 Mar 2017 18:17:03 +0100 Message-Id: <20170327171703.15489-5-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170327171703.15489-1-ard.biesheuvel@linaro.org> References: <20170327171703.15489-1-ard.biesheuvel@linaro.org> Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Update the allocation logic for the virtual mapping of the UEFI runtime services to start from a randomized base address if KASLR is in effect, and if the UEFI firmware exposes an implementation of EFI_RNG_PROTOCOL. This makes it more difficult to predict the location of exploitable data structures in the runtime UEFI firmware, which increases robustness against attacks. Note that these regions are only mapped during the time a runtime service call is in progress, and only on a single CPU at a time, bit give the lack of a downside, let's enable it nonetheless. Cc: Ingo Molnar Cc: Borislav Petkov Cc: Matt Fleming Signed-off-by: Ard Biesheuvel --- drivers/firmware/efi/libstub/arm-stub.c | 48 ++++++++++++++------ 1 file changed, 35 insertions(+), 13 deletions(-) -- 2.9.3 -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c index 657bb72c9e0b..fc8dc604bd17 100644 --- a/drivers/firmware/efi/libstub/arm-stub.c +++ b/drivers/firmware/efi/libstub/arm-stub.c @@ -18,6 +18,22 @@ #include "efistub.h" +/* + * This is the base address at which to start allocating virtual memory ranges + * for UEFI Runtime Services. This is in the low TTBR0 range so that we can use + * any allocation we choose, and eliminate the risk of a conflict after kexec. + * The value chosen is the largest non-zero power of 2 suitable for this purpose + * both on 32-bit and 64-bit ARM CPUs, to maximize the likelihood that it can + * be mapped efficiently. + * Since 32-bit ARM could potentially execute with a 1G/3G user/kernel split, + * map everything below 1 GB. (512 MB is a reasonable upper bound for the + * entire footprint of the UEFI runtime services memory regions) + */ +#define EFI_RT_VIRTUAL_BASE SZ_512M +#define EFI_RT_VIRTUAL_SIZE SZ_512M + +static u64 efi_virt_base = EFI_RT_VIRTUAL_BASE; + efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg, void *__image, void **__fh) { @@ -213,6 +229,25 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table, efi_random_get_seed(sys_table); + if (!nokaslr()) { + /* + * Randomize the base of the UEFI runtime services region. + * Preserve the 2 MB alignment of the region by taking a + * shift of 21 bit positions into account when scaling + * the headroom value using a 32-bit random value. + */ + u64 headroom = TASK_SIZE - EFI_RT_VIRTUAL_BASE - + EFI_RT_VIRTUAL_SIZE; + u32 rnd; + + status = efi_get_random_bytes(sys_table, sizeof(rnd), + (u8 *)&rnd); + if (status == EFI_SUCCESS) { + efi_virt_base = EFI_RT_VIRTUAL_BASE + + (((headroom >> 21) * rnd) >> (32 - 21)); + } + } + new_fdt_addr = fdt_addr; status = allocate_new_fdt_and_exit_boot(sys_table, handle, &new_fdt_addr, efi_get_max_fdt_addr(dram_base), @@ -242,18 +277,6 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table, return EFI_ERROR; } -/* - * This is the base address at which to start allocating virtual memory ranges - * for UEFI Runtime Services. This is in the low TTBR0 range so that we can use - * any allocation we choose, and eliminate the risk of a conflict after kexec. - * The value chosen is the largest non-zero power of 2 suitable for this purpose - * both on 32-bit and 64-bit ARM CPUs, to maximize the likelihood that it can - * be mapped efficiently. - * Since 32-bit ARM could potentially execute with a 1G/3G user/kernel split, - * map everything below 1 GB. - */ -#define EFI_RT_VIRTUAL_BASE SZ_512M - static int cmp_mem_desc(const void *l, const void *r) { const efi_memory_desc_t *left = l, *right = r; @@ -303,7 +326,6 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size, unsigned long desc_size, efi_memory_desc_t *runtime_map, int *count) { - u64 efi_virt_base = EFI_RT_VIRTUAL_BASE; efi_memory_desc_t *in, *prev = NULL, *out = runtime_map; int l;