From patchwork Wed Feb 15 14:51:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandre Ghiti X-Patchwork-Id: 654825 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA3D5C636CC for ; Wed, 15 Feb 2023 14:52:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229823AbjBOOwU (ORCPT ); Wed, 15 Feb 2023 09:52:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229517AbjBOOwT (ORCPT ); Wed, 15 Feb 2023 09:52:19 -0500 Received: from mail-wm1-x333.google.com (mail-wm1-x333.google.com [IPv6:2a00:1450:4864:20::333]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CC7A392A3 for ; Wed, 15 Feb 2023 06:52:18 -0800 (PST) Received: by mail-wm1-x333.google.com with SMTP id hg24-20020a05600c539800b003e1f5f2a29cso1750682wmb.4 for ; Wed, 15 Feb 2023 06:52:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LPxr2vySd3oVKa/Gk0FkWL3LBKn5yD5X+nK2hF1k7o4=; b=is/3FPoifEE7pzbkW4xvM3lD2VaSj0hu5DjFYC05irsdeBPPLpRE0ZWGVCcu1xZEfP vOXOSOe/XljFbqNoNr2OKFkEc2mil6gn2/MWaUy+61KqoBZh6gdn7QwOPjy+tEGT6WXW fguwEAGkRTH5vqDLjG8DGfUcOyNN8mDATOini01k7cZeb1m0bZruexBlOhNyR9qiHesG eT6hIKxDbyikSvsSiaIewcRhn0k+xrmHOJhyE9ehX3XBX66umVM3NM4CUL2/VS+AoomH TMZGvvK46xrvub+z8xzt4uMXsiVUdkFg55wyepXIeSoz8gvh6SJbVrHx6EUxhne3LzER EOWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LPxr2vySd3oVKa/Gk0FkWL3LBKn5yD5X+nK2hF1k7o4=; b=062vwZEEDf5t4lnXAGhTr+jv/oAgh8b28ZaAXtNhybF/X2SHrs75PGU/cx80WpYoCe cldlHCceIFFGbwoy68Gmp6N5hHWrqq9QcTP/MiyKBF9HxW/v3W6JY9Ha2waMwEEtEzH9 JTWO9TY/J7HWEB8weE8FCQzCmkkKNgUqF2TJgT4UngkiOfpF1lU8oRJMDzfv71J0vhpd f9vsWmamVSjB3jREkMX/EjMu2y2M566/3vqDS2WLomOX0bMzmNUIDm+pkZm0eJmB/2c/ xCQrj64VB17WDJ4TOaCFctkNQMxJyPsxO2nYIX84YcmlngZad4OH+mgfyFAFOkR2i/zp nS5Q== X-Gm-Message-State: AO0yUKU5MkAqFSTUoG5kwdARQGYxQPmy+ZS69j+w5O5/YqtV9Fh5A1HO J0kpSk+K5BT8ney4UYC6zgQXHQ== X-Google-Smtp-Source: AK7set957tAsbiR7v+ZgCLg+1nC6dJCW0QSkG4/V4O/WuvKYQzol9jmqM6/gPhaiiDZdxJd54wpJcA== X-Received: by 2002:a05:600c:4d92:b0:3e1:577:80f4 with SMTP id v18-20020a05600c4d9200b003e1057780f4mr2224904wmp.18.1676472736940; Wed, 15 Feb 2023 06:52:16 -0800 (PST) Received: from alex-rivos.home (lfbn-lyo-1-450-160.w2-7.abo.wanadoo.fr. [2.7.42.160]) by smtp.gmail.com with ESMTPSA id e12-20020a05600c218c00b003de8a1b06c0sm2386842wme.7.2023.02.15.06.52.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Feb 2023 06:52:16 -0800 (PST) From: Alexandre Ghiti To: Paul Walmsley , Palmer Dabbelt , Albert Ou , Ard Biesheuvel , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org Cc: Alexandre Ghiti Subject: [PATCH 1/4] riscv: Introduce virtual kernel mapping KASLR Date: Wed, 15 Feb 2023 15:51:10 +0100 Message-Id: <20230215145113.465558-2-alexghiti@rivosinc.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20230215145113.465558-1-alexghiti@rivosinc.com> References: <20230215145113.465558-1-alexghiti@rivosinc.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org KASLR implementation relies on a relocatable kernel so that we can move the kernel mapping. The seed needed to virtually move the kernel is taken from the device tree, so we rely on the bootloader to provide a correct seed. Zkr could be used unconditionnally instead if implemented, but that's for another patch. Signed-off-by: Alexandre Ghiti --- arch/riscv/Kconfig | 18 ++++++++++++++++ arch/riscv/include/asm/page.h | 1 + arch/riscv/kernel/pi/Makefile | 2 +- arch/riscv/kernel/pi/cmdline_early.c | 12 +++++++++++ arch/riscv/kernel/pi/fdt_early.c | 23 +++++++++++++++++++++ arch/riscv/mm/init.c | 31 +++++++++++++++++++++++++++- 6 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 arch/riscv/kernel/pi/fdt_early.c diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index e3b7608d23ae..70082bd978cf 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -559,6 +559,24 @@ config RELOCATABLE If unsure, say N. +config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" + select RELOCATABLE + help + Randomizes the virtual address at which the kernel image is + loaded, as a security feature that deters exploit attempts + relying on knowledge of the location of kernel internals. + + It is the bootloader's job to provide entropy, by passing a + random u64 value in /chosen/kaslr-seed at kernel entry. + + When booting via the UEFI stub, it will invoke the firmware's + EFI_RNG_PROTOCOL implementation (if available) to supply entropy + to the kernel proper. In addition, it will randomise the physical + location of the kernel Image as well. + + If unsure, say N. + endmenu # "Kernel features" menu "Boot options" diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h index bd7b9dda1e4f..11c9aa4931c7 100644 --- a/arch/riscv/include/asm/page.h +++ b/arch/riscv/include/asm/page.h @@ -107,6 +107,7 @@ typedef struct page *pgtable_t; struct kernel_mapping { unsigned long page_offset; unsigned long virt_addr; + unsigned long virt_offset; uintptr_t phys_addr; uintptr_t size; /* Offset between linear mapping virtual address and kernel load address */ diff --git a/arch/riscv/kernel/pi/Makefile b/arch/riscv/kernel/pi/Makefile index 554e936ef0b6..d997d08ae593 100644 --- a/arch/riscv/kernel/pi/Makefile +++ b/arch/riscv/kernel/pi/Makefile @@ -30,5 +30,5 @@ $(obj)/string.o: $(srctree)/lib/string.c FORCE $(obj)/ctype.o: $(srctree)/lib/ctype.c FORCE $(call if_changed_rule,cc_o_c) -obj-y := cmdline_early.pi.o string.pi.o ctype.pi.o lib-fdt.pi.o lib-fdt_ro.pi.o +obj-y := cmdline_early.pi.o fdt_early.pi.o string.pi.o ctype.pi.o lib-fdt.pi.o lib-fdt_ro.pi.o extra-y := $(patsubst %.pi.o,%.o,$(obj-y)) diff --git a/arch/riscv/kernel/pi/cmdline_early.c b/arch/riscv/kernel/pi/cmdline_early.c index 5ae7b853fa66..8d898cc6e7ff 100644 --- a/arch/riscv/kernel/pi/cmdline_early.c +++ b/arch/riscv/kernel/pi/cmdline_early.c @@ -50,3 +50,15 @@ u64 __init set_satp_mode_from_cmdline(uintptr_t dtb_pa) return match_noXlvl(cmdline); } + +static bool __init match_nokaslr(char *cmdline) +{ + return strstr(cmdline, "nokaslr"); +} + +bool __init set_nokaslr_from_cmdline(uintptr_t dtb_pa) +{ + char *cmdline = get_early_cmdline(dtb_pa); + + return match_nokaslr(cmdline); +} diff --git a/arch/riscv/kernel/pi/fdt_early.c b/arch/riscv/kernel/pi/fdt_early.c new file mode 100644 index 000000000000..a51f00021886 --- /dev/null +++ b/arch/riscv/kernel/pi/fdt_early.c @@ -0,0 +1,23 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include +#include +#include + +u64 __init get_kaslr_seed(uintptr_t dtb_pa) +{ + int node, len; + fdt64_t *prop; + u64 ret; + + node = fdt_path_offset((void *)dtb_pa, "/chosen"); + if (node < 0) + return 0; + + prop = fdt_getprop_w((void *)dtb_pa, node, "kaslr-seed", &len); + if (!prop || len != sizeof(u64)) + return 0; + + ret = fdt64_to_cpu(*prop); + *prop = 0; + return ret; +} diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c index aa4f1dc6df58..e6a7e6f5c75d 100644 --- a/arch/riscv/mm/init.c +++ b/arch/riscv/mm/init.c @@ -1032,11 +1032,40 @@ static void __init pt_ops_set_late(void) #endif } +#ifdef CONFIG_RANDOMIZE_BASE +extern bool __init __pi_set_nokaslr_from_cmdline(uintptr_t dtb_pa); +extern u64 __init __pi_get_kaslr_seed(uintptr_t dtb_pa); + +static int __init print_nokaslr(char *p) +{ + pr_info("Disabled KASLR"); + return 0; +} +early_param("nokaslr", print_nokaslr); +#endif + asmlinkage void __init setup_vm(uintptr_t dtb_pa) { pmd_t __maybe_unused fix_bmap_spmd, fix_bmap_epmd; - kernel_map.virt_addr = KERNEL_LINK_ADDR; +#ifdef CONFIG_RANDOMIZE_BASE + if (!__pi_set_nokaslr_from_cmdline(dtb_pa)) { + u64 kaslr_seed = __pi_get_kaslr_seed(dtb_pa); + u32 kernel_size = (uintptr_t)(&_end) - (uintptr_t)(&_start); + u32 nr_pos; + + /* + * Compute the number of positions available: we are limited + * by the early page table that only has one PUD and we must + * be aligned on PMD_SIZE. + */ + nr_pos = (PUD_SIZE - kernel_size) / PMD_SIZE; + + kernel_map.virt_offset = (kaslr_seed % nr_pos) * PMD_SIZE; + } +#endif + + kernel_map.virt_addr = KERNEL_LINK_ADDR + kernel_map.virt_offset; kernel_map.page_offset = _AC(CONFIG_PAGE_OFFSET, UL); #ifdef CONFIG_XIP_KERNEL