The following KASLR implementation allows to randomize the kernel mapping:
- virtually: we expect the bootloader to provide a seed in the device-tree
- physically: only implemented in the EFI stub, it relies on the firmware to
provide a seed using EFI_RNG_PROTOCOL. arm64 has a similar implementation
hence the patch 3 factorizes KASLR related functions for riscv to take
advantage.
The new virtual kernel location is limited by the early page table that only
has one PUD and with the PMD alignment constraint, the kernel can only take
< 512 positions.
base-commit-tag: v6.5-rc1
Changes in v6:
* Fix reintroduced build failures by compiling kaslr.c only for arm64
and riscv, as suggested by Ard
Changes in v5:
* Renamed efi-stub-kaslr.c into kaslr.c and fix commit log of patch 3,
as suggested by Ard
* Removed stubs since the kaslr functions were moved to their own file
(and then does not trigger any build failure for architectures that do
not call those functions since they are in their own compilation unit)
Changes in v4:
* Fix efi_get_kimg macro that returned nothing
* Moved new kaslr functions into their own files to avoid zboot link
failures, as suggested by Ard
Changes in v3:
* Rebase on top of 6.4-rc2
* Make RANDOMIZE_BASE depend on 64bit
* Fix efi_icache_sync and efi_get_kimg_min_align which were undefined
in x86 (and certainly other archs)
* Add patch 4 to fix warning on rv32
Changes in v2:
* Rebase on top of 6.3-rc1
* Add a riscv cache sync after memcpying the kernel
* Add kaslr_offset implementation for KCOV
* Add forward declaration to quiet LLVM
Alexandre Ghiti (5):
riscv: Introduce virtual kernel mapping KASLR
riscv: Dump out kernel offset information on panic
arm64: libstub: Move KASLR handling functions to kaslr.c
libstub: Fix compilation warning for rv32
riscv: libstub: Implement KASLR by using generic functions
arch/arm64/include/asm/efi.h | 2 +
arch/riscv/Kconfig | 19 +++
arch/riscv/include/asm/efi.h | 2 +
arch/riscv/include/asm/page.h | 3 +
arch/riscv/kernel/image-vars.h | 1 +
arch/riscv/kernel/pi/Makefile | 2 +-
arch/riscv/kernel/pi/cmdline_early.c | 13 ++
arch/riscv/kernel/pi/fdt_early.c | 30 ++++
arch/riscv/kernel/setup.c | 25 ++++
arch/riscv/mm/init.c | 36 ++++-
drivers/firmware/efi/libstub/Makefile | 4 +-
drivers/firmware/efi/libstub/arm64-stub.c | 117 ++--------------
drivers/firmware/efi/libstub/efistub.h | 8 ++
drivers/firmware/efi/libstub/kaslr.c | 159 ++++++++++++++++++++++
drivers/firmware/efi/libstub/riscv-stub.c | 33 ++---
15 files changed, 328 insertions(+), 126 deletions(-)
create mode 100644 arch/riscv/kernel/pi/fdt_early.c
create mode 100644 drivers/firmware/efi/libstub/kaslr.c
--
2.39.2
This prepares for riscv to use the same functions to handle the pĥysical
kernel move when KASLR is enabled.
Signed-off-by: Alexandre Ghiti <[email protected]>
---
arch/arm64/include/asm/efi.h | 2 +
drivers/firmware/efi/libstub/Makefile | 2 +-
drivers/firmware/efi/libstub/arm64-stub.c | 117 ++--------------
drivers/firmware/efi/libstub/efistub.h | 8 ++
drivers/firmware/efi/libstub/kaslr.c | 159 ++++++++++++++++++++++
5 files changed, 183 insertions(+), 105 deletions(-)
create mode 100644 drivers/firmware/efi/libstub/kaslr.c
diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
index 4cf2cb053bc8..46273ee89445 100644
--- a/arch/arm64/include/asm/efi.h
+++ b/arch/arm64/include/asm/efi.h
@@ -168,4 +168,6 @@ static inline void efi_capsule_flush_cache_range(void *addr, int size)
efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f);
+void efi_icache_sync(unsigned long start, unsigned long end);
+
#endif /* _ASM_EFI_H */
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 16d64a34d1e1..11aba8a041ec 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -86,7 +86,7 @@ lib-$(CONFIG_EFI_GENERIC_STUB) += efi-stub.o string.o intrinsics.o systable.o \
screen_info.o efi-stub-entry.o
lib-$(CONFIG_ARM) += arm32-stub.o
-lib-$(CONFIG_ARM64) += arm64.o arm64-stub.o smbios.o
+lib-$(CONFIG_ARM64) += kaslr.o arm64.o arm64-stub.o smbios.o
lib-$(CONFIG_X86) += x86-stub.o
lib-$(CONFIG_RISCV) += riscv.o riscv-stub.o
lib-$(CONFIG_LOONGARCH) += loongarch.o loongarch-stub.o
diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c
index 770b8ecb7398..452b7ccd330e 100644
--- a/drivers/firmware/efi/libstub/arm64-stub.c
+++ b/drivers/firmware/efi/libstub/arm64-stub.c
@@ -14,42 +14,6 @@
#include "efistub.h"
-/*
- * Distro versions of GRUB may ignore the BSS allocation entirely (i.e., fail
- * to provide space, and fail to zero it). Check for this condition by double
- * checking that the first and the last byte of the image are covered by the
- * same EFI memory map entry.
- */
-static bool check_image_region(u64 base, u64 size)
-{
- struct efi_boot_memmap *map;
- efi_status_t status;
- bool ret = false;
- int map_offset;
-
- status = efi_get_memory_map(&map, false);
- if (status != EFI_SUCCESS)
- return false;
-
- for (map_offset = 0; map_offset < map->map_size; map_offset += map->desc_size) {
- efi_memory_desc_t *md = (void *)map->map + map_offset;
- u64 end = md->phys_addr + md->num_pages * EFI_PAGE_SIZE;
-
- /*
- * Find the region that covers base, and return whether
- * it covers base+size bytes.
- */
- if (base >= md->phys_addr && base < end) {
- ret = (base + size) <= end;
- break;
- }
- }
-
- efi_bs_call(free_pool, map);
-
- return ret;
-}
-
efi_status_t handle_kernel_image(unsigned long *image_addr,
unsigned long *image_size,
unsigned long *reserve_addr,
@@ -59,31 +23,6 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
{
efi_status_t status;
unsigned long kernel_size, kernel_codesize, kernel_memsize;
- u32 phys_seed = 0;
- u64 min_kimg_align = efi_get_kimg_min_align();
-
- if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
- efi_guid_t li_fixed_proto = LINUX_EFI_LOADED_IMAGE_FIXED_GUID;
- void *p;
-
- if (efi_nokaslr) {
- efi_info("KASLR disabled on kernel command line\n");
- } else if (efi_bs_call(handle_protocol, image_handle,
- &li_fixed_proto, &p) == EFI_SUCCESS) {
- efi_info("Image placement fixed by loader\n");
- } else {
- status = efi_get_random_bytes(sizeof(phys_seed),
- (u8 *)&phys_seed);
- if (status == EFI_NOT_FOUND) {
- efi_info("EFI_RNG_PROTOCOL unavailable\n");
- efi_nokaslr = true;
- } else if (status != EFI_SUCCESS) {
- efi_err("efi_get_random_bytes() failed (0x%lx)\n",
- status);
- efi_nokaslr = true;
- }
- }
- }
if (image->image_base != _text) {
efi_err("FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value\n");
@@ -98,50 +37,15 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
kernel_codesize = __inittext_end - _text;
kernel_memsize = kernel_size + (_end - _edata);
*reserve_size = kernel_memsize;
+ *image_addr = (unsigned long)_text;
- if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) {
- /*
- * If KASLR is enabled, and we have some randomness available,
- * locate the kernel at a randomized offset in physical memory.
- */
- status = efi_random_alloc(*reserve_size, min_kimg_align,
- reserve_addr, phys_seed,
- EFI_LOADER_CODE);
- if (status != EFI_SUCCESS)
- efi_warn("efi_random_alloc() failed: 0x%lx\n", status);
- } else {
- status = EFI_OUT_OF_RESOURCES;
- }
-
- if (status != EFI_SUCCESS) {
- if (!check_image_region((u64)_text, kernel_memsize)) {
- efi_err("FIRMWARE BUG: Image BSS overlaps adjacent EFI memory region\n");
- } else if (IS_ALIGNED((u64)_text, min_kimg_align) &&
- (u64)_end < EFI_ALLOC_LIMIT) {
- /*
- * Just execute from wherever we were loaded by the
- * UEFI PE/COFF loader if the placement is suitable.
- */
- *image_addr = (u64)_text;
- *reserve_size = 0;
- return EFI_SUCCESS;
- }
-
- status = efi_allocate_pages_aligned(*reserve_size, reserve_addr,
- ULONG_MAX, min_kimg_align,
- EFI_LOADER_CODE);
-
- if (status != EFI_SUCCESS) {
- efi_err("Failed to relocate kernel\n");
- *reserve_size = 0;
- return status;
- }
- }
-
- *image_addr = *reserve_addr;
- memcpy((void *)*image_addr, _text, kernel_size);
- caches_clean_inval_pou(*image_addr, *image_addr + kernel_codesize);
- efi_remap_image(*image_addr, *reserve_size, kernel_codesize);
+ status = efi_kaslr_relocate_kernel(image_addr,
+ reserve_addr, reserve_size,
+ kernel_size, kernel_codesize,
+ kernel_memsize,
+ efi_kaslr_get_phys_seed(image_handle));
+ if (status != EFI_SUCCESS)
+ return status;
return EFI_SUCCESS;
}
@@ -159,3 +63,8 @@ unsigned long primary_entry_offset(void)
*/
return (char *)primary_entry - _text;
}
+
+void efi_icache_sync(unsigned long start, unsigned long end)
+{
+ caches_clean_inval_pou(start, end);
+}
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index 6aa38a1bf126..b1a1037567ba 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -1132,6 +1132,14 @@ const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record,
void efi_remap_image(unsigned long image_base, unsigned alloc_size,
unsigned long code_size);
+efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr,
+ unsigned long *reserve_addr,
+ unsigned long *reserve_size,
+ unsigned long kernel_size,
+ unsigned long kernel_codesize,
+ unsigned long kernel_memsize,
+ u32 phys_seed);
+u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle);
asmlinkage efi_status_t __efiapi
efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab);
diff --git a/drivers/firmware/efi/libstub/kaslr.c b/drivers/firmware/efi/libstub/kaslr.c
new file mode 100644
index 000000000000..be0c8ab0982a
--- /dev/null
+++ b/drivers/firmware/efi/libstub/kaslr.c
@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Helper functions used by the EFI stub on multiple
+ * architectures to deal with physical address space randomization.
+ */
+#include <linux/efi.h>
+
+#include "efistub.h"
+
+/**
+ * efi_kaslr_get_phys_seed() - Get random seed for physical kernel KASLR
+ * @image_handle: Handle to the image
+ *
+ * If KASLR is not disabled, obtain a random seed using EFI_RNG_PROTOCOL
+ * that will be used to move the kernel physical mapping.
+ *
+ * Return: the random seed
+ */
+u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle)
+{
+ efi_status_t status;
+ u32 phys_seed;
+ efi_guid_t li_fixed_proto = LINUX_EFI_LOADED_IMAGE_FIXED_GUID;
+ void *p;
+
+ if (!IS_ENABLED(CONFIG_RANDOMIZE_BASE))
+ return 0;
+
+ if (efi_nokaslr) {
+ efi_info("KASLR disabled on kernel command line\n");
+ } else if (efi_bs_call(handle_protocol, image_handle,
+ &li_fixed_proto, &p) == EFI_SUCCESS) {
+ efi_info("Image placement fixed by loader\n");
+ } else {
+ status = efi_get_random_bytes(sizeof(phys_seed),
+ (u8 *)&phys_seed);
+ if (status == EFI_SUCCESS) {
+ return phys_seed;
+ } else if (status == EFI_NOT_FOUND) {
+ efi_info("EFI_RNG_PROTOCOL unavailable\n");
+ efi_nokaslr = true;
+ } else if (status != EFI_SUCCESS) {
+ efi_err("efi_get_random_bytes() failed (0x%lx)\n",
+ status);
+ efi_nokaslr = true;
+ }
+ }
+
+ return 0;
+}
+
+/*
+ * Distro versions of GRUB may ignore the BSS allocation entirely (i.e., fail
+ * to provide space, and fail to zero it). Check for this condition by double
+ * checking that the first and the last byte of the image are covered by the
+ * same EFI memory map entry.
+ */
+static bool check_image_region(u64 base, u64 size)
+{
+ struct efi_boot_memmap *map;
+ efi_status_t status;
+ bool ret = false;
+ int map_offset;
+
+ status = efi_get_memory_map(&map, false);
+ if (status != EFI_SUCCESS)
+ return false;
+
+ for (map_offset = 0; map_offset < map->map_size; map_offset += map->desc_size) {
+ efi_memory_desc_t *md = (void *)map->map + map_offset;
+ u64 end = md->phys_addr + md->num_pages * EFI_PAGE_SIZE;
+
+ /*
+ * Find the region that covers base, and return whether
+ * it covers base+size bytes.
+ */
+ if (base >= md->phys_addr && base < end) {
+ ret = (base + size) <= end;
+ break;
+ }
+ }
+
+ efi_bs_call(free_pool, map);
+
+ return ret;
+}
+
+/**
+ * efi_kaslr_relocate_kernel() - Relocate the kernel (random if KASLR enabled)
+ * @image_addr: Pointer to the current kernel location
+ * @reserve_addr: Pointer to the relocated kernel location
+ * @reserve_size: Size of the relocated kernel
+ * @kernel_size: Size of the text + data
+ * @kernel_codesize: Size of the text
+ * @kernel_memsize: Size of the text + data + bss
+ * @phys_seed: Random seed used for the relocation
+ *
+ * If KASLR is not enabled, this function relocates the kernel to a fixed
+ * address (or leave it as its current location). If KASLR is enabled, the
+ * kernel physical location is randomized using the seed in parameter.
+ *
+ * Return: status code, EFI_SUCCESS if relocation is successful
+ */
+efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr,
+ unsigned long *reserve_addr,
+ unsigned long *reserve_size,
+ unsigned long kernel_size,
+ unsigned long kernel_codesize,
+ unsigned long kernel_memsize,
+ u32 phys_seed)
+{
+ efi_status_t status;
+ u64 min_kimg_align = efi_get_kimg_min_align();
+
+ if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) {
+ /*
+ * If KASLR is enabled, and we have some randomness available,
+ * locate the kernel at a randomized offset in physical memory.
+ */
+ status = efi_random_alloc(*reserve_size, min_kimg_align,
+ reserve_addr, phys_seed,
+ EFI_LOADER_CODE);
+ if (status != EFI_SUCCESS)
+ efi_warn("efi_random_alloc() failed: 0x%lx\n", status);
+ } else {
+ status = EFI_OUT_OF_RESOURCES;
+ }
+
+ if (status != EFI_SUCCESS) {
+ if (!check_image_region(*image_addr, kernel_memsize)) {
+ efi_err("FIRMWARE BUG: Image BSS overlaps adjacent EFI memory region\n");
+ } else if (IS_ALIGNED(*image_addr, min_kimg_align) &&
+ (u64)_end < EFI_ALLOC_LIMIT) {
+ /*
+ * Just execute from wherever we were loaded by the
+ * UEFI PE/COFF loader if the placement is suitable.
+ */
+ *reserve_size = 0;
+ return EFI_SUCCESS;
+ }
+
+ status = efi_allocate_pages_aligned(*reserve_size, reserve_addr,
+ ULONG_MAX, min_kimg_align,
+ EFI_LOADER_CODE);
+
+ if (status != EFI_SUCCESS) {
+ efi_err("Failed to relocate kernel\n");
+ *reserve_size = 0;
+ return status;
+ }
+ }
+
+ memcpy((void *)*reserve_addr, (void *)*image_addr, kernel_size);
+ *image_addr = *reserve_addr;
+ efi_icache_sync(*image_addr, *image_addr + kernel_codesize);
+ efi_remap_image(*image_addr, *reserve_size, kernel_codesize);
+
+ return status;
+}
--
2.39.2
On Sat, 22 Jul 2023 at 14:42, Alexandre Ghiti <[email protected]> wrote:
>
> This prepares for riscv to use the same functions to handle the pĥysical
> kernel move when KASLR is enabled.
>
> Signed-off-by: Alexandre Ghiti <[email protected]>
This looks fine to me.
I can stick this on a stable branch in the EFI tree, but I don't have
anything queued up for the next window anyway, so you might as well
just take it directly.
Acked-by: Ard Biesheuvel <[email protected]>
> ---
> arch/arm64/include/asm/efi.h | 2 +
> drivers/firmware/efi/libstub/Makefile | 2 +-
> drivers/firmware/efi/libstub/arm64-stub.c | 117 ++--------------
> drivers/firmware/efi/libstub/efistub.h | 8 ++
> drivers/firmware/efi/libstub/kaslr.c | 159 ++++++++++++++++++++++
> 5 files changed, 183 insertions(+), 105 deletions(-)
> create mode 100644 drivers/firmware/efi/libstub/kaslr.c
>
> diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
> index 4cf2cb053bc8..46273ee89445 100644
> --- a/arch/arm64/include/asm/efi.h
> +++ b/arch/arm64/include/asm/efi.h
> @@ -168,4 +168,6 @@ static inline void efi_capsule_flush_cache_range(void *addr, int size)
>
> efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f);
>
> +void efi_icache_sync(unsigned long start, unsigned long end);
> +
> #endif /* _ASM_EFI_H */
> diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> index 16d64a34d1e1..11aba8a041ec 100644
> --- a/drivers/firmware/efi/libstub/Makefile
> +++ b/drivers/firmware/efi/libstub/Makefile
> @@ -86,7 +86,7 @@ lib-$(CONFIG_EFI_GENERIC_STUB) += efi-stub.o string.o intrinsics.o systable.o \
> screen_info.o efi-stub-entry.o
>
> lib-$(CONFIG_ARM) += arm32-stub.o
> -lib-$(CONFIG_ARM64) += arm64.o arm64-stub.o smbios.o
> +lib-$(CONFIG_ARM64) += kaslr.o arm64.o arm64-stub.o smbios.o
> lib-$(CONFIG_X86) += x86-stub.o
> lib-$(CONFIG_RISCV) += riscv.o riscv-stub.o
> lib-$(CONFIG_LOONGARCH) += loongarch.o loongarch-stub.o
> diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c
> index 770b8ecb7398..452b7ccd330e 100644
> --- a/drivers/firmware/efi/libstub/arm64-stub.c
> +++ b/drivers/firmware/efi/libstub/arm64-stub.c
> @@ -14,42 +14,6 @@
>
> #include "efistub.h"
>
> -/*
> - * Distro versions of GRUB may ignore the BSS allocation entirely (i.e., fail
> - * to provide space, and fail to zero it). Check for this condition by double
> - * checking that the first and the last byte of the image are covered by the
> - * same EFI memory map entry.
> - */
> -static bool check_image_region(u64 base, u64 size)
> -{
> - struct efi_boot_memmap *map;
> - efi_status_t status;
> - bool ret = false;
> - int map_offset;
> -
> - status = efi_get_memory_map(&map, false);
> - if (status != EFI_SUCCESS)
> - return false;
> -
> - for (map_offset = 0; map_offset < map->map_size; map_offset += map->desc_size) {
> - efi_memory_desc_t *md = (void *)map->map + map_offset;
> - u64 end = md->phys_addr + md->num_pages * EFI_PAGE_SIZE;
> -
> - /*
> - * Find the region that covers base, and return whether
> - * it covers base+size bytes.
> - */
> - if (base >= md->phys_addr && base < end) {
> - ret = (base + size) <= end;
> - break;
> - }
> - }
> -
> - efi_bs_call(free_pool, map);
> -
> - return ret;
> -}
> -
> efi_status_t handle_kernel_image(unsigned long *image_addr,
> unsigned long *image_size,
> unsigned long *reserve_addr,
> @@ -59,31 +23,6 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
> {
> efi_status_t status;
> unsigned long kernel_size, kernel_codesize, kernel_memsize;
> - u32 phys_seed = 0;
> - u64 min_kimg_align = efi_get_kimg_min_align();
> -
> - if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
> - efi_guid_t li_fixed_proto = LINUX_EFI_LOADED_IMAGE_FIXED_GUID;
> - void *p;
> -
> - if (efi_nokaslr) {
> - efi_info("KASLR disabled on kernel command line\n");
> - } else if (efi_bs_call(handle_protocol, image_handle,
> - &li_fixed_proto, &p) == EFI_SUCCESS) {
> - efi_info("Image placement fixed by loader\n");
> - } else {
> - status = efi_get_random_bytes(sizeof(phys_seed),
> - (u8 *)&phys_seed);
> - if (status == EFI_NOT_FOUND) {
> - efi_info("EFI_RNG_PROTOCOL unavailable\n");
> - efi_nokaslr = true;
> - } else if (status != EFI_SUCCESS) {
> - efi_err("efi_get_random_bytes() failed (0x%lx)\n",
> - status);
> - efi_nokaslr = true;
> - }
> - }
> - }
>
> if (image->image_base != _text) {
> efi_err("FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value\n");
> @@ -98,50 +37,15 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
> kernel_codesize = __inittext_end - _text;
> kernel_memsize = kernel_size + (_end - _edata);
> *reserve_size = kernel_memsize;
> + *image_addr = (unsigned long)_text;
>
> - if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) {
> - /*
> - * If KASLR is enabled, and we have some randomness available,
> - * locate the kernel at a randomized offset in physical memory.
> - */
> - status = efi_random_alloc(*reserve_size, min_kimg_align,
> - reserve_addr, phys_seed,
> - EFI_LOADER_CODE);
> - if (status != EFI_SUCCESS)
> - efi_warn("efi_random_alloc() failed: 0x%lx\n", status);
> - } else {
> - status = EFI_OUT_OF_RESOURCES;
> - }
> -
> - if (status != EFI_SUCCESS) {
> - if (!check_image_region((u64)_text, kernel_memsize)) {
> - efi_err("FIRMWARE BUG: Image BSS overlaps adjacent EFI memory region\n");
> - } else if (IS_ALIGNED((u64)_text, min_kimg_align) &&
> - (u64)_end < EFI_ALLOC_LIMIT) {
> - /*
> - * Just execute from wherever we were loaded by the
> - * UEFI PE/COFF loader if the placement is suitable.
> - */
> - *image_addr = (u64)_text;
> - *reserve_size = 0;
> - return EFI_SUCCESS;
> - }
> -
> - status = efi_allocate_pages_aligned(*reserve_size, reserve_addr,
> - ULONG_MAX, min_kimg_align,
> - EFI_LOADER_CODE);
> -
> - if (status != EFI_SUCCESS) {
> - efi_err("Failed to relocate kernel\n");
> - *reserve_size = 0;
> - return status;
> - }
> - }
> -
> - *image_addr = *reserve_addr;
> - memcpy((void *)*image_addr, _text, kernel_size);
> - caches_clean_inval_pou(*image_addr, *image_addr + kernel_codesize);
> - efi_remap_image(*image_addr, *reserve_size, kernel_codesize);
> + status = efi_kaslr_relocate_kernel(image_addr,
> + reserve_addr, reserve_size,
> + kernel_size, kernel_codesize,
> + kernel_memsize,
> + efi_kaslr_get_phys_seed(image_handle));
> + if (status != EFI_SUCCESS)
> + return status;
>
> return EFI_SUCCESS;
> }
> @@ -159,3 +63,8 @@ unsigned long primary_entry_offset(void)
> */
> return (char *)primary_entry - _text;
> }
> +
> +void efi_icache_sync(unsigned long start, unsigned long end)
> +{
> + caches_clean_inval_pou(start, end);
> +}
> diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
> index 6aa38a1bf126..b1a1037567ba 100644
> --- a/drivers/firmware/efi/libstub/efistub.h
> +++ b/drivers/firmware/efi/libstub/efistub.h
> @@ -1132,6 +1132,14 @@ const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record,
>
> void efi_remap_image(unsigned long image_base, unsigned alloc_size,
> unsigned long code_size);
> +efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr,
> + unsigned long *reserve_addr,
> + unsigned long *reserve_size,
> + unsigned long kernel_size,
> + unsigned long kernel_codesize,
> + unsigned long kernel_memsize,
> + u32 phys_seed);
> +u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle);
>
> asmlinkage efi_status_t __efiapi
> efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab);
> diff --git a/drivers/firmware/efi/libstub/kaslr.c b/drivers/firmware/efi/libstub/kaslr.c
> new file mode 100644
> index 000000000000..be0c8ab0982a
> --- /dev/null
> +++ b/drivers/firmware/efi/libstub/kaslr.c
> @@ -0,0 +1,159 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Helper functions used by the EFI stub on multiple
> + * architectures to deal with physical address space randomization.
> + */
> +#include <linux/efi.h>
> +
> +#include "efistub.h"
> +
> +/**
> + * efi_kaslr_get_phys_seed() - Get random seed for physical kernel KASLR
> + * @image_handle: Handle to the image
> + *
> + * If KASLR is not disabled, obtain a random seed using EFI_RNG_PROTOCOL
> + * that will be used to move the kernel physical mapping.
> + *
> + * Return: the random seed
> + */
> +u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle)
> +{
> + efi_status_t status;
> + u32 phys_seed;
> + efi_guid_t li_fixed_proto = LINUX_EFI_LOADED_IMAGE_FIXED_GUID;
> + void *p;
> +
> + if (!IS_ENABLED(CONFIG_RANDOMIZE_BASE))
> + return 0;
> +
> + if (efi_nokaslr) {
> + efi_info("KASLR disabled on kernel command line\n");
> + } else if (efi_bs_call(handle_protocol, image_handle,
> + &li_fixed_proto, &p) == EFI_SUCCESS) {
> + efi_info("Image placement fixed by loader\n");
> + } else {
> + status = efi_get_random_bytes(sizeof(phys_seed),
> + (u8 *)&phys_seed);
> + if (status == EFI_SUCCESS) {
> + return phys_seed;
> + } else if (status == EFI_NOT_FOUND) {
> + efi_info("EFI_RNG_PROTOCOL unavailable\n");
> + efi_nokaslr = true;
> + } else if (status != EFI_SUCCESS) {
> + efi_err("efi_get_random_bytes() failed (0x%lx)\n",
> + status);
> + efi_nokaslr = true;
> + }
> + }
> +
> + return 0;
> +}
> +
> +/*
> + * Distro versions of GRUB may ignore the BSS allocation entirely (i.e., fail
> + * to provide space, and fail to zero it). Check for this condition by double
> + * checking that the first and the last byte of the image are covered by the
> + * same EFI memory map entry.
> + */
> +static bool check_image_region(u64 base, u64 size)
> +{
> + struct efi_boot_memmap *map;
> + efi_status_t status;
> + bool ret = false;
> + int map_offset;
> +
> + status = efi_get_memory_map(&map, false);
> + if (status != EFI_SUCCESS)
> + return false;
> +
> + for (map_offset = 0; map_offset < map->map_size; map_offset += map->desc_size) {
> + efi_memory_desc_t *md = (void *)map->map + map_offset;
> + u64 end = md->phys_addr + md->num_pages * EFI_PAGE_SIZE;
> +
> + /*
> + * Find the region that covers base, and return whether
> + * it covers base+size bytes.
> + */
> + if (base >= md->phys_addr && base < end) {
> + ret = (base + size) <= end;
> + break;
> + }
> + }
> +
> + efi_bs_call(free_pool, map);
> +
> + return ret;
> +}
> +
> +/**
> + * efi_kaslr_relocate_kernel() - Relocate the kernel (random if KASLR enabled)
> + * @image_addr: Pointer to the current kernel location
> + * @reserve_addr: Pointer to the relocated kernel location
> + * @reserve_size: Size of the relocated kernel
> + * @kernel_size: Size of the text + data
> + * @kernel_codesize: Size of the text
> + * @kernel_memsize: Size of the text + data + bss
> + * @phys_seed: Random seed used for the relocation
> + *
> + * If KASLR is not enabled, this function relocates the kernel to a fixed
> + * address (or leave it as its current location). If KASLR is enabled, the
> + * kernel physical location is randomized using the seed in parameter.
> + *
> + * Return: status code, EFI_SUCCESS if relocation is successful
> + */
> +efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr,
> + unsigned long *reserve_addr,
> + unsigned long *reserve_size,
> + unsigned long kernel_size,
> + unsigned long kernel_codesize,
> + unsigned long kernel_memsize,
> + u32 phys_seed)
> +{
> + efi_status_t status;
> + u64 min_kimg_align = efi_get_kimg_min_align();
> +
> + if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) {
> + /*
> + * If KASLR is enabled, and we have some randomness available,
> + * locate the kernel at a randomized offset in physical memory.
> + */
> + status = efi_random_alloc(*reserve_size, min_kimg_align,
> + reserve_addr, phys_seed,
> + EFI_LOADER_CODE);
> + if (status != EFI_SUCCESS)
> + efi_warn("efi_random_alloc() failed: 0x%lx\n", status);
> + } else {
> + status = EFI_OUT_OF_RESOURCES;
> + }
> +
> + if (status != EFI_SUCCESS) {
> + if (!check_image_region(*image_addr, kernel_memsize)) {
> + efi_err("FIRMWARE BUG: Image BSS overlaps adjacent EFI memory region\n");
> + } else if (IS_ALIGNED(*image_addr, min_kimg_align) &&
> + (u64)_end < EFI_ALLOC_LIMIT) {
> + /*
> + * Just execute from wherever we were loaded by the
> + * UEFI PE/COFF loader if the placement is suitable.
> + */
> + *reserve_size = 0;
> + return EFI_SUCCESS;
> + }
> +
> + status = efi_allocate_pages_aligned(*reserve_size, reserve_addr,
> + ULONG_MAX, min_kimg_align,
> + EFI_LOADER_CODE);
> +
> + if (status != EFI_SUCCESS) {
> + efi_err("Failed to relocate kernel\n");
> + *reserve_size = 0;
> + return status;
> + }
> + }
> +
> + memcpy((void *)*reserve_addr, (void *)*image_addr, kernel_size);
> + *image_addr = *reserve_addr;
> + efi_icache_sync(*image_addr, *image_addr + kernel_codesize);
> + efi_remap_image(*image_addr, *reserve_size, kernel_codesize);
> +
> + return status;
> +}
> --
> 2.39.2
>
Hey Alex,
On Sat, Jul 22, 2023 at 02:38:45PM +0200, Alexandre Ghiti wrote:
> The following KASLR implementation allows to randomize the kernel mapping:
>
> - virtually: we expect the bootloader to provide a seed in the device-tree
> - physically: only implemented in the EFI stub, it relies on the firmware to
> provide a seed using EFI_RNG_PROTOCOL. arm64 has a similar implementation
> hence the patch 3 factorizes KASLR related functions for riscv to take
> advantage.
>
> The new virtual kernel location is limited by the early page table that only
> has one PUD and with the PMD alignment constraint, the kernel can only take
> < 512 positions.
I gave this all a go today, it seems to do what it it says on the tin,
and crashing my kernel does dump out an offset etc.
Tested-by: Conor Dooley <[email protected]>
I'll hopefully get some time later in the week to go through the code.
Cheers,
Conor.
On Mon, Jul 24, 2023 at 4:32 PM Conor Dooley <[email protected]> wrote:
>
> Hey Alex,
>
> On Sat, Jul 22, 2023 at 02:38:45PM +0200, Alexandre Ghiti wrote:
> > The following KASLR implementation allows to randomize the kernel mapping:
> >
> > - virtually: we expect the bootloader to provide a seed in the device-tree
> > - physically: only implemented in the EFI stub, it relies on the firmware to
> > provide a seed using EFI_RNG_PROTOCOL. arm64 has a similar implementation
> > hence the patch 3 factorizes KASLR related functions for riscv to take
> > advantage.
> >
> > The new virtual kernel location is limited by the early page table that only
> > has one PUD and with the PMD alignment constraint, the kernel can only take
> > < 512 positions.
>
> I gave this all a go today, it seems to do what it it says on the tin,
> and crashing my kernel does dump out an offset etc.
>
> Tested-by: Conor Dooley <[email protected]>
Great, thanks for testing!
>
> I'll hopefully get some time later in the week to go through the code.
I will be on holiday in 3 weeks, you have some time, no worries :)
Thanks again,
Alex
>
> Cheers,
> Conor.
>
在 2023/8/17 21:10, Alexandre Ghiti 写道:
> Hi Song,
>
> On Tue, Aug 15, 2023 at 1:24 PM Song Shuai <[email protected]> wrote:
>>
>>
>> Hi, Alex:
>>
>> 在 2023/7/22 20:38, Alexandre Ghiti 写道:
>>> The following KASLR implementation allows to randomize the kernel mapping:
>>>
>>> - virtually: we expect the bootloader to provide a seed in the device-tree
>>> - physically: only implemented in the EFI stub, it relies on the firmware to
>>> provide a seed using EFI_RNG_PROTOCOL. arm64 has a similar implementation
>>> hence the patch 3 factorizes KASLR related functions for riscv to take
>>> advantage.
>>>
>>> The new virtual kernel location is limited by the early page table that only
>>> has one PUD and with the PMD alignment constraint, the kernel can only take
>>> < 512 positions.
>>>
>>
>> I have gone through the code and tested this series with RiscVVirt edk2.
>> All seems good to me, you can add :
>>
>> Tested-by: Song Shuai <[email protected]>
>>
>> And a few questions about patch 2 ("riscv: Dump out kernel offset
>> information on panic"):
>>
>> 1. The dump_kernel_offset() function would output "Kernel Offset: 0x0
>> from 0xffffffff80000000" when booting with "nokaslr" option.
>>
>> How about disabling the registration of "kernel_offset_notifier" with
>> "nokaslr" option?
>
> I'd rather keep it as it shows the "nokaslr" flag was taken into account.
>
>>
>> 2. Inspired by patch 2, I added the Crash KASLR support based on this
>> series [1].
>> So is it necessary to keep this patch if we have Crash KASLR support?
>
> I don't understand your question here
Crash can automatically calculate virt_offset by comparing the vmlinux
and vmcore. If this patch is just intended to assist Crash in setting
the "--kaslr offset," it might be deleted; if not just keep it.
>
>>
>>
>> [1]:
>> https://lore.kernel.org/linux-riscv/[email protected]/T/#u
>>
>>> base-commit-tag: v6.5-rc1
>>>
>>> Changes in v6:
>>> * Fix reintroduced build failures by compiling kaslr.c only for arm64
>>> and riscv, as suggested by Ard
>>>
>>> Changes in v5:
>>> * Renamed efi-stub-kaslr.c into kaslr.c and fix commit log of patch 3,
>>> as suggested by Ard
>>> * Removed stubs since the kaslr functions were moved to their own file
>>> (and then does not trigger any build failure for architectures that do
>>> not call those functions since they are in their own compilation unit)
>>>
>>> Changes in v4:
>>> * Fix efi_get_kimg macro that returned nothing
>>> * Moved new kaslr functions into their own files to avoid zboot link
>>> failures, as suggested by Ard
>>>
>>> Changes in v3:
>>> * Rebase on top of 6.4-rc2
>>> * Make RANDOMIZE_BASE depend on 64bit
>>> * Fix efi_icache_sync and efi_get_kimg_min_align which were undefined
>>> in x86 (and certainly other archs)
>>> * Add patch 4 to fix warning on rv32
>>>
>>> Changes in v2:
>>> * Rebase on top of 6.3-rc1
>>> * Add a riscv cache sync after memcpying the kernel
>>> * Add kaslr_offset implementation for KCOV
>>> * Add forward declaration to quiet LLVM
>>>
>>> Alexandre Ghiti (5):
>>> riscv: Introduce virtual kernel mapping KASLR
>>> riscv: Dump out kernel offset information on panic
>>> arm64: libstub: Move KASLR handling functions to kaslr.c
>>> libstub: Fix compilation warning for rv32
>>> riscv: libstub: Implement KASLR by using generic functions
>>>
>>> arch/arm64/include/asm/efi.h | 2 +
>>> arch/riscv/Kconfig | 19 +++
>>> arch/riscv/include/asm/efi.h | 2 +
>>> arch/riscv/include/asm/page.h | 3 +
>>> arch/riscv/kernel/image-vars.h | 1 +
>>> arch/riscv/kernel/pi/Makefile | 2 +-
>>> arch/riscv/kernel/pi/cmdline_early.c | 13 ++
>>> arch/riscv/kernel/pi/fdt_early.c | 30 ++++
>>> arch/riscv/kernel/setup.c | 25 ++++
>>> arch/riscv/mm/init.c | 36 ++++-
>>> drivers/firmware/efi/libstub/Makefile | 4 +-
>>> drivers/firmware/efi/libstub/arm64-stub.c | 117 ++--------------
>>> drivers/firmware/efi/libstub/efistub.h | 8 ++
>>> drivers/firmware/efi/libstub/kaslr.c | 159 ++++++++++++++++++++++
>>> drivers/firmware/efi/libstub/riscv-stub.c | 33 ++---
>>> 15 files changed, 328 insertions(+), 126 deletions(-)
>>> create mode 100644 arch/riscv/kernel/pi/fdt_early.c
>>> create mode 100644 drivers/firmware/efi/libstub/kaslr.c
>>>
>>
>> --
>> Thanks
>> Song Shuai
>
> Thanks for testing this and your suggestions!
>
> Alex
>
--
Thanks
Song Shuai
Hi, Alex:
在 2023/7/22 20:38, Alexandre Ghiti 写道:
> The following KASLR implementation allows to randomize the kernel mapping:
>
> - virtually: we expect the bootloader to provide a seed in the device-tree
> - physically: only implemented in the EFI stub, it relies on the firmware to
> provide a seed using EFI_RNG_PROTOCOL. arm64 has a similar implementation
> hence the patch 3 factorizes KASLR related functions for riscv to take
> advantage.
>
> The new virtual kernel location is limited by the early page table that only
> has one PUD and with the PMD alignment constraint, the kernel can only take
> < 512 positions.
>
I have gone through the code and tested this series with RiscVVirt edk2.
All seems good to me, you can add :
Tested-by: Song Shuai <[email protected]>
And a few questions about patch 2 ("riscv: Dump out kernel offset
information on panic"):
1. The dump_kernel_offset() function would output "Kernel Offset: 0x0
from 0xffffffff80000000" when booting with "nokaslr" option.
How about disabling the registration of "kernel_offset_notifier" with
"nokaslr" option?
2. Inspired by patch 2, I added the Crash KASLR support based on this
series [1].
So is it necessary to keep this patch if we have Crash KASLR support?
[1]:
https://lore.kernel.org/linux-riscv/[email protected]/T/#u
> base-commit-tag: v6.5-rc1
>
> Changes in v6:
> * Fix reintroduced build failures by compiling kaslr.c only for arm64
> and riscv, as suggested by Ard
>
> Changes in v5:
> * Renamed efi-stub-kaslr.c into kaslr.c and fix commit log of patch 3,
> as suggested by Ard
> * Removed stubs since the kaslr functions were moved to their own file
> (and then does not trigger any build failure for architectures that do
> not call those functions since they are in their own compilation unit)
>
> Changes in v4:
> * Fix efi_get_kimg macro that returned nothing
> * Moved new kaslr functions into their own files to avoid zboot link
> failures, as suggested by Ard
>
> Changes in v3:
> * Rebase on top of 6.4-rc2
> * Make RANDOMIZE_BASE depend on 64bit
> * Fix efi_icache_sync and efi_get_kimg_min_align which were undefined
> in x86 (and certainly other archs)
> * Add patch 4 to fix warning on rv32
>
> Changes in v2:
> * Rebase on top of 6.3-rc1
> * Add a riscv cache sync after memcpying the kernel
> * Add kaslr_offset implementation for KCOV
> * Add forward declaration to quiet LLVM
>
> Alexandre Ghiti (5):
> riscv: Introduce virtual kernel mapping KASLR
> riscv: Dump out kernel offset information on panic
> arm64: libstub: Move KASLR handling functions to kaslr.c
> libstub: Fix compilation warning for rv32
> riscv: libstub: Implement KASLR by using generic functions
>
> arch/arm64/include/asm/efi.h | 2 +
> arch/riscv/Kconfig | 19 +++
> arch/riscv/include/asm/efi.h | 2 +
> arch/riscv/include/asm/page.h | 3 +
> arch/riscv/kernel/image-vars.h | 1 +
> arch/riscv/kernel/pi/Makefile | 2 +-
> arch/riscv/kernel/pi/cmdline_early.c | 13 ++
> arch/riscv/kernel/pi/fdt_early.c | 30 ++++
> arch/riscv/kernel/setup.c | 25 ++++
> arch/riscv/mm/init.c | 36 ++++-
> drivers/firmware/efi/libstub/Makefile | 4 +-
> drivers/firmware/efi/libstub/arm64-stub.c | 117 ++--------------
> drivers/firmware/efi/libstub/efistub.h | 8 ++
> drivers/firmware/efi/libstub/kaslr.c | 159 ++++++++++++++++++++++
> drivers/firmware/efi/libstub/riscv-stub.c | 33 ++---
> 15 files changed, 328 insertions(+), 126 deletions(-)
> create mode 100644 arch/riscv/kernel/pi/fdt_early.c
> create mode 100644 drivers/firmware/efi/libstub/kaslr.c
>
--
Thanks
Song Shuai