lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMj1kXGy10_C69QeNwCFcKkzHfCoo7_u=pAhZ6Q3U8NdVTRfbA@mail.gmail.com>
Date:   Mon, 24 Jul 2023 16:07:23 +0200
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Alexandre Ghiti <alexghiti@...osinc.com>
Cc:     Paul Walmsley <paul.walmsley@...ive.com>,
        Palmer Dabbelt <palmer@...belt.com>,
        Albert Ou <aou@...s.berkeley.edu>,
        Kees Cook <keescook@...omium.org>,
        linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
        linux-efi@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v6 3/5] arm64: libstub: Move KASLR handling functions to kaslr.c

On Sat, 22 Jul 2023 at 14:42, Alexandre Ghiti <alexghiti@...osinc.com> wrote:
>
> This prepares for riscv to use the same functions to handle the pĥysical
> kernel move when KASLR is enabled.
>
> Signed-off-by: Alexandre Ghiti <alexghiti@...osinc.com>

This looks fine to me.

I can stick this on a stable branch in the EFI tree, but I don't have
anything queued up for the next window anyway, so you might as well
just take it directly.

Acked-by: Ard Biesheuvel <ardb@...nel.org>

> ---
>  arch/arm64/include/asm/efi.h              |   2 +
>  drivers/firmware/efi/libstub/Makefile     |   2 +-
>  drivers/firmware/efi/libstub/arm64-stub.c | 117 ++--------------
>  drivers/firmware/efi/libstub/efistub.h    |   8 ++
>  drivers/firmware/efi/libstub/kaslr.c      | 159 ++++++++++++++++++++++
>  5 files changed, 183 insertions(+), 105 deletions(-)
>  create mode 100644 drivers/firmware/efi/libstub/kaslr.c
>
> diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
> index 4cf2cb053bc8..46273ee89445 100644
> --- a/arch/arm64/include/asm/efi.h
> +++ b/arch/arm64/include/asm/efi.h
> @@ -168,4 +168,6 @@ static inline void efi_capsule_flush_cache_range(void *addr, int size)
>
>  efi_status_t efi_handle_corrupted_x18(efi_status_t s, const char *f);
>
> +void efi_icache_sync(unsigned long start, unsigned long end);
> +
>  #endif /* _ASM_EFI_H */
> diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> index 16d64a34d1e1..11aba8a041ec 100644
> --- a/drivers/firmware/efi/libstub/Makefile
> +++ b/drivers/firmware/efi/libstub/Makefile
> @@ -86,7 +86,7 @@ lib-$(CONFIG_EFI_GENERIC_STUB)        += efi-stub.o string.o intrinsics.o systable.o \
>                                    screen_info.o efi-stub-entry.o
>
>  lib-$(CONFIG_ARM)              += arm32-stub.o
> -lib-$(CONFIG_ARM64)            += arm64.o arm64-stub.o smbios.o
> +lib-$(CONFIG_ARM64)            += kaslr.o arm64.o arm64-stub.o smbios.o
>  lib-$(CONFIG_X86)              += x86-stub.o
>  lib-$(CONFIG_RISCV)            += riscv.o riscv-stub.o
>  lib-$(CONFIG_LOONGARCH)                += loongarch.o loongarch-stub.o
> diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c
> index 770b8ecb7398..452b7ccd330e 100644
> --- a/drivers/firmware/efi/libstub/arm64-stub.c
> +++ b/drivers/firmware/efi/libstub/arm64-stub.c
> @@ -14,42 +14,6 @@
>
>  #include "efistub.h"
>
> -/*
> - * Distro versions of GRUB may ignore the BSS allocation entirely (i.e., fail
> - * to provide space, and fail to zero it). Check for this condition by double
> - * checking that the first and the last byte of the image are covered by the
> - * same EFI memory map entry.
> - */
> -static bool check_image_region(u64 base, u64 size)
> -{
> -       struct efi_boot_memmap *map;
> -       efi_status_t status;
> -       bool ret = false;
> -       int map_offset;
> -
> -       status = efi_get_memory_map(&map, false);
> -       if (status != EFI_SUCCESS)
> -               return false;
> -
> -       for (map_offset = 0; map_offset < map->map_size; map_offset += map->desc_size) {
> -               efi_memory_desc_t *md = (void *)map->map + map_offset;
> -               u64 end = md->phys_addr + md->num_pages * EFI_PAGE_SIZE;
> -
> -               /*
> -                * Find the region that covers base, and return whether
> -                * it covers base+size bytes.
> -                */
> -               if (base >= md->phys_addr && base < end) {
> -                       ret = (base + size) <= end;
> -                       break;
> -               }
> -       }
> -
> -       efi_bs_call(free_pool, map);
> -
> -       return ret;
> -}
> -
>  efi_status_t handle_kernel_image(unsigned long *image_addr,
>                                  unsigned long *image_size,
>                                  unsigned long *reserve_addr,
> @@ -59,31 +23,6 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
>  {
>         efi_status_t status;
>         unsigned long kernel_size, kernel_codesize, kernel_memsize;
> -       u32 phys_seed = 0;
> -       u64 min_kimg_align = efi_get_kimg_min_align();
> -
> -       if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
> -               efi_guid_t li_fixed_proto = LINUX_EFI_LOADED_IMAGE_FIXED_GUID;
> -               void *p;
> -
> -               if (efi_nokaslr) {
> -                       efi_info("KASLR disabled on kernel command line\n");
> -               } else if (efi_bs_call(handle_protocol, image_handle,
> -                                      &li_fixed_proto, &p) == EFI_SUCCESS) {
> -                       efi_info("Image placement fixed by loader\n");
> -               } else {
> -                       status = efi_get_random_bytes(sizeof(phys_seed),
> -                                                     (u8 *)&phys_seed);
> -                       if (status == EFI_NOT_FOUND) {
> -                               efi_info("EFI_RNG_PROTOCOL unavailable\n");
> -                               efi_nokaslr = true;
> -                       } else if (status != EFI_SUCCESS) {
> -                               efi_err("efi_get_random_bytes() failed (0x%lx)\n",
> -                                       status);
> -                               efi_nokaslr = true;
> -                       }
> -               }
> -       }
>
>         if (image->image_base != _text) {
>                 efi_err("FIRMWARE BUG: efi_loaded_image_t::image_base has bogus value\n");
> @@ -98,50 +37,15 @@ efi_status_t handle_kernel_image(unsigned long *image_addr,
>         kernel_codesize = __inittext_end - _text;
>         kernel_memsize = kernel_size + (_end - _edata);
>         *reserve_size = kernel_memsize;
> +       *image_addr = (unsigned long)_text;
>
> -       if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) {
> -               /*
> -                * If KASLR is enabled, and we have some randomness available,
> -                * locate the kernel at a randomized offset in physical memory.
> -                */
> -               status = efi_random_alloc(*reserve_size, min_kimg_align,
> -                                         reserve_addr, phys_seed,
> -                                         EFI_LOADER_CODE);
> -               if (status != EFI_SUCCESS)
> -                       efi_warn("efi_random_alloc() failed: 0x%lx\n", status);
> -       } else {
> -               status = EFI_OUT_OF_RESOURCES;
> -       }
> -
> -       if (status != EFI_SUCCESS) {
> -               if (!check_image_region((u64)_text, kernel_memsize)) {
> -                       efi_err("FIRMWARE BUG: Image BSS overlaps adjacent EFI memory region\n");
> -               } else if (IS_ALIGNED((u64)_text, min_kimg_align) &&
> -                          (u64)_end < EFI_ALLOC_LIMIT) {
> -                       /*
> -                        * Just execute from wherever we were loaded by the
> -                        * UEFI PE/COFF loader if the placement is suitable.
> -                        */
> -                       *image_addr = (u64)_text;
> -                       *reserve_size = 0;
> -                       return EFI_SUCCESS;
> -               }
> -
> -               status = efi_allocate_pages_aligned(*reserve_size, reserve_addr,
> -                                                   ULONG_MAX, min_kimg_align,
> -                                                   EFI_LOADER_CODE);
> -
> -               if (status != EFI_SUCCESS) {
> -                       efi_err("Failed to relocate kernel\n");
> -                       *reserve_size = 0;
> -                       return status;
> -               }
> -       }
> -
> -       *image_addr = *reserve_addr;
> -       memcpy((void *)*image_addr, _text, kernel_size);
> -       caches_clean_inval_pou(*image_addr, *image_addr + kernel_codesize);
> -       efi_remap_image(*image_addr, *reserve_size, kernel_codesize);
> +       status = efi_kaslr_relocate_kernel(image_addr,
> +                                          reserve_addr, reserve_size,
> +                                          kernel_size, kernel_codesize,
> +                                          kernel_memsize,
> +                                          efi_kaslr_get_phys_seed(image_handle));
> +       if (status != EFI_SUCCESS)
> +               return status;
>
>         return EFI_SUCCESS;
>  }
> @@ -159,3 +63,8 @@ unsigned long primary_entry_offset(void)
>          */
>         return (char *)primary_entry - _text;
>  }
> +
> +void efi_icache_sync(unsigned long start, unsigned long end)
> +{
> +       caches_clean_inval_pou(start, end);
> +}
> diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
> index 6aa38a1bf126..b1a1037567ba 100644
> --- a/drivers/firmware/efi/libstub/efistub.h
> +++ b/drivers/firmware/efi/libstub/efistub.h
> @@ -1132,6 +1132,14 @@ const u8 *__efi_get_smbios_string(const struct efi_smbios_record *record,
>
>  void efi_remap_image(unsigned long image_base, unsigned alloc_size,
>                      unsigned long code_size);
> +efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr,
> +                                      unsigned long *reserve_addr,
> +                                      unsigned long *reserve_size,
> +                                      unsigned long kernel_size,
> +                                      unsigned long kernel_codesize,
> +                                      unsigned long kernel_memsize,
> +                                      u32 phys_seed);
> +u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle);
>
>  asmlinkage efi_status_t __efiapi
>  efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab);
> diff --git a/drivers/firmware/efi/libstub/kaslr.c b/drivers/firmware/efi/libstub/kaslr.c
> new file mode 100644
> index 000000000000..be0c8ab0982a
> --- /dev/null
> +++ b/drivers/firmware/efi/libstub/kaslr.c
> @@ -0,0 +1,159 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Helper functions used by the EFI stub on multiple
> + * architectures to deal with physical address space randomization.
> + */
> +#include <linux/efi.h>
> +
> +#include "efistub.h"
> +
> +/**
> + * efi_kaslr_get_phys_seed() - Get random seed for physical kernel KASLR
> + * @image_handle:      Handle to the image
> + *
> + * If KASLR is not disabled, obtain a random seed using EFI_RNG_PROTOCOL
> + * that will be used to move the kernel physical mapping.
> + *
> + * Return:     the random seed
> + */
> +u32 efi_kaslr_get_phys_seed(efi_handle_t image_handle)
> +{
> +       efi_status_t status;
> +       u32 phys_seed;
> +       efi_guid_t li_fixed_proto = LINUX_EFI_LOADED_IMAGE_FIXED_GUID;
> +       void *p;
> +
> +       if (!IS_ENABLED(CONFIG_RANDOMIZE_BASE))
> +               return 0;
> +
> +       if (efi_nokaslr) {
> +               efi_info("KASLR disabled on kernel command line\n");
> +       } else if (efi_bs_call(handle_protocol, image_handle,
> +                              &li_fixed_proto, &p) == EFI_SUCCESS) {
> +               efi_info("Image placement fixed by loader\n");
> +       } else {
> +               status = efi_get_random_bytes(sizeof(phys_seed),
> +                                             (u8 *)&phys_seed);
> +               if (status == EFI_SUCCESS) {
> +                       return phys_seed;
> +               } else if (status == EFI_NOT_FOUND) {
> +                       efi_info("EFI_RNG_PROTOCOL unavailable\n");
> +                       efi_nokaslr = true;
> +               } else if (status != EFI_SUCCESS) {
> +                       efi_err("efi_get_random_bytes() failed (0x%lx)\n",
> +                               status);
> +                       efi_nokaslr = true;
> +               }
> +       }
> +
> +       return 0;
> +}
> +
> +/*
> + * Distro versions of GRUB may ignore the BSS allocation entirely (i.e., fail
> + * to provide space, and fail to zero it). Check for this condition by double
> + * checking that the first and the last byte of the image are covered by the
> + * same EFI memory map entry.
> + */
> +static bool check_image_region(u64 base, u64 size)
> +{
> +       struct efi_boot_memmap *map;
> +       efi_status_t status;
> +       bool ret = false;
> +       int map_offset;
> +
> +       status = efi_get_memory_map(&map, false);
> +       if (status != EFI_SUCCESS)
> +               return false;
> +
> +       for (map_offset = 0; map_offset < map->map_size; map_offset += map->desc_size) {
> +               efi_memory_desc_t *md = (void *)map->map + map_offset;
> +               u64 end = md->phys_addr + md->num_pages * EFI_PAGE_SIZE;
> +
> +               /*
> +                * Find the region that covers base, and return whether
> +                * it covers base+size bytes.
> +                */
> +               if (base >= md->phys_addr && base < end) {
> +                       ret = (base + size) <= end;
> +                       break;
> +               }
> +       }
> +
> +       efi_bs_call(free_pool, map);
> +
> +       return ret;
> +}
> +
> +/**
> + * efi_kaslr_relocate_kernel() - Relocate the kernel (random if KASLR enabled)
> + * @image_addr: Pointer to the current kernel location
> + * @reserve_addr:      Pointer to the relocated kernel location
> + * @reserve_size:      Size of the relocated kernel
> + * @kernel_size:       Size of the text + data
> + * @kernel_codesize:   Size of the text
> + * @kernel_memsize:    Size of the text + data + bss
> + * @phys_seed:         Random seed used for the relocation
> + *
> + * If KASLR is not enabled, this function relocates the kernel to a fixed
> + * address (or leave it as its current location). If KASLR is enabled, the
> + * kernel physical location is randomized using the seed in parameter.
> + *
> + * Return:     status code, EFI_SUCCESS if relocation is successful
> + */
> +efi_status_t efi_kaslr_relocate_kernel(unsigned long *image_addr,
> +                                      unsigned long *reserve_addr,
> +                                      unsigned long *reserve_size,
> +                                      unsigned long kernel_size,
> +                                      unsigned long kernel_codesize,
> +                                      unsigned long kernel_memsize,
> +                                      u32 phys_seed)
> +{
> +       efi_status_t status;
> +       u64 min_kimg_align = efi_get_kimg_min_align();
> +
> +       if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && phys_seed != 0) {
> +               /*
> +                * If KASLR is enabled, and we have some randomness available,
> +                * locate the kernel at a randomized offset in physical memory.
> +                */
> +               status = efi_random_alloc(*reserve_size, min_kimg_align,
> +                                         reserve_addr, phys_seed,
> +                                         EFI_LOADER_CODE);
> +               if (status != EFI_SUCCESS)
> +                       efi_warn("efi_random_alloc() failed: 0x%lx\n", status);
> +       } else {
> +               status = EFI_OUT_OF_RESOURCES;
> +       }
> +
> +       if (status != EFI_SUCCESS) {
> +               if (!check_image_region(*image_addr, kernel_memsize)) {
> +                       efi_err("FIRMWARE BUG: Image BSS overlaps adjacent EFI memory region\n");
> +               } else if (IS_ALIGNED(*image_addr, min_kimg_align) &&
> +                          (u64)_end < EFI_ALLOC_LIMIT) {
> +                       /*
> +                        * Just execute from wherever we were loaded by the
> +                        * UEFI PE/COFF loader if the placement is suitable.
> +                        */
> +                       *reserve_size = 0;
> +                       return EFI_SUCCESS;
> +               }
> +
> +               status = efi_allocate_pages_aligned(*reserve_size, reserve_addr,
> +                                                   ULONG_MAX, min_kimg_align,
> +                                                   EFI_LOADER_CODE);
> +
> +               if (status != EFI_SUCCESS) {
> +                       efi_err("Failed to relocate kernel\n");
> +                       *reserve_size = 0;
> +                       return status;
> +               }
> +       }
> +
> +       memcpy((void *)*reserve_addr, (void *)*image_addr, kernel_size);
> +       *image_addr = *reserve_addr;
> +       efi_icache_sync(*image_addr, *image_addr + kernel_codesize);
> +       efi_remap_image(*image_addr, *reserve_size, kernel_codesize);
> +
> +       return status;
> +}
> --
> 2.39.2
>

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ