Unverified Commit 84fe419d authored by Alexandre Ghiti's avatar Alexandre Ghiti Committed by Palmer Dabbelt
Browse files

riscv: Introduce virtual kernel mapping KASLR 



KASLR implementation relies on a relocatable kernel so that we can move
the kernel mapping.

The seed needed to virtually move the kernel is taken from the device tree,
so we rely on the bootloader to provide a correct seed. Zkr could be used
unconditionnally instead if implemented, but that's for another patch.

Signed-off-by: default avatarAlexandre Ghiti <alexghiti@rivosinc.com>
Tested-by: default avatarConor Dooley <conor.dooley@microchip.com>
Tested-by: default avatarSong Shuai <songshuaishuai@tinylab.org>
Reviewed-by: default avatarSami Tolvanen <samitolvanen@google.com>
Tested-by: default avatarSami Tolvanen <samitolvanen@google.com>
Link: https://lore.kernel.org/r/20230722123850.634544-2-alexghiti@rivosinc.com


Signed-off-by: default avatarPalmer Dabbelt <palmer@rivosinc.com>
parent 06c2afb8

arch/riscv/Kconfig

+19 −0
Original line number Diff line number Diff line
@@ -719,6 +719,25 @@ config RELOCATABLE 


          If unsure, say N.



config RANDOMIZE_BASE

        bool "Randomize the address of the kernel image"

        select RELOCATABLE

        depends on MMU && 64BIT && !XIP_KERNEL

        help

          Randomizes the virtual address at which the kernel image is

          loaded, as a security feature that deters exploit attempts

          relying on knowledge of the location of kernel internals.



          It is the bootloader's job to provide entropy, by passing a

          random u64 value in /chosen/kaslr-seed at kernel entry.



          When booting via the UEFI stub, it will invoke the firmware's

          EFI_RNG_PROTOCOL implementation (if available) to supply entropy

          to the kernel proper. In addition, it will randomise the physical

          location of the kernel Image as well.



          If unsure, say N.



endmenu # "Kernel features"



menu "Boot options"

arch/riscv/include/asm/page.h

+3 −0
Original line number Diff line number Diff line
@@ -106,6 +106,7 @@ typedef struct page *pgtable_t; 
struct kernel_mapping {

	unsigned long page_offset;

	unsigned long virt_addr;

	unsigned long virt_offset;

	uintptr_t phys_addr;

	uintptr_t size;

	/* Offset between linear mapping virtual address and kernel load address */
@@ -185,6 +186,8 @@ extern phys_addr_t __phys_addr_symbol(unsigned long x); 


#define sym_to_pfn(x)           __phys_to_pfn(__pa_symbol(x))



unsigned long kaslr_offset(void);



#endif /* __ASSEMBLY__ */



#define virt_addr_valid(vaddr)	({						\

arch/riscv/kernel/pi/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -35,5 +35,5 @@ $(obj)/string.o: $(srctree)/lib/string.c FORCE 
$(obj)/ctype.o: $(srctree)/lib/ctype.c FORCE

	$(call if_changed_rule,cc_o_c)



obj-y		:= cmdline_early.pi.o string.pi.o ctype.pi.o lib-fdt.pi.o lib-fdt_ro.pi.o

obj-y		:= cmdline_early.pi.o fdt_early.pi.o string.pi.o ctype.pi.o lib-fdt.pi.o lib-fdt_ro.pi.o

extra-y		:= $(patsubst %.pi.o,%.o,$(obj-y))

arch/riscv/kernel/pi/cmdline_early.c

+13 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ static char early_cmdline[COMMAND_LINE_SIZE]; 
 * LLVM complain because the function is actually unused in this file).

 */

u64 set_satp_mode_from_cmdline(uintptr_t dtb_pa);

bool set_nokaslr_from_cmdline(uintptr_t dtb_pa);



static char *get_early_cmdline(uintptr_t dtb_pa)

{
@@ -60,3 +61,15 @@ u64 set_satp_mode_from_cmdline(uintptr_t dtb_pa) 


	return match_noXlvl(cmdline);

}



static bool match_nokaslr(char *cmdline)

{

	return strstr(cmdline, "nokaslr");

}



bool set_nokaslr_from_cmdline(uintptr_t dtb_pa)

{

	char *cmdline = get_early_cmdline(dtb_pa);



	return match_nokaslr(cmdline);

}

arch/riscv/kernel/pi/fdt_early.c

0 → 100644
+30 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

#include <linux/types.h>

#include <linux/init.h>

#include <linux/libfdt.h>



/*

 * Declare the functions that are exported (but prefixed) here so that LLVM

 * does not complain it lacks the 'static' keyword (which, if added, makes

 * LLVM complain because the function is actually unused in this file).

 */

u64 get_kaslr_seed(uintptr_t dtb_pa);



u64 get_kaslr_seed(uintptr_t dtb_pa)

{

	int node, len;

	fdt64_t *prop;

	u64 ret;



	node = fdt_path_offset((void *)dtb_pa, "/chosen");

	if (node < 0)

		return 0;



	prop = fdt_getprop_w((void *)dtb_pa, node, "kaslr-seed", &len);

	if (!prop || len != sizeof(u64))

		return 0;



	ret = fdt64_to_cpu(*prop);

	*prop = 0;

	return ret;

}