Groups > linux.kernel > #1379329 > unrolled thread

[PATCH v5 00/21] x86, boot: KASLR cleanup and 64-bit improvements

Started by	Kees Cook <keescook@chromium.org>
First post	2016-04-15 00:30 +0200
Last post	2016-04-16 11:10 +0200
Articles	20 on this page of 39 — 3 participants

Back to article view | Back to linux.kernel

  [PATCH v5 00/21] x86, boot: KASLR cleanup and 64-bit improvements Kees Cook <keescook@chromium.org> - 2016-04-15 00:30 +0200
    [PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build Kees Cook <keescook@chromium.org> - 2016-04-15 00:30 +0200
      Re: [PATCH v5 05/21] x86, boot: Calculate decompression size during  boot not build Ingo Molnar <mingo@kernel.org> - 2016-04-15 10:20 +0200
        Re: [PATCH v5 05/21] x86, boot: Calculate decompression size during  boot not build Kees Cook <keescook@chromium.org> - 2016-04-15 21:20 +0200
    [PATCH v5 21/21] x86, KASLR: Allow randomization below load address Kees Cook <keescook@chromium.org> - 2016-04-15 00:30 +0200
    [PATCH v5 09/21] x86, KASLR: Correctly bounds-check relocations Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 20/21] x86, KASLR: Remove unused slot tracking code Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 01/21] x86, KASLR: Remove unneeded boot_params argument Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 01/21] x86, KASLR: Remove unneeded boot_params argument Ingo Molnar <mingo@kernel.org> - 2016-04-15 09:30 +0200
        Re: [PATCH v5 01/21] x86, KASLR: Remove unneeded boot_params argument Kees Cook <keescook@chromium.org> - 2016-04-15 21:00 +0200
    [PATCH v5 19/21] x86, KASLR: Add physical address randomization >4G Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy Lasse Collin <lasse.collin@tukaani.org> - 2016-04-15 17:00 +0200
        Re: [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy Kees Cook <keescook@chromium.org> - 2016-04-15 21:30 +0200
    [PATCH v5 02/21] x86, KASLR: Handle kernel relocation above 2G Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 02/21] x86, KASLR: Handle kernel relocation above 2G Ingo Molnar <mingo@kernel.org> - 2016-04-15 09:50 +0200
        Re: [PATCH v5 02/21] x86, KASLR: Handle kernel relocation above 2G Kees Cook <keescook@chromium.org> - 2016-04-15 21:10 +0200
    [PATCH v5 16/21] x86, KASLR: Add virtual address choosing function Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 15/21] x86, KASLR: Add slot_area support functions Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 04/21] x86, boot: Move compressed kernel to end of decompression buffer Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 04/21] x86, boot: Move compressed kernel to end of  decompression buffer Ingo Molnar <mingo@kernel.org> - 2016-04-15 10:20 +0200
        Re: [PATCH v5 04/21] x86, boot: Move compressed kernel to end of  decompression buffer Kees Cook <keescook@chromium.org> - 2016-04-18 19:00 +0200
      Re: [PATCH v5 04/21] x86, boot: Move compressed kernel to end of  decompression buffer Ingo Molnar <mingo@kernel.org> - 2016-04-15 11:10 +0200
    [PATCH v5 12/21] x86, 64bit: Set ident_mapping for KASLR Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 08/21] x86, KASLR: Clean up unused code from old run_size Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 14/21] x86, KASLR: Add slot_area to manage random slots Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 17/21] x86, KASLR: Clarify purpose of each get_random_long Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 11/21] x86, boot: Split out kernel_ident_mapping_init Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 10/21] x86, KASLR: Consolidate mem_avoid entries Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
    [PATCH v5 03/21] x86, KASLR: Drop CONFIG_RANDOMIZE_BASE_MAX_OFFSET Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 03/21] x86, KASLR: Drop  CONFIG_RANDOMIZE_BASE_MAX_OFFSET Ingo Molnar <mingo@kernel.org> - 2016-04-15 10:10 +0200
        Re: [PATCH v5 03/21] x86, KASLR: Drop CONFIG_RANDOMIZE_BASE_MAX_OFFSET Kees Cook <keescook@chromium.org> - 2016-04-15 21:20 +0200
          Re: [PATCH v5 03/21] x86, KASLR: Drop  CONFIG_RANDOMIZE_BASE_MAX_OFFSET Ingo Molnar <mingo@kernel.org> - 2016-04-16 10:50 +0200
    [PATCH v5 06/21] x86, KASLR: Update description for decompressor worst case size Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 06/21] x86, KASLR: Update description for  decompressor worst case size Lasse Collin <lasse.collin@tukaani.org> - 2016-04-15 18:20 +0200
    [PATCH v5 07/21] x86, boot: Fix run_size calculation Kees Cook <keescook@chromium.org> - 2016-04-15 00:40 +0200
      Re: [PATCH v5 07/21] x86, boot: Fix run_size calculation Ingo Molnar <mingo@kernel.org> - 2016-04-15 10:40 +0200
        Re: [PATCH v5 07/21] x86, boot: Fix run_size calculation Kees Cook <keescook@chromium.org> - 2016-04-15 21:30 +0200
          Re: [PATCH v5 07/21] x86, boot: Fix run_size calculation Ingo Molnar <mingo@kernel.org> - 2016-04-16 11:10 +0200

Page 1 of 2 [1] 2 Next page →

#1379329 — [PATCH v5 00/21] x86, boot: KASLR cleanup and 64-bit improvements

From	Kees Cook <keescook@chromium.org>
Date	2016-04-15 00:30 +0200
Subject	[PATCH v5 00/21] x86, boot: KASLR cleanup and 64-bit improvements
Message-ID	<rnXVT-YO-3@gated-at.bofh.it>

This is v5 of the x86 KASLR improvement series from Yinghai, Baoquan,
and myself. The current branch lives here:
http://git.kernel.org/cgit/linux/kernel/git/kees/linux.git/log/?h=kaslr/highmem

***Background:
Bugs have been reported around kdump, kexec, and some netboot situations
that didn't work when KASLR was enabled. While discussing the bugs, it
was found that the current KASLR implementation had various limitations,
but most importantly that it can only randomize in a 1GB region of
physical memory.

The current KASLR implementaion only randomizes the base physical
address of the kernel. If the delta from build-time load address and
KASLR run-time load address (i.e. the physical address of where the
kernel actually decompressed) is not equal to 0, relocation handling is
performed using the delta. Though in principle kernel can be randomized
to any physical address, the physical kernel text mapping address space
is limited to 1G and the virtual address is just offset by the same
amount. On x86_64 the result is the following range:
[0xffffffff80000000, 0xffffffffc0000000)

hpa and Vivek suggested we should change this by decoupling the physical
address and virtual address randomization of kernel text and let them work
separately. Then kernel text physical address can be randomized in region
[16M, 64T), and kernel text virtual address can be randomized in region
[0xffffffff80000000, 0xffffffffc0000000).

***Problems that needed solving:
- When booting from the startup_32 case, only a 0~4G identity mapping is
built. If kernel will be randomly put anywhere from 16M to 64T at
most, the price to build all region of identity mapping is too high.
We need build the identity mapping on demand, not covering all
physical address space.

- Decouple the physical address and virtual address randomization of kernel
text and let them work separately.

***Parts:
- The 1st part is clean-up and improvements to help the rest of the series.
(Patches 01-10)
- The 2nd part is Yinghai's building of identity mappings on demand.
This is used to solve the first problem mentioned above.
(Patches 11-12)
- The 3rd part is Baoquan's decoupling the physical address and virtual
address randomization of kernel text and letting them work separately,
based on Yinghai's ident mapping patches.
(Patches 13-21)

I've boot tested this a bunch on 32-bit and 64-bit, and things appear
to be working as expected. I've cleaned up the changelogs, improved
some comments, refactored a few things, etc. Changes are noted in the
individual changelogs.

Thanks!

-Kees

v4->v5:
- rewrote all the changelogs, and several comments.
- refactored e820 parser to use a while loop instead of goto.
- rearranged removal of CONFIG_RANDOMIZE_BASE_MAX_OFFSET to earlier.
- additionally dropped KERNEL_IMAGE_SIZE_DEFAULT
- refactored minimum address calculation
- refactored slot offset calculation for readability
- fixed 32-bit boot failures
- fixed CONFIG_RANDOMIZE_BASE=n boot failure
- improved debug reporting

[Baoquan's histroy]
v3->v4:
- Made changes according to Kees's comments.
Add one patch 20/20 as Kees suggested to use KERNEL_IMAGE_SIZE as offset
max of virtual random, meanwhile clean up useless CONFIG_RANDOM_OFFSET_MAX

x86, kaslr: Use KERNEL_IMAGE_SIZE as the offset max for kernel virtual randomization

v2->v3:
- It only takes care of the kaslr related patches.
For reviewers it's better to discuss only one issue in one thread.
* I take off one patch as follows from Yinghai's because I think it's unnecessay.
- Patch 05/19 x86, kaslr: rename output_size to output_run_size
output_size is enough to represen the value:
output_len > run_size ? output_len : run_size

* I add Patch 04/19, it's a comment update patch. For other patches, I just
adjust patch log and do several places of change comparing with 2nd round.
Please check the change log under patch log of each patch for details.

* Adjust sequence of several patches to make review easier. It doesn't
affect codes.

v1->v2:
- In 2nd round Yinghai made a big patchset including this kaslr fix and another
setup_data related fix. The link is here:
http://lists-archives.com/linux-kernel/28346903-x86-updated-patches-for-kaslr-and-setup_data-etc-for-v4-3.html
You can get the code from Yinghai's git branch:
git://git.kernel.org/pub/scm/linux/kernel/git/yinghai/linux-yinghai.git for-x86-v4.3-next

v1:
- The first round can be found here:
https://lwn.net/Articles/637115/

[toc] | [next] | [standalone]

#1379331 — [PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build

From	Kees Cook <keescook@chromium.org>
Date	2016-04-15 00:30 +0200
Subject	[PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build
Message-ID	<rnXVU-YO-17@gated-at.bofh.it>
In reply to	#1379329

From: Yinghai Lu <yinghai@kernel.org>

Currently z_extract_offset is calculated in boot/compressed/mkpiggy.c.
This doesn't work well because mkpiggy.c doesn't know the details of the
decompressor in use. As a result, it can only make an estimation, which
has risks:

 - output + output_len (VO) could be much bigger than input + input_len
   (ZO). In this case, the decompressed kernel plus relocs could overwrite
   the decompression code while it is running.

 - The head code of ZO could be bigger than z_extract_offset. In this case
   an overwrite could happen when the head code is running to move ZO to
   the end of buffer. Though currently the size of the head code is very
   small it's still a potential risk. Since there is no rule to limit the
   size of the head code of ZO, it runs the risk of suddenly becoming a
   (hard to find) bug.

Instead, this moves the z_extract_offset calculation into header.S, and
makes adjustments to be sure that the above two cases can never happen.

Since we have (previously) made ZO always be located against the end of
decompression buffer, z_extract_offset is only used here to calculate an
appropriate buffer size (INIT_SIZE), and is not longer used elsewhere. As
such, it can be removed from voffset.h.

Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Baoquan He <bhe@redhat.com>
[kees: rewrote changelog]
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 arch/x86/boot/Makefile             |  2 +-
 arch/x86/boot/compressed/misc.c    |  5 +----
 arch/x86/boot/compressed/mkpiggy.c | 15 +--------------
 arch/x86/boot/header.S             | 23 ++++++++++++++++++++++-
 4 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index b1ef9e489084..942f7dabfb1e 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -95,7 +95,7 @@ targets += voffset.h
 $(obj)/voffset.h: vmlinux FORCE
 	$(call if_changed,voffset)
 
-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
 
 quiet_cmd_zoffset = ZOFFSET $@
       cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index c4477d5f3fff..e2a998f8c304 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -83,13 +83,10 @@
  * To avoid problems with the compressed data's meta information an extra 18
  * bytes are needed.  Leading to the formula:
  *
- * extra_bytes = (uncompressed_size >> 12) + 32768 + 18 + decompressor_size.
+ * extra_bytes = (uncompressed_size >> 12) + 32768 + 18.
  *
  * Adding 8 bytes per 32K is a bit excessive but much easier to calculate.
  * Adding 32768 instead of 32767 just makes for round numbers.
- * Adding the decompressor_size is necessary as it musht live after all
- * of the data as well.  Last I measured the decompressor is about 14K.
- * 10K of actual data and 4K of bss.
  *
  */
 
diff --git a/arch/x86/boot/compressed/mkpiggy.c b/arch/x86/boot/compressed/mkpiggy.c
index b980046c3329..a613c84d9b88 100644
--- a/arch/x86/boot/compressed/mkpiggy.c
+++ b/arch/x86/boot/compressed/mkpiggy.c
@@ -21,8 +21,7 @@
  * ----------------------------------------------------------------------- */
 
 /*
- * Compute the desired load offset from a compressed program; outputs
- * a small assembly wrapper with the appropriate symbols defined.
+ * outputs a small assembly wrapper with the appropriate symbols defined.
  */
 
 #include <stdlib.h>
@@ -35,7 +34,6 @@ int main(int argc, char *argv[])
 {
 	uint32_t olen;
 	long ilen;
-	unsigned long offs;
 	unsigned long run_size;
 	FILE *f = NULL;
 	int retval = 1;
@@ -67,15 +65,6 @@ int main(int argc, char *argv[])
 	ilen = ftell(f);
 	olen = get_unaligned_le32(&olen);
 
-	/*
-	 * Now we have the input (compressed) and output (uncompressed)
-	 * sizes, compute the necessary decompression offset...
-	 */
-
-	offs = (olen > ilen) ? olen - ilen : 0;
-	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
-	offs += 64*1024 + 128;	/* Add 64K + 128 bytes slack */
-	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
 	run_size = atoi(argv[2]);
 
 	printf(".section \".rodata..compressed\",\"a\",@progbits\n");
@@ -83,8 +72,6 @@ int main(int argc, char *argv[])
 	printf("z_input_len = %lu\n", ilen);
 	printf(".globl z_output_len\n");
 	printf("z_output_len = %lu\n", (unsigned long)olen);
-	printf(".globl z_extract_offset\n");
-	printf("z_extract_offset = 0x%lx\n", offs);
 	printf(".globl z_run_size\n");
 	printf("z_run_size = %lu\n", run_size);
 
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 6236b9ec4b76..6565dcb2b899 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -440,7 +440,28 @@ setup_data:		.quad 0			# 64-bit physical pointer to
 
 pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
 
-#define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
+/* Check arch/x86/boot/compressed/misc.c for the formula of extra_bytes*/
+#define ZO_z_extra_bytes	((ZO_z_output_len >> 12) + 65536 + 128)
+#if ZO_z_output_len > ZO_z_input_len
+#define ZO_z_extract_offset	(ZO_z_output_len + ZO_z_extra_bytes - \
+				 ZO_z_input_len)
+#else
+#define ZO_z_extract_offset	ZO_z_extra_bytes
+#endif
+
+/*
+ * extract_offset has to be bigger than ZO head section. Otherwise
+ * during head code running to move ZO to end of buffer, it will
+ * overwrite head code itself.
+ */
+#if (ZO__ehead - ZO_startup_32) > ZO_z_extract_offset
+#define ZO_z_min_extract_offset ((ZO__ehead - ZO_startup_32 + 4095) & ~4095)
+#else
+#define ZO_z_min_extract_offset ((ZO_z_extract_offset + 4095) & ~4095)
+#endif
+
+#define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_min_extract_offset)
+
 #define VO_INIT_SIZE	(VO__end - VO__text)
 #if ZO_INIT_SIZE > VO_INIT_SIZE
 #define INIT_SIZE ZO_INIT_SIZE
-- 
2.6.3

From	Ingo Molnar <mingo@kernel.org>
Date	2016-04-15 10:20 +0200
Subject	Re: [PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build
Message-ID	<ro78S-8qx-13@gated-at.bofh.it>
In reply to	#1379331

From	Lasse Collin <lasse.collin@tukaani.org>
Date	2016-04-15 17:00 +0200
Subject	Re: [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy
Message-ID	<rodnY-4BO-3@gated-at.bofh.it>
In reply to	#1379341

[PATCH v5 00/21] x86, boot: KASLR cleanup and 64-bit improvements

Contents

#1379329 — [PATCH v5 00/21] x86, boot: KASLR cleanup and 64-bit improvements

#1379331 — [PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build

#1379537 — Re: [PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build

#1380141 — Re: [PATCH v5 05/21] x86, boot: Calculate decompression size during boot not build

#1379332 — [PATCH v5 21/21] x86, KASLR: Allow randomization below load address

#1379334 — [PATCH v5 09/21] x86, KASLR: Correctly bounds-check relocations

#1379335 — [PATCH v5 20/21] x86, KASLR: Remove unused slot tracking code

#1379336 — [PATCH v5 01/21] x86, KASLR: Remove unneeded boot_params argument

#1379508 — Re: [PATCH v5 01/21] x86, KASLR: Remove unneeded boot_params argument

#1380125 — Re: [PATCH v5 01/21] x86, KASLR: Remove unneeded boot_params argument

#1379340 — [PATCH v5 19/21] x86, KASLR: Add physical address randomization >4G

#1379341 — [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy

#1379888 — Re: [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy

#1380175 — Re: [PATCH v5 13/21] x86, boot: Report overlap failures in memcpy

#1379342 — [PATCH v5 02/21] x86, KASLR: Handle kernel relocation above 2G

#1379517 — Re: [PATCH v5 02/21] x86, KASLR: Handle kernel relocation above 2G

#1380128 — Re: [PATCH v5 02/21] x86, KASLR: Handle kernel relocation above 2G

#1379343 — [PATCH v5 16/21] x86, KASLR: Add virtual address choosing function

#1379344 — [PATCH v5 15/21] x86, KASLR: Add slot_area support functions

#1379345 — [PATCH v5 04/21] x86, boot: Move compressed kernel to end of decompression buffer