Commit 0483e1fa authored Jun 21, 2016 by Thomas Garnier Committed by Ingo Molnar Jul 08, 2016

x86/mm: Implement ASLR for kernel memory regions



Randomizes the virtual address space of kernel memory regions for
x86_64. This first patch adds the infrastructure and does not randomize
any region. The following patches will randomize the physical memory
mapping, vmalloc and vmemmap regions.

This security feature mitigates exploits relying on predictable kernel
addresses. These addresses can be used to disclose the kernel modules
base addresses or corrupt specific structures to elevate privileges
bypassing the current implementation of KASLR. This feature can be
enabled with the CONFIG_RANDOMIZE_MEMORY option.

The order of each memory region is not changed. The feature looks at the
available space for the regions based on different configuration options
and randomizes the base and space between each. The size of the physical
memory mapping is the available physical memory. No performance impact
was detected while testing the feature.

Entropy is generated using the KASLR early boot functions now shared in
the lib directory (originally written by Kees Cook). Randomization is
done on PGD & PUD page table levels to increase possible addresses. The
physical memory mapping code was adapted to support PUD level virtual
addresses. This implementation on the best configuration provides 30,000
possible virtual addresses in average for each memory region.  An
additional low memory page is used to ensure each CPU can start with a
PGD aligned virtual address (for realmode).

x86/dump_pagetable was updated to correctly display each region.

Updated documentation on x86_64 memory layout accordingly.

Performance data, after all patches in the series:

Kernbench shows almost no difference (-+ less than 1%):

Before:

Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.63 (1.2695)
User Time 1034.89 (1.18115) System Time 87.056 (0.456416) Percent CPU 1092.9
(13.892) Context Switches 199805 (3455.33) Sleeps 97907.8 (900.636)

After:

Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.489 (1.10636)
User Time 1034.86 (1.36053) System Time 87.764 (0.49345) Percent CPU 1095
(12.7715) Context Switches 199036 (4298.1) Sleeps 97681.6 (1031.11)

Hackbench shows 0% difference on average (hackbench 90 repeated 10 times):

attemp,before,after 1,0.076,0.069 2,0.072,0.069 3,0.066,0.066 4,0.066,0.068
5,0.066,0.067 6,0.066,0.069 7,0.067,0.066 8,0.063,0.067 9,0.067,0.065
10,0.068,0.071 average,0.0677,0.0677

Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Alexander Kuleshov <kuleshovmail@gmail.com>
Cc: Alexander Popov <alpopov@ptsecurity.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jan Beulich <JBeulich@suse.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lv Zheng <lv.zheng@intel.com>
Cc: Mark Salter <msalter@redhat.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: kernel-hardening@lists.openwall.com
Cc: linux-doc@vger.kernel.org
Link: http://lkml.kernel.org/r/1466556426-32664-6-git-send-email-keescook@chromium.org


Signed-off-by: Ingo Molnar <mingo@kernel.org>

parent b234e8a0

Documentation/x86/x86_64/mm.txt

+4 −0

Original line number	Diff line number	Diff line
		@@ -39,4 +39,8 @@ memory window (this size is arbitrary, it can be raised later if needed).
		The mappings are not part of any other kernel PGD and are only available
		during EFI runtime calls.

		Note that if CONFIG_RANDOMIZE_MEMORY is enabled, the direct mapping of all
		physical memory, vmalloc/ioremap space and virtual memory map are randomized.
		Their order is preserved but their base will be offset early at boot time.

		-Andi Kleen, Jul 2004

arch/x86/Kconfig

+17 −0

Original line number	Diff line number	Diff line
		@@ -1993,6 +1993,23 @@ config PHYSICAL_ALIGN

		Don't change this unless you know what you are doing.

		config RANDOMIZE_MEMORY
		bool "Randomize the kernel memory sections"
		depends on X86_64
		depends on RANDOMIZE_BASE
		default RANDOMIZE_BASE
		---help---
		Randomizes the base virtual address of kernel memory sections
		(physical memory mapping, vmalloc & vmemmap). This security feature
		makes exploits relying on predictable memory locations less reliable.

		The order of allocations remains unchanged. Entropy is generated in
		the same way as RANDOMIZE_BASE. Current implementation in the optimal
		configuration have in average 30,000 different possible virtual
		addresses for each memory section.

		If unsure, say N.

		config HOTPLUG_CPU
		bool "Support for hot-pluggable CPUs"
		depends on SMP

arch/x86/include/asm/kaslr.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -3,4 +3,10 @@

		unsigned long kaslr_get_random_long(const char *purpose);

		#ifdef CONFIG_RANDOMIZE_MEMORY
		void kernel_randomize_memory(void);
		#else
		static inline void kernel_randomize_memory(void) { }
		#endif /* CONFIG_RANDOMIZE_MEMORY */

		#endif

arch/x86/include/asm/pgtable.h

+6 −1

Original line number	Diff line number	Diff line
		@@ -732,11 +732,16 @@ void early_alloc_pgt_buf(void);
		#ifdef CONFIG_X86_64
		/* Realmode trampoline initialization. */
		extern pgd_t trampoline_pgd_entry;
		static inline void __meminit init_trampoline(void)
		static inline void __meminit init_trampoline_default(void)
		{
		/* Default trampoline pgd value */
		trampoline_pgd_entry = init_level4_pgt[pgd_index(__PAGE_OFFSET)];
		}
		# ifdef CONFIG_RANDOMIZE_MEMORY
		void __meminit init_trampoline(void);
		# else
		# define init_trampoline init_trampoline_default
		# endif
		#else
		static inline void init_trampoline(void) { }
		#endif

arch/x86/kernel/setup.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -113,6 +113,7 @@
		#include <asm/prom.h>
		#include <asm/microcode.h>
		#include <asm/mmu_context.h>
		#include <asm/kaslr.h>

		/*
		* max_low_pfn_mapped: highest direct mapped pfn under 4GB
		@@ -942,6 +943,8 @@ void __init setup_arch(char **cmdline_p)

		x86_init.oem.arch_setup();

		kernel_randomize_memory();

		iomem_resource.end = (1ULL << boot_cpu_data.x86_phys_bits) - 1;
		setup_memory_map();
		parse_setup_data();