Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3882b5f6 authored by Will Deacon's avatar Will Deacon Committed by Greg Kroah-Hartman
Browse files

arm64: kaslr: Put kernel vectors address in separate data page 




Commit 6c27c4082f4f upstream.

The literal pool entry for identifying the vectors base is the only piece
of information in the trampoline page that identifies the true location
of the kernel.

This patch moves it into a page-aligned region of the .rodata section
and maps this adjacent to the trampoline text via an additional fixmap
entry, which protects against any accidental leakage of the trampoline
contents.

Suggested-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: default avatarLaura Abbott <labbott@redhat.com>
Tested-by: default avatarShanker Donthineni <shankerd@codeaurora.org>
Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7fafcbb0

arch/arm64/include/asm/fixmap.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -59,6 +59,7 @@ enum fixed_addresses { 
#endif /* CONFIG_ACPI_APEI_GHES */

#endif /* CONFIG_ACPI_APEI_GHES */





#ifdef CONFIG_UNMAP_KERNEL_AT_EL0

#ifdef CONFIG_UNMAP_KERNEL_AT_EL0

	FIX_ENTRY_TRAMP_DATA,

	FIX_ENTRY_TRAMP_TEXT,

	FIX_ENTRY_TRAMP_TEXT,

#define TRAMP_VALIAS		(__fix_to_virt(FIX_ENTRY_TRAMP_TEXT))

#define TRAMP_VALIAS		(__fix_to_virt(FIX_ENTRY_TRAMP_TEXT))

#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */

#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */

arch/arm64/kernel/entry.S

+14 −0
Original line number Original line Diff line number Diff line
@@ -982,7 +982,13 @@ alternative_else_nop_endif 
	msr	tpidrro_el0, x30	// Restored in kernel_ventry

	msr	tpidrro_el0, x30	// Restored in kernel_ventry

	.endif

	.endif

	tramp_map_kernel	x30

	tramp_map_kernel	x30

#ifdef CONFIG_RANDOMIZE_BASE

	adr	x30, tramp_vectors + PAGE_SIZE

alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003

	ldr	x30, [x30]

#else

	ldr	x30, =vectors

	ldr	x30, =vectors

#endif

	prfm	plil1strm, [x30, #(1b - tramp_vectors)]

	prfm	plil1strm, [x30, #(1b - tramp_vectors)]

	msr	vbar_el1, x30

	msr	vbar_el1, x30

	add	x30, x30, #(1b - tramp_vectors)

	add	x30, x30, #(1b - tramp_vectors)
@@ -1025,6 +1031,14 @@ END(tramp_exit_compat) 




	.ltorg

	.ltorg

	.popsection				// .entry.tramp.text

	.popsection				// .entry.tramp.text

#ifdef CONFIG_RANDOMIZE_BASE

	.pushsection ".rodata", "a"

	.align PAGE_SHIFT

	.globl	__entry_tramp_data_start

__entry_tramp_data_start:

	.quad	vectors

	.popsection				// .rodata

#endif /* CONFIG_RANDOMIZE_BASE */

#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */

#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */





/*

/*

arch/arm64/kernel/vmlinux.lds.S

+4 −1
Original line number Original line Diff line number Diff line
@@ -251,7 +251,10 @@ ASSERT(__idmap_text_end - (__idmap_text_start & ~(SZ_4K - 1)) <= SZ_4K, 
ASSERT(__hibernate_exit_text_end - (__hibernate_exit_text_start & ~(SZ_4K - 1))

ASSERT(__hibernate_exit_text_end - (__hibernate_exit_text_start & ~(SZ_4K - 1))

	<= SZ_4K, "Hibernate exit text too big or misaligned")

	<= SZ_4K, "Hibernate exit text too big or misaligned")

#endif

#endif



#ifdef CONFIG_UNMAP_KERNEL_AT_EL0

ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) == PAGE_SIZE,

	"Entry trampoline text too big")

#endif

/*

/*

 * If padding is applied before .head.text, virt<->phys conversions will fail.

 * If padding is applied before .head.text, virt<->phys conversions will fail.

 */

 */

arch/arm64/mm/mmu.c

+9 −1
Original line number Original line Diff line number Diff line
@@ -541,8 +541,16 @@ static int __init map_entry_trampoline(void) 
	__create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,

	__create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,

			     prot, pgd_pgtable_alloc, 0);

			     prot, pgd_pgtable_alloc, 0);





	/* ...as well as the kernel page table */

	/* Map both the text and data into the kernel page table */

	__set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot);

	__set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot);

	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {

		extern char __entry_tramp_data_start[];



		__set_fixmap(FIX_ENTRY_TRAMP_DATA,

			     __pa_symbol(__entry_tramp_data_start),

			     PAGE_KERNEL_RO);

	}



	return 0;

	return 0;

}

}

core_initcall(map_entry_trampoline);

core_initcall(map_entry_trampoline);