kaslr.c 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright IBM Corp. 2019
  4. */
  5. #include <linux/pgtable.h>
  6. #include <asm/mem_detect.h>
  7. #include <asm/cpacf.h>
  8. #include <asm/timex.h>
  9. #include <asm/sclp.h>
  10. #include "compressed/decompressor.h"
  11. #include "boot.h"
  12. #define PRNG_MODE_TDES 1
  13. #define PRNG_MODE_SHA512 2
  14. #define PRNG_MODE_TRNG 3
  15. struct prno_parm {
  16. u32 res;
  17. u32 reseed_counter;
  18. u64 stream_bytes;
  19. u8 V[112];
  20. u8 C[112];
  21. };
  22. struct prng_parm {
  23. u8 parm_block[32];
  24. u32 reseed_counter;
  25. u64 byte_counter;
  26. };
  27. static int check_prng(void)
  28. {
  29. if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG)) {
  30. sclp_early_printk("KASLR disabled: CPU has no PRNG\n");
  31. return 0;
  32. }
  33. if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG))
  34. return PRNG_MODE_TRNG;
  35. if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN))
  36. return PRNG_MODE_SHA512;
  37. else
  38. return PRNG_MODE_TDES;
  39. }
  40. static int get_random(unsigned long limit, unsigned long *value)
  41. {
  42. struct prng_parm prng = {
  43. /* initial parameter block for tdes mode, copied from libica */
  44. .parm_block = {
  45. 0x0F, 0x2B, 0x8E, 0x63, 0x8C, 0x8E, 0xD2, 0x52,
  46. 0x64, 0xB7, 0xA0, 0x7B, 0x75, 0x28, 0xB8, 0xF4,
  47. 0x75, 0x5F, 0xD2, 0xA6, 0x8D, 0x97, 0x11, 0xFF,
  48. 0x49, 0xD8, 0x23, 0xF3, 0x7E, 0x21, 0xEC, 0xA0
  49. },
  50. };
  51. unsigned long seed, random;
  52. struct prno_parm prno;
  53. __u64 entropy[4];
  54. int mode, i;
  55. mode = check_prng();
  56. seed = get_tod_clock_fast();
  57. switch (mode) {
  58. case PRNG_MODE_TRNG:
  59. cpacf_trng(NULL, 0, (u8 *) &random, sizeof(random));
  60. break;
  61. case PRNG_MODE_SHA512:
  62. cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED, &prno, NULL, 0,
  63. (u8 *) &seed, sizeof(seed));
  64. cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN, &prno, (u8 *) &random,
  65. sizeof(random), NULL, 0);
  66. break;
  67. case PRNG_MODE_TDES:
  68. /* add entropy */
  69. *(unsigned long *) prng.parm_block ^= seed;
  70. for (i = 0; i < 16; i++) {
  71. cpacf_kmc(CPACF_KMC_PRNG, prng.parm_block,
  72. (u8 *) entropy, (u8 *) entropy,
  73. sizeof(entropy));
  74. memcpy(prng.parm_block, entropy, sizeof(entropy));
  75. }
  76. random = seed;
  77. cpacf_kmc(CPACF_KMC_PRNG, prng.parm_block, (u8 *) &random,
  78. (u8 *) &random, sizeof(random));
  79. break;
  80. default:
  81. return -1;
  82. }
  83. *value = random % limit;
  84. return 0;
  85. }
  86. /*
  87. * To randomize kernel base address we have to consider several facts:
  88. * 1. physical online memory might not be continuous and have holes. mem_detect
  89. * info contains list of online memory ranges we should consider.
  90. * 2. we have several memory regions which are occupied and we should not
  91. * overlap and destroy them. Currently safe_addr tells us the border below
  92. * which all those occupied regions are. We are safe to use anything above
  93. * safe_addr.
  94. * 3. the upper limit might apply as well, even if memory above that limit is
  95. * online. Currently those limitations are:
  96. * 3.1. Limit set by "mem=" kernel command line option
  97. * 3.2. memory reserved at the end for kasan initialization.
  98. * 4. kernel base address must be aligned to THREAD_SIZE (kernel stack size).
  99. * Which is required for CONFIG_CHECK_STACK. Currently THREAD_SIZE is 4 pages
  100. * (16 pages when the kernel is built with kasan enabled)
  101. * Assumptions:
  102. * 1. kernel size (including .bss size) and upper memory limit are page aligned.
  103. * 2. mem_detect memory region start is THREAD_SIZE aligned / end is PAGE_SIZE
  104. * aligned (in practice memory configurations granularity on z/VM and LPAR
  105. * is 1mb).
  106. *
  107. * To guarantee uniform distribution of kernel base address among all suitable
  108. * addresses we generate random value just once. For that we need to build a
  109. * continuous range in which every value would be suitable. We can build this
  110. * range by simply counting all suitable addresses (let's call them positions)
  111. * which would be valid as kernel base address. To count positions we iterate
  112. * over online memory ranges. For each range which is big enough for the
  113. * kernel image we count all suitable addresses we can put the kernel image at
  114. * that is
  115. * (end - start - kernel_size) / THREAD_SIZE + 1
  116. * Two functions count_valid_kernel_positions and position_to_address help
  117. * to count positions in memory range given and then convert position back
  118. * to address.
  119. */
  120. static unsigned long count_valid_kernel_positions(unsigned long kernel_size,
  121. unsigned long _min,
  122. unsigned long _max)
  123. {
  124. unsigned long start, end, pos = 0;
  125. int i;
  126. for_each_mem_detect_block(i, &start, &end) {
  127. if (_min >= end)
  128. continue;
  129. if (start >= _max)
  130. break;
  131. start = max(_min, start);
  132. end = min(_max, end);
  133. if (end - start < kernel_size)
  134. continue;
  135. pos += (end - start - kernel_size) / THREAD_SIZE + 1;
  136. }
  137. return pos;
  138. }
  139. static unsigned long position_to_address(unsigned long pos, unsigned long kernel_size,
  140. unsigned long _min, unsigned long _max)
  141. {
  142. unsigned long start, end;
  143. int i;
  144. for_each_mem_detect_block(i, &start, &end) {
  145. if (_min >= end)
  146. continue;
  147. if (start >= _max)
  148. break;
  149. start = max(_min, start);
  150. end = min(_max, end);
  151. if (end - start < kernel_size)
  152. continue;
  153. if ((end - start - kernel_size) / THREAD_SIZE + 1 >= pos)
  154. return start + (pos - 1) * THREAD_SIZE;
  155. pos -= (end - start - kernel_size) / THREAD_SIZE + 1;
  156. }
  157. return 0;
  158. }
  159. unsigned long get_random_base(unsigned long safe_addr)
  160. {
  161. unsigned long memory_limit = get_mem_detect_end();
  162. unsigned long base_pos, max_pos, kernel_size;
  163. unsigned long kasan_needs;
  164. int i;
  165. if (memory_end_set)
  166. memory_limit = min(memory_limit, memory_end);
  167. if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && INITRD_START && INITRD_SIZE) {
  168. if (safe_addr < INITRD_START + INITRD_SIZE)
  169. safe_addr = INITRD_START + INITRD_SIZE;
  170. }
  171. safe_addr = ALIGN(safe_addr, THREAD_SIZE);
  172. if ((IS_ENABLED(CONFIG_KASAN))) {
  173. /*
  174. * Estimate kasan memory requirements, which it will reserve
  175. * at the very end of available physical memory. To estimate
  176. * that, we take into account that kasan would require
  177. * 1/8 of available physical memory (for shadow memory) +
  178. * creating page tables for the whole memory + shadow memory
  179. * region (1 + 1/8). To keep page tables estimates simple take
  180. * the double of combined ptes size.
  181. */
  182. memory_limit = get_mem_detect_end();
  183. if (memory_end_set && memory_limit > memory_end)
  184. memory_limit = memory_end;
  185. /* for shadow memory */
  186. kasan_needs = memory_limit / 8;
  187. /* for paging structures */
  188. kasan_needs += (memory_limit + kasan_needs) / PAGE_SIZE /
  189. _PAGE_ENTRIES * _PAGE_TABLE_SIZE * 2;
  190. memory_limit -= kasan_needs;
  191. }
  192. kernel_size = vmlinux.image_size + vmlinux.bss_size;
  193. if (safe_addr + kernel_size > memory_limit)
  194. return 0;
  195. max_pos = count_valid_kernel_positions(kernel_size, safe_addr, memory_limit);
  196. if (!max_pos) {
  197. sclp_early_printk("KASLR disabled: not enough memory\n");
  198. return 0;
  199. }
  200. /* we need a value in the range [1, base_pos] inclusive */
  201. if (get_random(max_pos, &base_pos))
  202. return 0;
  203. return position_to_address(base_pos + 1, kernel_size, safe_addr, memory_limit);
  204. }