[PATCH v2 1/1] powerpc: mm: support ARCH_MMAP_RND_BITS

powerpc: arch_mmap_rnd() uses hard-coded values, (23-PAGE_SHIFT) for
32-bit and (30-PAGE_SHIFT) for 64-bit, to generate the random offset
for the mmap base address.

This value represents a compromise between increased
ASLR effectiveness and avoiding address-space fragmentation.
Replace it with a Kconfig option, which is sensibly bounded, so that
platform developers may choose where to place this compromise.
Keep default values as new minimums.

This patch makes sure that now powerpc mmap arch_mmap_rnd() approach
is similar to other ARCHs like x86, arm64 and arm.

Cc: Alexander Graf <redacted>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Anatolij Gustschin <agust@denx.de>
Cc: Alistair Popple <redacted>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Vitaly Bordug <redacted>
Cc: Scott Wood <oss@buserror.net>
Cc: Kumar Gala <redacted>
Cc: Daniel Cashman <redacted>
Signed-off-by: Bhupesh Sharma <redacted>
Reviewed-by: Kees Cook <keescook at chromium.org>
---
Changes since v1:
v1 can be seen here (https://lists.ozlabs.org/pipermail/linuxppc-dev/2017-February/153594.html)
    - No functional change in this patch.
    - Added R-B from Kees.
    - Dropped PATCH 2/2 from v1 as recommended by Kees Cook.
	
 arch/powerpc/Kconfig   | 34 ++++++++++++++++++++++++++++++++++
 arch/powerpc/mm/mmap.c |  7 ++++---
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index a8ee573fe610..b4a843f68705 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig

@@ -22,6 +22,38 @@ config MMU
 	bool
 	default y
 
+config ARCH_MMAP_RND_BITS_MIN
+       default 5 if PPC_256K_PAGES && 32BIT
+       default 12 if PPC_256K_PAGES && 64BIT
+       default 7 if PPC_64K_PAGES && 32BIT
+       default 14 if PPC_64K_PAGES && 64BIT
+       default 9 if PPC_16K_PAGES && 32BIT
+       default 16 if PPC_16K_PAGES && 64BIT
+       default 11 if PPC_4K_PAGES && 32BIT
+       default 18 if PPC_4K_PAGES && 64BIT
+
+# max bits determined by the following formula:
+#  VA_BITS - PAGE_SHIFT - 4
+#  for e.g for 64K page and 64BIT = 48 - 16 - 4 = 28
+config ARCH_MMAP_RND_BITS_MAX
+       default 10 if PPC_256K_PAGES && 32BIT
+       default 26 if PPC_256K_PAGES && 64BIT
+       default 12 if PPC_64K_PAGES && 32BIT
+       default 28 if PPC_64K_PAGES && 64BIT
+       default 14 if PPC_16K_PAGES && 32BIT
+       default 30 if PPC_16K_PAGES && 64BIT
+       default 16 if PPC_4K_PAGES && 32BIT
+       default 32 if PPC_4K_PAGES && 64BIT
+
+config ARCH_MMAP_RND_COMPAT_BITS_MIN
+       default 5 if PPC_256K_PAGES
+       default 7 if PPC_64K_PAGES
+       default 9 if PPC_16K_PAGES
+       default 11
+
+config ARCH_MMAP_RND_COMPAT_BITS_MAX
+       default 16
+
 config HAVE_SETUP_PER_CPU_AREA
 	def_bool PPC64
 

@@ -100,6 +132,8 @@ config PPC
 	select HAVE_EFFICIENT_UNALIGNED_ACCESS if !(CPU_LITTLE_ENDIAN && POWER7_CPU)
 	select HAVE_KPROBES
 	select HAVE_ARCH_KGDB
+	select HAVE_ARCH_MMAP_RND_BITS
+	select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
 	select HAVE_KRETPROBES
 	select HAVE_ARCH_TRACEHOOK
 	select HAVE_MEMBLOCK

diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 2f1e44362198..babf59faab3b 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c

@@ -60,11 +60,12 @@ unsigned long arch_mmap_rnd(void)
 {
 	unsigned long rnd;
 
-	/* 8MB for 32bit, 1GB for 64bit */
+#ifdef CONFIG_COMPAT
 	if (is_32bit_task())
-		rnd = get_random_long() % (1<<(23-PAGE_SHIFT));
+		rnd = get_random_long() & ((1UL << mmap_rnd_compat_bits) - 1);
 	else
-		rnd = get_random_long() % (1UL<<(30-PAGE_SHIFT));
+#endif
+		rnd = get_random_long() & ((1UL << mmap_rnd_bits) - 1);
 
 	return rnd << PAGE_SHIFT;
 }

-- 
2.7.4

On Thu, Feb 2, 2017 at 9:11 PM, Bhupesh Sharma [off-list ref] wrote:

powerpc: arch_mmap_rnd() uses hard-coded values, (23-PAGE_SHIFT) for
32-bit and (30-PAGE_SHIFT) for 64-bit, to generate the random offset
for the mmap base address.

This value represents a compromise between increased
ASLR effectiveness and avoiding address-space fragmentation.
Replace it with a Kconfig option, which is sensibly bounded, so that
platform developers may choose where to place this compromise.
Keep default values as new minimums.

This patch makes sure that now powerpc mmap arch_mmap_rnd() approach
is similar to other ARCHs like x86, arm64 and arm.

Cc: Alexander Graf <redacted>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Anatolij Gustschin <agust@denx.de>
Cc: Alistair Popple <redacted>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Vitaly Bordug <redacted>
Cc: Scott Wood <oss@buserror.net>
Cc: Kumar Gala <redacted>
Cc: Daniel Cashman <redacted>
Signed-off-by: Bhupesh Sharma <redacted>
Reviewed-by: Kees Cook <keescook at chromium.org>

This " at " should be "@", but otherwise, yay v2! :)

-Kees

-- 
Kees Cook
Pixel Security

Bhupesh Sharma [off-list ref] writes:

powerpc: arch_mmap_rnd() uses hard-coded values, (23-PAGE_SHIFT) for
32-bit and (30-PAGE_SHIFT) for 64-bit, to generate the random offset
for the mmap base address.

This value represents a compromise between increased
ASLR effectiveness and avoiding address-space fragmentation.
Replace it with a Kconfig option, which is sensibly bounded, so that
platform developers may choose where to place this compromise.
Keep default values as new minimums.

This patch makes sure that now powerpc mmap arch_mmap_rnd() approach
is similar to other ARCHs like x86, arm64 and arm.

Cc: Alexander Graf <redacted>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Anatolij Gustschin <agust@denx.de>
Cc: Alistair Popple <redacted>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Vitaly Bordug <redacted>
Cc: Scott Wood <oss@buserror.net>
Cc: Kumar Gala <redacted>
Cc: Daniel Cashman <redacted>
Signed-off-by: Bhupesh Sharma <redacted>
Reviewed-by: Kees Cook <keescook at chromium.org>
---
Changes since v1:
v1 can be seen here (https://lists.ozlabs.org/pipermail/linuxppc-dev/2017-February/153594.html)
    - No functional change in this patch.
    - Added R-B from Kees.
    - Dropped PATCH 2/2 from v1 as recommended by Kees Cook.

Thanks for v2.

But I replied to your v1 with some comments, did you see them?

cheers

On Sat, Feb 4, 2017 at 6:13 AM, Kees Cook [off-list ref] wrote:

On Thu, Feb 2, 2017 at 9:11 PM, Bhupesh Sharma [off-list ref] wrote:

quoted

powerpc: arch_mmap_rnd() uses hard-coded values, (23-PAGE_SHIFT) for
32-bit and (30-PAGE_SHIFT) for 64-bit, to generate the random offset
for the mmap base address.

This value represents a compromise between increased
ASLR effectiveness and avoiding address-space fragmentation.
Replace it with a Kconfig option, which is sensibly bounded, so that
platform developers may choose where to place this compromise.
Keep default values as new minimums.

This patch makes sure that now powerpc mmap arch_mmap_rnd() approach
is similar to other ARCHs like x86, arm64 and arm.

Cc: Alexander Graf <redacted>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Anatolij Gustschin <agust@denx.de>
Cc: Alistair Popple <redacted>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Vitaly Bordug <redacted>
Cc: Scott Wood <oss@buserror.net>
Cc: Kumar Gala <redacted>
Cc: Daniel Cashman <redacted>
Signed-off-by: Bhupesh Sharma <redacted>
Reviewed-by: Kees Cook <keescook at chromium.org>

This " at " should be "@", but otherwise, yay v2! :)

Noted. Sorry for the typo :(

Regards,
Bhupesh

Hi Michael,

On Tue, Feb 7, 2017 at 7:57 AM, Michael Ellerman [off-list ref] wrote:

Bhupesh Sharma [off-list ref] writes:

quoted

powerpc: arch_mmap_rnd() uses hard-coded values, (23-PAGE_SHIFT) for
32-bit and (30-PAGE_SHIFT) for 64-bit, to generate the random offset
for the mmap base address.

This value represents a compromise between increased
ASLR effectiveness and avoiding address-space fragmentation.
Replace it with a Kconfig option, which is sensibly bounded, so that
platform developers may choose where to place this compromise.
Keep default values as new minimums.

This patch makes sure that now powerpc mmap arch_mmap_rnd() approach
is similar to other ARCHs like x86, arm64 and arm.

Cc: Alexander Graf <redacted>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Anatolij Gustschin <agust@denx.de>
Cc: Alistair Popple <redacted>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Vitaly Bordug <redacted>
Cc: Scott Wood <oss@buserror.net>
Cc: Kumar Gala <redacted>
Cc: Daniel Cashman <redacted>
Signed-off-by: Bhupesh Sharma <redacted>
Reviewed-by: Kees Cook <keescook at chromium.org>
---
Changes since v1:
v1 can be seen here (https://lists.ozlabs.org/pipermail/linuxppc-dev/2017-February/153594.html)
    - No functional change in this patch.
    - Added R-B from Kees.
    - Dropped PATCH 2/2 from v1 as recommended by Kees Cook.

Thanks for v2.

But I replied to your v1 with some comments, did you see them?

I have replied to your comments on the original thread.
Please share your views and if possible share your test results on the
PPC setups you might have at your end.

Thanks,
Bhupesh