On Thu, Jul 25, 2019 at 03:16:28PM +0800, Jason Yan wrote:

Hi all, any comments?

I'm a fan of it, but I don't know ppc internals well enough to sanely
review the code. :) Some comments below on design...

On 2019/7/17 16:06, Jason Yan wrote:

quoted

This series implements KASLR for powerpc/fsl_booke/32, as a security
feature that deters exploit attempts relying on knowledge of the location
of kernel internals.

Since CONFIG_RELOCATABLE has already supported, what we need to do is
map or copy kernel to a proper place and relocate. Freescale Book-E
parts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1
entries are not suitable to map the kernel directly in a randomized
region, so we chose to copy the kernel to a proper place and restart to
relocate.

Entropy is derived from the banner and timer base, which will change every
build and boot. This not so much safe so additionally the bootloader may
pass entropy via the /chosen/kaslr-seed node in device tree.

Good: adding kaslr-seed is a good step here. Are there any x86-like
RDRAND or RDTSC to use? (Or maybe timer base here is similar to x86
RDTSC here?)

quoted

We will use the first 512M of the low memory to randomize the kernel
image. The memory will be split in 64M zones. We will use the lower 8
bit of the entropy to decide the index of the 64M zone. Then we chose a
16K aligned offset inside the 64M zone to put the kernel in.

Does this 16K granularity have any page table performance impact? My
understanding was that x86 needed to have 2M granularity due to its page
table layouts.

Why the 64M zones instead of just 16K granularity across the entire low
512M?

quoted

     KERNELBASE

         |-->   64M   <--|
         |               |
         +---------------+    +----------------+---------------+
         |               |....|    |kernel|    |               |
         +---------------+    +----------------+---------------+
         |                         |
         |----->   offset    <-----|

                               kimage_vaddr

We also check if we will overlap with some areas like the dtb area, the
initrd area or the crashkernel area. If we cannot find a proper area,
kaslr will be disabled and boot from the original kernel.

Jason Yan (10):
   powerpc: unify definition of M_IF_NEEDED
   powerpc: move memstart_addr and kernstart_addr to init-common.c
   powerpc: introduce kimage_vaddr to store the kernel base
   powerpc/fsl_booke/32: introduce create_tlb_entry() helper
   powerpc/fsl_booke/32: introduce reloc_kernel_entry() helper
   powerpc/fsl_booke/32: implement KASLR infrastructure
   powerpc/fsl_booke/32: randomize the kernel image offset
   powerpc/fsl_booke/kaslr: clear the original kernel if randomized
   powerpc/fsl_booke/kaslr: support nokaslr cmdline parameter
   powerpc/fsl_booke/kaslr: dump out kernel offset information on panic

Is there anything planned for other fixed-location things, like x86's
CONFIG_RANDOMIZE_MEMORY?

-- 
Kees Cook