The NetBSD Project

CVS log for src/sys/arch/amd64/stand/prekern/mm.c

[BACK] Up to [cvs.NetBSD.org] / src / sys / arch / amd64 / stand / prekern

Request diff between arbitrary revisions


Default branch: MAIN
Current tag: MAIN


Revision 1.22 / (download) - annotate - [select for diffs], Wed Jun 20 11:49:37 2018 UTC (3 months ago) by maxv
Branch: MAIN
CVS Tags: phil-wifi-base, phil-wifi, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, HEAD
Changes since 1.21: +2 -1 lines
Diff to previous 1.21 (colored)

Add and use bootspace.smodule. Initialize it in locore/prekern to better
hide the specifics from the "upper" layers. This allows for greater
flexibility.

Revision 1.21 / (download) - annotate - [select for diffs], Thu Dec 21 14:32:06 2017 UTC (8 months, 4 weeks ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-base, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: pgoyette-compat
Changes since 1.20: +1 -5 lines
Diff to previous 1.20 (colored)

Remove unused macros.

Revision 1.20 / (download) - annotate - [select for diffs], Sun Nov 26 14:29:48 2017 UTC (9 months, 3 weeks ago) by maxv
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202
Branch point for: tls-maxphys
Changes since 1.19: +16 -3 lines
Diff to previous 1.19 (colored)

Oh, damn. Obviously I forgot one case here: an already-mapped region could
be contained entirely in the region we're trying to create. So go through
another round. While here add mm_reenter_pa, and make sure the va given to
mm_enter_pa does not already point to something.

Revision 1.19 / (download) - annotate - [select for diffs], Sun Nov 26 11:01:09 2017 UTC (9 months, 3 weeks ago) by maxv
Branch: MAIN
Changes since 1.18: +4 -11 lines
Diff to previous 1.18 (colored)

Add a PRNG for the prekern, based on SHA512. The formula is basically:

	Y0   = SHA512(entropy-file, 256bit rdseed, 64bit rdtsc)
	Yn+1 = SHA512(256bit lowerhalf(Yn), 256bit rdseed, 64bit rdtsc)

On each round, random values are taken from the higher half of Yn. If
rdseed is not available, rdrand is used.

The SHA1 checksum of entropy-file is verified. However, the rndsave_t::data
field is not updated by the prekern, because the area is accessed via the
read-only view we created in locore. I like this design, so it will have
to be updated differently.

Revision 1.18 / (download) - annotate - [select for diffs], Tue Nov 21 07:56:05 2017 UTC (9 months, 4 weeks ago) by maxv
Branch: MAIN
Changes since 1.17: +40 -52 lines
Diff to previous 1.17 (colored)

Clean up and add some ASSERTs.

Revision 1.17 / (download) - annotate - [select for diffs], Wed Nov 15 20:45:16 2017 UTC (10 months ago) by maxv
Branch: MAIN
Changes since 1.16: +15 -12 lines
Diff to previous 1.16 (colored)

Small cleanup.

Revision 1.16 / (download) - annotate - [select for diffs], Wed Nov 15 20:25:29 2017 UTC (10 months ago) by maxv
Branch: MAIN
Changes since 1.15: +2 -2 lines
Diff to previous 1.15 (colored)

Mmh, should be <=.

Revision 1.15 / (download) - annotate - [select for diffs], Wed Nov 15 18:44:34 2017 UTC (10 months ago) by maxv
Branch: MAIN
Changes since 1.14: +4 -0 lines
Diff to previous 1.14 (colored)

Define MM_PROT_* locally.

Revision 1.14 / (download) - annotate - [select for diffs], Wed Nov 15 18:02:36 2017 UTC (10 months ago) by maxv
Branch: MAIN
Changes since 1.13: +46 -10 lines
Diff to previous 1.13 (colored)

Support large pages on KASLR kernels, in a way that does not reduce
randomness, but on the contrary that increases it.

The size of the kernel sub-blocks is changed to be 1MB. This produces a
kernel with sections that are always < 2MB in size, that can fit a large
page.

Each section is put in a 2MB physical chunk. In this chunk, there is a
padding of approximately 1MB. The prekern uses a random offset aligned to
sh_addralign, to shift the section in physical memory.

For example, physical memory layout created by the bootloader for .text.4
and .rodata.0:
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
 |+---------------+                  |+---------------+                  |
 ||    .text.4    |       PAD        ||   .rodata.0   |       PAD        |
 |+---------------+                  |+---------------+                  |
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
 PA                                  PA+2MB                         PA+4MB

Then, physical memory layout, after having been shifted by the prekern:
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
 | P +---------------+               |          +---------------+        |
 | A |    .text.4    |      PAD      |   PAD    |   .rodata.0   |   PAD  |
 | D +---------------+               |          +---------------+        |
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
 PA                                  PA+2MB                         PA+4MB

The kernel maps these 2MB physical chunks with 2MB large pages. Therefore,
randomness is enforced at both the virtual and physical levels, and the
resulting entropy is higher than that of our current implementaion until
now.

The padding around the section is filled by the prekern. Not to consume
too much memory, the sections that are smaller than PAGE_SIZE are mapped
with normal pages - because there is no point in optimizing them. In these
normal pages, the same shift is applied.

This change has two additional advantages: (a) the cache attacks based on
the TLB are mostly mitigated, because even if you are able to determine
that a given page-aligned range is mapped as executable you don't know
where exactly within that range the section actually begins, and (b) given
that we are slightly randomizing the physical layout we are making some
rare physical attacks more difficult to conduct.

NOTE: after this change you need to update GENERIC_KASLR / prekern /
bootloader.

Revision 1.13 / (download) - annotate - [select for diffs], Tue Nov 14 07:06:34 2017 UTC (10 months ago) by maxv
Branch: MAIN
Changes since 1.12: +7 -8 lines
Diff to previous 1.12 (colored)

Add -Wstrict-prototypes, and fix each warning.

Revision 1.12 / (download) - annotate - [select for diffs], Mon Nov 13 21:14:04 2017 UTC (10 months ago) by maxv
Branch: MAIN
Changes since 1.11: +15 -56 lines
Diff to previous 1.11 (colored)

Change the mapping logic: don't group sections of the same type into
segments, and rather map each section independently at a random VA.

In particular, .data and .bss are not merged anymore and reside at
different addresses.

Revision 1.11 / (download) - annotate - [select for diffs], Sat Nov 11 13:50:57 2017 UTC (10 months, 1 week ago) by maxv
Branch: MAIN
Changes since 1.10: +10 -16 lines
Diff to previous 1.10 (colored)

Detect collisions from bootspace directly.

Revision 1.10 / (download) - annotate - [select for diffs], Sat Nov 11 12:51:06 2017 UTC (10 months, 1 week ago) by maxv
Branch: MAIN
Changes since 1.9: +55 -18 lines
Diff to previous 1.9 (colored)

Modify the layout of the bootspace structure, in such a way that it can
contain several kernel segments of the same type (eg several .text
segments). Some parts are still a bit messy but will be cleaned up soon.

I cannot compile-test this change on i386, but it seems fine enough.

NOTE: you need to rebuild and reinstall a new prekern after this change.

Revision 1.9 / (download) - annotate - [select for diffs], Thu Nov 9 15:24:39 2017 UTC (10 months, 1 week ago) by maxv
Branch: MAIN
Changes since 1.8: +20 -4 lines
Diff to previous 1.8 (colored)

Fill in the page padding. Only .text is pre-filled by the ld script, but
this will change in the future.

Revision 1.8 / (download) - annotate - [select for diffs], Sun Nov 5 16:26:15 2017 UTC (10 months, 2 weeks ago) by maxv
Branch: MAIN
Changes since 1.7: +19 -5 lines
Diff to previous 1.7 (colored)

Mprotect the segments in mm.c using bootspace, and remove the now unused
fields of elfinfo.

Revision 1.7 / (download) - annotate - [select for diffs], Sun Oct 29 11:38:43 2017 UTC (10 months, 3 weeks ago) by maxv
Branch: MAIN
Changes since 1.6: +4 -1 lines
Diff to previous 1.6 (colored)

Fix a few error messages, and be a little more verbose.

Revision 1.6 / (download) - annotate - [select for diffs], Sun Oct 29 11:28:30 2017 UTC (10 months, 3 weeks ago) by maxv
Branch: MAIN
Changes since 1.5: +194 -32 lines
Diff to previous 1.5 (colored)

Randomize the kernel segments independently. That is to say, put text,
rodata and data at different addresses (and in a random order).

To achieve that, the mapping order in the prekern is changed. Until now,
we were creating the kernel map the following way:
	-> choose a random VA
	-> map [kernpa_start; kernpa_end[ at this VA
	-> parse the ELF structures from there
	-> determine where exactly the kernel segments are located
	-> relocate etc
Now, we are doing:
	-> create a read-only view of [kernpa_start; kernpa_end[
	-> from this view, compute the size of the "head" region
	-> choose a random VA in the HEAD window, and map the head there
	-> for each region in (text, rodata, data, boot)
		-> compute the size of the region from the RO view
		-> choose a random VA in the KASLR window
		-> map the region there
	-> relocate etc

Each time we map a region, we initialize its bootspace fields right away.

The "head" region must be put before the other regions in memory, because
the kernel uses (headva + sh_offset) to get the addresses of the symbols,
and the offset is unsigned.

Given that the head does not have an mcmodel constraint, its location is
randomized in a window located below the KASLR window.

The rest of the regions being in the same window, we need to detect
collisions.

Note that the module map is embedded in the "boot" region, and that
therefore its location is randomized too.

Revision 1.5 / (download) - annotate - [select for diffs], Sat Oct 28 19:28:11 2017 UTC (10 months, 3 weeks ago) by maxv
Branch: MAIN
Changes since 1.4: +14 -6 lines
Diff to previous 1.4 (colored)

Fix a mistake I made in the very first revision. The calculation of the
number of slots was incorrect in some cases, and it could cause the
prekern to fault right away at boot time, or the kernel to fault when
loading kernel modules near the end of the module map.

The variables are divided by PAGE_SIZE to prevent integer overflows.

Revision 1.4 / (download) - annotate - [select for diffs], Mon Oct 23 06:00:59 2017 UTC (10 months, 4 weeks ago) by maxv
Branch: MAIN
Changes since 1.3: +2 -2 lines
Diff to previous 1.3 (colored)

Add two XXXs, so that people don't get confused, a fifth region is needed
anyway.

Revision 1.3 / (download) - annotate - [select for diffs], Wed Oct 18 17:12:42 2017 UTC (11 months ago) by maxv
Branch: MAIN
Changes since 1.2: +35 -22 lines
Diff to previous 1.2 (colored)

If a branch is already there, use it and don't create a new one. This way
we can call mm_map_tree twice with neighboring regions.

Revision 1.2 / (download) - annotate - [select for diffs], Sun Oct 15 06:37:32 2017 UTC (11 months ago) by maxv
Branch: MAIN
Changes since 1.1: +38 -57 lines
Diff to previous 1.1 (colored)

Descend the page tree from L4 to L1, instead of allocating a separate
branch and linking it at the end. This way we don't need to allocate VA
from the (tiny) prekern map.

Revision 1.1 / (download) - annotate - [select for diffs], Tue Oct 10 09:29:14 2017 UTC (11 months, 1 week ago) by maxv
Branch: MAIN

Add the amd64 prekern. It is a kernel relocator used for Kernel ASLR (see
tech-kern@). It works, but is not yet linked to the build system, because
I can't build a distribution right now.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>