2008-04-17 23:40:45 +08:00
|
|
|
/*
|
|
|
|
|
* Debug helper to dump the current kernel pagetables of the system
|
|
|
|
|
* so that we can see what the various memory ranges are set to.
|
|
|
|
|
*
|
|
|
|
|
* (C) Copyright 2008 Intel Corporation
|
|
|
|
|
*
|
|
|
|
|
* Author: Arjan van de Ven <arjan@linux.intel.com>
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
|
* as published by the Free Software Foundation; version 2
|
|
|
|
|
* of the License.
|
|
|
|
|
*/
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
#include <linux/debugfs.h>
|
2017-07-24 23:25:58 +08:00
|
|
|
#include <linux/kasan.h>
|
2008-04-17 23:40:45 +08:00
|
|
|
#include <linux/mm.h>
|
2016-07-14 08:18:54 +08:00
|
|
|
#include <linux/init.h>
|
2017-02-10 17:54:05 +08:00
|
|
|
#include <linux/sched.h>
|
2008-04-17 23:40:45 +08:00
|
|
|
#include <linux/seq_file.h>
|
|
|
|
|
|
|
|
|
|
#include <asm/pgtable.h>
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* The dumper groups pagetable entries of the same type into one, and for
|
|
|
|
|
* that it needs to keep some state when walking, and flush this state
|
|
|
|
|
* when a "break" in the continuity is found.
|
|
|
|
|
*/
|
|
|
|
|
struct pg_state {
|
|
|
|
|
int level;
|
|
|
|
|
pgprot_t current_prot;
|
|
|
|
|
unsigned long start_address;
|
|
|
|
|
unsigned long current_address;
|
2008-04-17 23:40:45 +08:00
|
|
|
const struct addr_marker *marker;
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
unsigned long lines;
|
2014-01-18 19:48:14 +08:00
|
|
|
bool to_dmesg;
|
2015-10-06 00:55:20 +08:00
|
|
|
bool check_wx;
|
|
|
|
|
unsigned long wx_pages;
|
2008-04-17 23:40:45 +08:00
|
|
|
};
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
struct addr_marker {
|
|
|
|
|
unsigned long start_address;
|
|
|
|
|
const char *name;
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
unsigned long max_lines;
|
2008-04-17 23:40:45 +08:00
|
|
|
};
|
|
|
|
|
|
2017-12-21 01:07:42 +08:00
|
|
|
/* Address space markers hints */
|
|
|
|
|
|
|
|
|
|
#ifdef CONFIG_X86_64
|
|
|
|
|
|
2010-07-21 06:19:46 +08:00
|
|
|
enum address_markers_idx {
|
|
|
|
|
USER_SPACE_NR = 0,
|
|
|
|
|
KERNEL_SPACE_NR,
|
|
|
|
|
LOW_KERNEL_NR,
|
x86/pti: Put the LDT in its own PGD if PTI is on
With PTI enabled, the LDT must be mapped in the usermode tables somewhere.
The LDT is per process, i.e. per mm.
An earlier approach mapped the LDT on context switch into a fixmap area,
but that's a big overhead and exhausted the fixmap space when NR_CPUS got
big.
Take advantage of the fact that there is an address space hole which
provides a completely unused pgd. Use this pgd to manage per-mm LDT
mappings.
This has a down side: the LDT isn't (currently) randomized, and an attack
that can write the LDT is instant root due to call gates (thanks, AMD, for
leaving call gates in AMD64 but designing them wrong so they're only useful
for exploits). This can be mitigated by making the LDT read-only or
randomizing the mapping, either of which is strightforward on top of this
patch.
This will significantly slow down LDT users, but that shouldn't matter for
important workloads -- the LDT is only used by DOSEMU(2), Wine, and very
old libc implementations.
[ tglx: Cleaned it up. ]
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-12 23:56:45 +08:00
|
|
|
#if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL)
|
|
|
|
|
LDT_NR,
|
|
|
|
|
#endif
|
2010-07-21 06:19:46 +08:00
|
|
|
VMALLOC_START_NR,
|
|
|
|
|
VMEMMAP_START_NR,
|
2017-02-14 18:08:39 +08:00
|
|
|
#ifdef CONFIG_KASAN
|
|
|
|
|
KASAN_SHADOW_START_NR,
|
|
|
|
|
KASAN_SHADOW_END_NR,
|
x86/pti: Put the LDT in its own PGD if PTI is on
With PTI enabled, the LDT must be mapped in the usermode tables somewhere.
The LDT is per process, i.e. per mm.
An earlier approach mapped the LDT on context switch into a fixmap area,
but that's a big overhead and exhausted the fixmap space when NR_CPUS got
big.
Take advantage of the fact that there is an address space hole which
provides a completely unused pgd. Use this pgd to manage per-mm LDT
mappings.
This has a down side: the LDT isn't (currently) randomized, and an attack
that can write the LDT is instant root due to call gates (thanks, AMD, for
leaving call gates in AMD64 but designing them wrong so they're only useful
for exploits). This can be mitigated by making the LDT read-only or
randomizing the mapping, either of which is strightforward on top of this
patch.
This will significantly slow down LDT users, but that shouldn't matter for
important workloads -- the LDT is only used by DOSEMU(2), Wine, and very
old libc implementations.
[ tglx: Cleaned it up. ]
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-12 23:56:45 +08:00
|
|
|
#endif
|
2018-01-04 20:01:40 +08:00
|
|
|
CPU_ENTRY_AREA_NR,
|
x86/pti: Put the LDT in its own PGD if PTI is on
With PTI enabled, the LDT must be mapped in the usermode tables somewhere.
The LDT is per process, i.e. per mm.
An earlier approach mapped the LDT on context switch into a fixmap area,
but that's a big overhead and exhausted the fixmap space when NR_CPUS got
big.
Take advantage of the fact that there is an address space hole which
provides a completely unused pgd. Use this pgd to manage per-mm LDT
mappings.
This has a down side: the LDT isn't (currently) randomized, and an attack
that can write the LDT is instant root due to call gates (thanks, AMD, for
leaving call gates in AMD64 but designing them wrong so they're only useful
for exploits). This can be mitigated by making the LDT read-only or
randomizing the mapping, either of which is strightforward on top of this
patch.
This will significantly slow down LDT users, but that shouldn't matter for
important workloads -- the LDT is only used by DOSEMU(2), Wine, and very
old libc implementations.
[ tglx: Cleaned it up. ]
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-12 23:56:45 +08:00
|
|
|
#if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL)
|
|
|
|
|
LDT_NR,
|
2017-02-14 18:08:39 +08:00
|
|
|
#endif
|
2017-12-21 01:07:42 +08:00
|
|
|
#ifdef CONFIG_X86_ESPFIX64
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
ESPFIX_START_NR,
|
2017-12-21 01:07:42 +08:00
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_EFI
|
|
|
|
|
EFI_END_NR,
|
|
|
|
|
#endif
|
2010-07-21 06:19:46 +08:00
|
|
|
HIGH_KERNEL_NR,
|
|
|
|
|
MODULES_VADDR_NR,
|
|
|
|
|
MODULES_END_NR,
|
2017-12-21 01:07:42 +08:00
|
|
|
FIXADDR_START_NR,
|
|
|
|
|
END_OF_SPACE_NR,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct addr_marker address_markers[] = {
|
|
|
|
|
[USER_SPACE_NR] = { 0, "User Space" },
|
|
|
|
|
[KERNEL_SPACE_NR] = { (1UL << 63), "Kernel Space" },
|
|
|
|
|
[LOW_KERNEL_NR] = { 0UL, "Low Kernel Mapping" },
|
|
|
|
|
[VMALLOC_START_NR] = { 0UL, "vmalloc() Area" },
|
|
|
|
|
[VMEMMAP_START_NR] = { 0UL, "Vmemmap" },
|
|
|
|
|
#ifdef CONFIG_KASAN
|
2018-02-14 19:16:55 +08:00
|
|
|
/*
|
|
|
|
|
* These fields get initialized with the (dynamic)
|
|
|
|
|
* KASAN_SHADOW_{START,END} values in pt_dump_init().
|
|
|
|
|
*/
|
|
|
|
|
[KASAN_SHADOW_START_NR] = { 0UL, "KASAN shadow" },
|
|
|
|
|
[KASAN_SHADOW_END_NR] = { 0UL, "KASAN shadow end" },
|
x86/pti: Put the LDT in its own PGD if PTI is on
With PTI enabled, the LDT must be mapped in the usermode tables somewhere.
The LDT is per process, i.e. per mm.
An earlier approach mapped the LDT on context switch into a fixmap area,
but that's a big overhead and exhausted the fixmap space when NR_CPUS got
big.
Take advantage of the fact that there is an address space hole which
provides a completely unused pgd. Use this pgd to manage per-mm LDT
mappings.
This has a down side: the LDT isn't (currently) randomized, and an attack
that can write the LDT is instant root due to call gates (thanks, AMD, for
leaving call gates in AMD64 but designing them wrong so they're only useful
for exploits). This can be mitigated by making the LDT read-only or
randomizing the mapping, either of which is strightforward on top of this
patch.
This will significantly slow down LDT users, but that shouldn't matter for
important workloads -- the LDT is only used by DOSEMU(2), Wine, and very
old libc implementations.
[ tglx: Cleaned it up. ]
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-12-12 23:56:45 +08:00
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_MODIFY_LDT_SYSCALL
|
2018-02-14 19:16:52 +08:00
|
|
|
[LDT_NR] = { 0UL, "LDT remap" },
|
2017-12-21 01:07:42 +08:00
|
|
|
#endif
|
2017-12-21 01:51:31 +08:00
|
|
|
[CPU_ENTRY_AREA_NR] = { CPU_ENTRY_AREA_BASE,"CPU entry Area" },
|
2017-12-21 01:07:42 +08:00
|
|
|
#ifdef CONFIG_X86_ESPFIX64
|
|
|
|
|
[ESPFIX_START_NR] = { ESPFIX_BASE_ADDR, "ESPfix Area", 16 },
|
|
|
|
|
#endif
|
|
|
|
|
#ifdef CONFIG_EFI
|
|
|
|
|
[EFI_END_NR] = { EFI_VA_END, "EFI Runtime Services" },
|
|
|
|
|
#endif
|
|
|
|
|
[HIGH_KERNEL_NR] = { __START_KERNEL_map, "High Kernel Mapping" },
|
|
|
|
|
[MODULES_VADDR_NR] = { MODULES_VADDR, "Modules" },
|
|
|
|
|
[MODULES_END_NR] = { MODULES_END, "End Modules" },
|
|
|
|
|
[FIXADDR_START_NR] = { FIXADDR_START, "Fixmap Area" },
|
|
|
|
|
[END_OF_SPACE_NR] = { -1, NULL }
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#else /* CONFIG_X86_64 */
|
|
|
|
|
|
|
|
|
|
enum address_markers_idx {
|
|
|
|
|
USER_SPACE_NR = 0,
|
2010-07-21 06:19:46 +08:00
|
|
|
KERNEL_SPACE_NR,
|
|
|
|
|
VMALLOC_START_NR,
|
|
|
|
|
VMALLOC_END_NR,
|
2017-12-21 01:07:42 +08:00
|
|
|
#ifdef CONFIG_HIGHMEM
|
2010-07-21 06:19:46 +08:00
|
|
|
PKMAP_BASE_NR,
|
|
|
|
|
#endif
|
2017-12-21 01:51:31 +08:00
|
|
|
CPU_ENTRY_AREA_NR,
|
2017-12-21 01:07:42 +08:00
|
|
|
FIXADDR_START_NR,
|
|
|
|
|
END_OF_SPACE_NR,
|
2010-07-21 06:19:46 +08:00
|
|
|
};
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
static struct addr_marker address_markers[] = {
|
2017-12-21 01:07:42 +08:00
|
|
|
[USER_SPACE_NR] = { 0, "User Space" },
|
|
|
|
|
[KERNEL_SPACE_NR] = { PAGE_OFFSET, "Kernel Mapping" },
|
|
|
|
|
[VMALLOC_START_NR] = { 0UL, "vmalloc() Area" },
|
|
|
|
|
[VMALLOC_END_NR] = { 0UL, "vmalloc() End" },
|
|
|
|
|
#ifdef CONFIG_HIGHMEM
|
|
|
|
|
[PKMAP_BASE_NR] = { 0UL, "Persistent kmap() Area" },
|
2008-04-17 23:40:45 +08:00
|
|
|
#endif
|
2017-12-21 01:51:31 +08:00
|
|
|
[CPU_ENTRY_AREA_NR] = { 0UL, "CPU entry area" },
|
2017-12-21 01:07:42 +08:00
|
|
|
[FIXADDR_START_NR] = { 0UL, "Fixmap area" },
|
|
|
|
|
[END_OF_SPACE_NR] = { -1, NULL }
|
2008-04-17 23:40:45 +08:00
|
|
|
};
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-12-21 01:07:42 +08:00
|
|
|
#endif /* !CONFIG_X86_64 */
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
/* Multipliers for offsets within the PTEs */
|
|
|
|
|
#define PTE_LEVEL_MULT (PAGE_SIZE)
|
|
|
|
|
#define PMD_LEVEL_MULT (PTRS_PER_PTE * PTE_LEVEL_MULT)
|
|
|
|
|
#define PUD_LEVEL_MULT (PTRS_PER_PMD * PMD_LEVEL_MULT)
|
2017-03-28 18:48:06 +08:00
|
|
|
#define P4D_LEVEL_MULT (PTRS_PER_PUD * PUD_LEVEL_MULT)
|
2017-04-12 22:36:34 +08:00
|
|
|
#define PGD_LEVEL_MULT (PTRS_PER_P4D * P4D_LEVEL_MULT)
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2014-01-18 19:48:14 +08:00
|
|
|
#define pt_dump_seq_printf(m, to_dmesg, fmt, args...) \
|
|
|
|
|
({ \
|
|
|
|
|
if (to_dmesg) \
|
|
|
|
|
printk(KERN_INFO fmt, ##args); \
|
|
|
|
|
else \
|
|
|
|
|
if (m) \
|
|
|
|
|
seq_printf(m, fmt, ##args); \
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
#define pt_dump_cont_printf(m, to_dmesg, fmt, args...) \
|
|
|
|
|
({ \
|
|
|
|
|
if (to_dmesg) \
|
|
|
|
|
printk(KERN_CONT fmt, ##args); \
|
|
|
|
|
else \
|
|
|
|
|
if (m) \
|
|
|
|
|
seq_printf(m, fmt, ##args); \
|
|
|
|
|
})
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
/*
|
|
|
|
|
* Print a readable form of a pgprot_t to the seq_file
|
|
|
|
|
*/
|
2014-01-18 19:48:14 +08:00
|
|
|
static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
2008-04-17 23:40:45 +08:00
|
|
|
pgprotval_t pr = pgprot_val(prot);
|
|
|
|
|
static const char * const level_name[] =
|
2017-07-17 06:59:48 +08:00
|
|
|
{ "cr3", "pgd", "p4d", "pud", "pmd", "pte" };
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-12-16 08:14:39 +08:00
|
|
|
if (!(pr & _PAGE_PRESENT)) {
|
2008-04-17 23:40:45 +08:00
|
|
|
/* Not present */
|
2014-11-03 21:02:01 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2008-04-17 23:40:45 +08:00
|
|
|
} else {
|
|
|
|
|
if (pr & _PAGE_USER)
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "USR ");
|
2008-04-17 23:40:45 +08:00
|
|
|
else
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2008-04-17 23:40:45 +08:00
|
|
|
if (pr & _PAGE_RW)
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "RW ");
|
2008-04-17 23:40:45 +08:00
|
|
|
else
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "ro ");
|
2008-04-17 23:40:45 +08:00
|
|
|
if (pr & _PAGE_PWT)
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "PWT ");
|
2008-04-17 23:40:45 +08:00
|
|
|
else
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2008-04-17 23:40:45 +08:00
|
|
|
if (pr & _PAGE_PCD)
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "PCD ");
|
2008-04-17 23:40:45 +08:00
|
|
|
else
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2014-11-03 21:02:01 +08:00
|
|
|
/* Bit 7 has a different meaning on level 3 vs 4 */
|
2017-07-17 06:59:48 +08:00
|
|
|
if (level <= 4 && pr & _PAGE_PSE)
|
2014-11-03 21:02:01 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "PSE ");
|
|
|
|
|
else
|
|
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2017-07-17 06:59:48 +08:00
|
|
|
if ((level == 5 && pr & _PAGE_PAT) ||
|
|
|
|
|
((level == 4 || level == 3) && pr & _PAGE_PAT_LARGE))
|
2015-09-18 02:24:19 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "PAT ");
|
2014-11-03 21:02:01 +08:00
|
|
|
else
|
|
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2008-04-17 23:40:45 +08:00
|
|
|
if (pr & _PAGE_GLOBAL)
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "GLB ");
|
2008-04-17 23:40:45 +08:00
|
|
|
else
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, " ");
|
2008-04-17 23:40:45 +08:00
|
|
|
if (pr & _PAGE_NX)
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "NX ");
|
2008-04-17 23:40:45 +08:00
|
|
|
else
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "x ");
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_cont_printf(m, dmsg, "%s\n", level_name[level]);
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
2008-04-17 23:40:45 +08:00
|
|
|
* On 64 bits, sign-extend the 48 bit address to 64 bit
|
2008-04-17 23:40:45 +08:00
|
|
|
*/
|
2008-04-17 23:40:45 +08:00
|
|
|
static unsigned long normalize_addr(unsigned long u)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
2017-07-17 06:59:47 +08:00
|
|
|
int shift;
|
|
|
|
|
if (!IS_ENABLED(CONFIG_X86_64))
|
|
|
|
|
return u;
|
|
|
|
|
|
|
|
|
|
shift = 64 - (__VIRTUAL_MASK_SHIFT + 1);
|
|
|
|
|
return (signed long)(u << shift) >> shift;
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* This function gets called on a break in a continuous series
|
|
|
|
|
* of PTE entries; the next one is different so we need to
|
|
|
|
|
* print what we collected so far.
|
|
|
|
|
*/
|
|
|
|
|
static void note_page(struct seq_file *m, struct pg_state *st,
|
2008-04-17 23:40:45 +08:00
|
|
|
pgprot_t new_prot, int level)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
2008-04-17 23:40:45 +08:00
|
|
|
pgprotval_t prot, cur;
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
static const char units[] = "BKMGTPE";
|
2008-04-17 23:40:45 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* If we have a "break" in the series, we need to flush the state that
|
2008-04-17 23:40:45 +08:00
|
|
|
* we have now. "break" is either changing perms, levels or
|
|
|
|
|
* address space marker.
|
2008-04-17 23:40:45 +08:00
|
|
|
*/
|
2015-09-18 02:24:19 +08:00
|
|
|
prot = pgprot_val(new_prot);
|
|
|
|
|
cur = pgprot_val(st->current_prot);
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
if (!st->level) {
|
|
|
|
|
/* First entry */
|
|
|
|
|
st->current_prot = new_prot;
|
|
|
|
|
st->level = level;
|
|
|
|
|
st->marker = address_markers;
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
st->lines = 0;
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_seq_printf(m, st->to_dmesg, "---[ %s ]---\n",
|
|
|
|
|
st->marker->name);
|
2008-04-17 23:40:45 +08:00
|
|
|
} else if (prot != cur || level != st->level ||
|
|
|
|
|
st->current_address >= st->marker[1].start_address) {
|
|
|
|
|
const char *unit = units;
|
2008-04-17 23:40:45 +08:00
|
|
|
unsigned long delta;
|
2009-04-14 14:51:46 +08:00
|
|
|
int width = sizeof(unsigned long) * 2;
|
2015-10-06 00:55:20 +08:00
|
|
|
pgprotval_t pr = pgprot_val(st->current_prot);
|
|
|
|
|
|
|
|
|
|
if (st->check_wx && (pr & _PAGE_RW) && !(pr & _PAGE_NX)) {
|
|
|
|
|
WARN_ONCE(1,
|
|
|
|
|
"x86/mm: Found insecure W+X mapping at address %p/%pS\n",
|
|
|
|
|
(void *)st->start_address,
|
|
|
|
|
(void *)st->start_address);
|
|
|
|
|
st->wx_pages += (st->current_address -
|
|
|
|
|
st->start_address) / PAGE_SIZE;
|
|
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Now print the actual finished series
|
|
|
|
|
*/
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
if (!st->marker->max_lines ||
|
|
|
|
|
st->lines < st->marker->max_lines) {
|
|
|
|
|
pt_dump_seq_printf(m, st->to_dmesg,
|
|
|
|
|
"0x%0*lx-0x%0*lx ",
|
|
|
|
|
width, st->start_address,
|
|
|
|
|
width, st->current_address);
|
2008-04-17 23:40:45 +08:00
|
|
|
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
delta = st->current_address - st->start_address;
|
|
|
|
|
while (!(delta & 1023) && unit[1]) {
|
|
|
|
|
delta >>= 10;
|
|
|
|
|
unit++;
|
|
|
|
|
}
|
|
|
|
|
pt_dump_cont_printf(m, st->to_dmesg, "%9lu%c ",
|
|
|
|
|
delta, *unit);
|
|
|
|
|
printk_prot(m, st->current_prot, st->level,
|
|
|
|
|
st->to_dmesg);
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
st->lines++;
|
2008-04-17 23:40:45 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* We print markers for special areas of address space,
|
|
|
|
|
* such as the start of vmalloc space etc.
|
|
|
|
|
* This helps in the interpretation.
|
|
|
|
|
*/
|
|
|
|
|
if (st->current_address >= st->marker[1].start_address) {
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
if (st->marker->max_lines &&
|
|
|
|
|
st->lines > st->marker->max_lines) {
|
|
|
|
|
unsigned long nskip =
|
|
|
|
|
st->lines - st->marker->max_lines;
|
|
|
|
|
pt_dump_seq_printf(m, st->to_dmesg,
|
|
|
|
|
"... %lu entr%s skipped ... \n",
|
|
|
|
|
nskip,
|
|
|
|
|
nskip == 1 ? "y" : "ies");
|
|
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
st->marker++;
|
x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. This
causes some 16-bit software to break, but it also leaks kernel state
to user space. We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.
In checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.
This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart. When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace. The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.
(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)
Special thanks to:
- Andy Lutomirski, for the suggestion of using very small stack slots
and copy (as opposed to map) the IRET frame there, and for the
suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.
Reported-by: Brian Gerst <brgerst@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
2014-04-30 07:46:09 +08:00
|
|
|
st->lines = 0;
|
2014-01-18 19:48:14 +08:00
|
|
|
pt_dump_seq_printf(m, st->to_dmesg, "---[ %s ]---\n",
|
|
|
|
|
st->marker->name);
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
st->start_address = st->current_address;
|
|
|
|
|
st->current_prot = new_prot;
|
|
|
|
|
st->level = level;
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
|
|
|
|
|
2017-03-28 18:48:06 +08:00
|
|
|
static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, unsigned long P)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
pte_t *start;
|
2015-09-18 02:24:19 +08:00
|
|
|
pgprotval_t prot;
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-03-28 18:48:06 +08:00
|
|
|
start = (pte_t *)pmd_page_vaddr(addr);
|
2008-04-17 23:40:45 +08:00
|
|
|
for (i = 0; i < PTRS_PER_PTE; i++) {
|
2015-09-18 02:24:19 +08:00
|
|
|
prot = pte_flags(*start);
|
2008-04-17 23:40:45 +08:00
|
|
|
st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT);
|
2017-07-17 06:59:48 +08:00
|
|
|
note_page(m, st, __pgprot(prot), 5);
|
2008-04-17 23:40:45 +08:00
|
|
|
start++;
|
|
|
|
|
}
|
|
|
|
|
}
|
2017-07-24 23:25:58 +08:00
|
|
|
#ifdef CONFIG_KASAN
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* This is an optimization for KASAN=y case. Since all kasan page tables
|
|
|
|
|
* eventually point to the kasan_zero_page we could call note_page()
|
|
|
|
|
* right away without walking through lower level page tables. This saves
|
|
|
|
|
* us dozens of seconds (minutes for 5-level config) while checking for
|
|
|
|
|
* W+X mapping or reading kernel_page_tables debugfs file.
|
|
|
|
|
*/
|
|
|
|
|
static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
|
|
|
|
|
void *pt)
|
|
|
|
|
{
|
|
|
|
|
if (__pa(pt) == __pa(kasan_zero_pmd) ||
|
|
|
|
|
#ifdef CONFIG_X86_5LEVEL
|
|
|
|
|
__pa(pt) == __pa(kasan_zero_p4d) ||
|
|
|
|
|
#endif
|
|
|
|
|
__pa(pt) == __pa(kasan_zero_pud)) {
|
|
|
|
|
pgprotval_t prot = pte_flags(kasan_zero_pte[0]);
|
|
|
|
|
note_page(m, st, __pgprot(prot), 5);
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
|
|
|
|
|
void *pt)
|
|
|
|
|
{
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
#endif
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
#if PTRS_PER_PMD > 1
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-03-28 18:48:06 +08:00
|
|
|
static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr, unsigned long P)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
|
|
|
|
int i;
|
2017-07-24 23:25:58 +08:00
|
|
|
pmd_t *start, *pmd_start;
|
2015-09-18 02:24:19 +08:00
|
|
|
pgprotval_t prot;
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-07-24 23:25:58 +08:00
|
|
|
pmd_start = start = (pmd_t *)pud_page_vaddr(addr);
|
2008-04-17 23:40:45 +08:00
|
|
|
for (i = 0; i < PTRS_PER_PMD; i++) {
|
2008-04-17 23:40:45 +08:00
|
|
|
st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT);
|
2008-04-17 23:40:45 +08:00
|
|
|
if (!pmd_none(*start)) {
|
2015-09-18 02:24:19 +08:00
|
|
|
if (pmd_large(*start) || !pmd_present(*start)) {
|
|
|
|
|
prot = pmd_flags(*start);
|
2017-07-17 06:59:48 +08:00
|
|
|
note_page(m, st, __pgprot(prot), 4);
|
2017-07-24 23:25:58 +08:00
|
|
|
} else if (!kasan_page_table(m, st, pmd_start)) {
|
2008-04-17 23:40:45 +08:00
|
|
|
walk_pte_level(m, st, *start,
|
|
|
|
|
P + i * PMD_LEVEL_MULT);
|
2015-09-18 02:24:19 +08:00
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
} else
|
2017-07-17 06:59:48 +08:00
|
|
|
note_page(m, st, __pgprot(0), 4);
|
2008-04-17 23:40:45 +08:00
|
|
|
start++;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
#else
|
|
|
|
|
#define walk_pmd_level(m,s,a,p) walk_pte_level(m,s,__pmd(pud_val(a)),p)
|
|
|
|
|
#define pud_large(a) pmd_large(__pmd(pud_val(a)))
|
|
|
|
|
#define pud_none(a) pmd_none(__pmd(pud_val(a)))
|
|
|
|
|
#endif
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
#if PTRS_PER_PUD > 1
|
|
|
|
|
|
2017-03-28 18:48:06 +08:00
|
|
|
static void walk_pud_level(struct seq_file *m, struct pg_state *st, p4d_t addr, unsigned long P)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
|
|
|
|
int i;
|
2017-07-24 23:25:58 +08:00
|
|
|
pud_t *start, *pud_start;
|
2015-09-18 02:24:19 +08:00
|
|
|
pgprotval_t prot;
|
2017-02-14 18:08:38 +08:00
|
|
|
pud_t *prev_pud = NULL;
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-07-24 23:25:58 +08:00
|
|
|
pud_start = start = (pud_t *)p4d_page_vaddr(addr);
|
2008-04-17 23:40:45 +08:00
|
|
|
|
|
|
|
|
for (i = 0; i < PTRS_PER_PUD; i++) {
|
2008-04-17 23:40:45 +08:00
|
|
|
st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
|
2017-07-24 23:25:58 +08:00
|
|
|
if (!pud_none(*start)) {
|
2015-09-18 02:24:19 +08:00
|
|
|
if (pud_large(*start) || !pud_present(*start)) {
|
|
|
|
|
prot = pud_flags(*start);
|
2017-07-17 06:59:48 +08:00
|
|
|
note_page(m, st, __pgprot(prot), 3);
|
2017-07-24 23:25:58 +08:00
|
|
|
} else if (!kasan_page_table(m, st, pud_start)) {
|
2008-04-17 23:40:45 +08:00
|
|
|
walk_pmd_level(m, st, *start,
|
|
|
|
|
P + i * PUD_LEVEL_MULT);
|
2015-09-18 02:24:19 +08:00
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
} else
|
2017-07-17 06:59:48 +08:00
|
|
|
note_page(m, st, __pgprot(0), 3);
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-02-14 18:08:38 +08:00
|
|
|
prev_pud = start;
|
2008-04-17 23:40:45 +08:00
|
|
|
start++;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
#else
|
2017-03-28 18:48:06 +08:00
|
|
|
#define walk_pud_level(m,s,a,p) walk_pmd_level(m,s,__pud(p4d_val(a)),p)
|
|
|
|
|
#define p4d_large(a) pud_large(__pud(p4d_val(a)))
|
|
|
|
|
#define p4d_none(a) pud_none(__pud(p4d_val(a)))
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
static void walk_p4d_level(struct seq_file *m, struct pg_state *st, pgd_t addr, unsigned long P)
|
|
|
|
|
{
|
|
|
|
|
int i;
|
2017-07-24 23:25:58 +08:00
|
|
|
p4d_t *start, *p4d_start;
|
2017-03-28 18:48:06 +08:00
|
|
|
pgprotval_t prot;
|
|
|
|
|
|
2018-02-14 19:16:53 +08:00
|
|
|
if (PTRS_PER_P4D == 1)
|
|
|
|
|
return walk_pud_level(m, st, __p4d(pgd_val(addr)), P);
|
|
|
|
|
|
2017-07-24 23:25:58 +08:00
|
|
|
p4d_start = start = (p4d_t *)pgd_page_vaddr(addr);
|
2017-03-28 18:48:06 +08:00
|
|
|
|
|
|
|
|
for (i = 0; i < PTRS_PER_P4D; i++) {
|
|
|
|
|
st->current_address = normalize_addr(P + i * P4D_LEVEL_MULT);
|
|
|
|
|
if (!p4d_none(*start)) {
|
|
|
|
|
if (p4d_large(*start) || !p4d_present(*start)) {
|
|
|
|
|
prot = p4d_flags(*start);
|
|
|
|
|
note_page(m, st, __pgprot(prot), 2);
|
2017-07-24 23:25:58 +08:00
|
|
|
} else if (!kasan_page_table(m, st, p4d_start)) {
|
2017-03-28 18:48:06 +08:00
|
|
|
walk_pud_level(m, st, *start,
|
|
|
|
|
P + i * P4D_LEVEL_MULT);
|
|
|
|
|
}
|
|
|
|
|
} else
|
|
|
|
|
note_page(m, st, __pgprot(0), 2);
|
|
|
|
|
|
|
|
|
|
start++;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2018-02-14 19:16:53 +08:00
|
|
|
#define pgd_large(a) (pgtable_l5_enabled ? pgd_large(a) : p4d_large(__p4d(pgd_val(a))))
|
|
|
|
|
#define pgd_none(a) (pgtable_l5_enabled ? pgd_none(a) : p4d_none(__p4d(pgd_val(a))))
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2015-11-06 02:56:35 +08:00
|
|
|
static inline bool is_hypervisor_range(int idx)
|
|
|
|
|
{
|
2016-02-19 04:00:41 +08:00
|
|
|
#ifdef CONFIG_X86_64
|
2015-11-06 02:56:35 +08:00
|
|
|
/*
|
|
|
|
|
* ffff800000000000 - ffff87ffffffffff is reserved for
|
|
|
|
|
* the hypervisor.
|
|
|
|
|
*/
|
2016-02-19 04:00:41 +08:00
|
|
|
return (idx >= pgd_index(__PAGE_OFFSET) - 16) &&
|
|
|
|
|
(idx < pgd_index(__PAGE_OFFSET));
|
2015-11-06 02:56:35 +08:00
|
|
|
#else
|
2016-02-19 04:00:41 +08:00
|
|
|
return false;
|
2015-11-06 02:56:35 +08:00
|
|
|
#endif
|
2016-02-19 04:00:41 +08:00
|
|
|
}
|
2015-11-06 02:56:35 +08:00
|
|
|
|
2015-10-06 00:55:20 +08:00
|
|
|
static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
|
2017-12-04 22:08:05 +08:00
|
|
|
bool checkwx, bool dmesg)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
2008-04-17 23:40:45 +08:00
|
|
|
#ifdef CONFIG_X86_64
|
2017-06-06 19:31:27 +08:00
|
|
|
pgd_t *start = (pgd_t *) &init_top_pgt;
|
2008-04-17 23:40:45 +08:00
|
|
|
#else
|
|
|
|
|
pgd_t *start = swapper_pg_dir;
|
|
|
|
|
#endif
|
2015-09-18 02:24:19 +08:00
|
|
|
pgprotval_t prot;
|
2008-04-17 23:40:45 +08:00
|
|
|
int i;
|
2014-01-18 19:48:14 +08:00
|
|
|
struct pg_state st = {};
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2014-01-18 19:48:14 +08:00
|
|
|
if (pgd) {
|
|
|
|
|
start = pgd;
|
2017-12-04 22:08:05 +08:00
|
|
|
st.to_dmesg = dmesg;
|
2014-01-18 19:48:14 +08:00
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2015-10-06 00:55:20 +08:00
|
|
|
st.check_wx = checkwx;
|
|
|
|
|
if (checkwx)
|
|
|
|
|
st.wx_pages = 0;
|
|
|
|
|
|
2008-04-17 23:40:45 +08:00
|
|
|
for (i = 0; i < PTRS_PER_PGD; i++) {
|
2008-04-17 23:40:45 +08:00
|
|
|
st.current_address = normalize_addr(i * PGD_LEVEL_MULT);
|
2015-11-06 02:56:35 +08:00
|
|
|
if (!pgd_none(*start) && !is_hypervisor_range(i)) {
|
2015-09-18 02:24:19 +08:00
|
|
|
if (pgd_large(*start) || !pgd_present(*start)) {
|
|
|
|
|
prot = pgd_flags(*start);
|
2008-04-17 23:40:45 +08:00
|
|
|
note_page(m, &st, __pgprot(prot), 1);
|
2015-09-18 02:24:19 +08:00
|
|
|
} else {
|
2017-03-28 18:48:06 +08:00
|
|
|
walk_p4d_level(m, &st, *start,
|
2008-04-17 23:40:45 +08:00
|
|
|
i * PGD_LEVEL_MULT);
|
2015-09-18 02:24:19 +08:00
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
} else
|
2008-04-17 23:40:45 +08:00
|
|
|
note_page(m, &st, __pgprot(0), 1);
|
2008-04-17 23:40:45 +08:00
|
|
|
|
2017-02-10 17:54:05 +08:00
|
|
|
cond_resched();
|
2008-04-17 23:40:45 +08:00
|
|
|
start++;
|
|
|
|
|
}
|
2008-04-17 23:40:45 +08:00
|
|
|
|
|
|
|
|
/* Flush out the last page */
|
|
|
|
|
st.current_address = normalize_addr(PTRS_PER_PGD*PGD_LEVEL_MULT);
|
|
|
|
|
note_page(m, &st, __pgprot(0), 0);
|
2015-10-06 00:55:20 +08:00
|
|
|
if (!checkwx)
|
|
|
|
|
return;
|
|
|
|
|
if (st.wx_pages)
|
|
|
|
|
pr_info("x86/mm: Checked W+X mappings: FAILED, %lu W+X pages found.\n",
|
|
|
|
|
st.wx_pages);
|
|
|
|
|
else
|
|
|
|
|
pr_info("x86/mm: Checked W+X mappings: passed, no W+X pages found.\n");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd)
|
|
|
|
|
{
|
2017-12-04 22:08:05 +08:00
|
|
|
ptdump_walk_pgd_level_core(m, pgd, false, true);
|
|
|
|
|
}
|
|
|
|
|
|
2017-12-04 22:08:06 +08:00
|
|
|
void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user)
|
2017-12-04 22:08:05 +08:00
|
|
|
{
|
2017-12-04 22:08:06 +08:00
|
|
|
#ifdef CONFIG_PAGE_TABLE_ISOLATION
|
|
|
|
|
if (user && static_cpu_has(X86_FEATURE_PTI))
|
|
|
|
|
pgd = kernel_to_user_pgdp(pgd);
|
|
|
|
|
#endif
|
2017-12-04 22:08:05 +08:00
|
|
|
ptdump_walk_pgd_level_core(m, pgd, false, false);
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level_debugfs);
|
|
|
|
|
|
|
|
|
|
static void ptdump_walk_user_pgd_level_checkwx(void)
|
|
|
|
|
{
|
|
|
|
|
#ifdef CONFIG_PAGE_TABLE_ISOLATION
|
|
|
|
|
pgd_t *pgd = (pgd_t *) &init_top_pgt;
|
|
|
|
|
|
|
|
|
|
if (!static_cpu_has(X86_FEATURE_PTI))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
pr_info("x86/mm: Checking user space page tables\n");
|
|
|
|
|
pgd = kernel_to_user_pgdp(pgd);
|
|
|
|
|
ptdump_walk_pgd_level_core(NULL, pgd, true, false);
|
|
|
|
|
#endif
|
2008-04-17 23:40:45 +08:00
|
|
|
}
|
|
|
|
|
|
2015-10-06 00:55:20 +08:00
|
|
|
void ptdump_walk_pgd_level_checkwx(void)
|
|
|
|
|
{
|
2017-12-04 22:08:05 +08:00
|
|
|
ptdump_walk_pgd_level_core(NULL, NULL, true, false);
|
|
|
|
|
ptdump_walk_user_pgd_level_checkwx();
|
2015-10-06 00:55:20 +08:00
|
|
|
}
|
|
|
|
|
|
2015-11-20 09:07:55 +08:00
|
|
|
static int __init pt_dump_init(void)
|
2008-04-17 23:40:45 +08:00
|
|
|
{
|
x86/mm: Implement ASLR for kernel memory regions
Randomizes the virtual address space of kernel memory regions for
x86_64. This first patch adds the infrastructure and does not randomize
any region. The following patches will randomize the physical memory
mapping, vmalloc and vmemmap regions.
This security feature mitigates exploits relying on predictable kernel
addresses. These addresses can be used to disclose the kernel modules
base addresses or corrupt specific structures to elevate privileges
bypassing the current implementation of KASLR. This feature can be
enabled with the CONFIG_RANDOMIZE_MEMORY option.
The order of each memory region is not changed. The feature looks at the
available space for the regions based on different configuration options
and randomizes the base and space between each. The size of the physical
memory mapping is the available physical memory. No performance impact
was detected while testing the feature.
Entropy is generated using the KASLR early boot functions now shared in
the lib directory (originally written by Kees Cook). Randomization is
done on PGD & PUD page table levels to increase possible addresses. The
physical memory mapping code was adapted to support PUD level virtual
addresses. This implementation on the best configuration provides 30,000
possible virtual addresses in average for each memory region. An
additional low memory page is used to ensure each CPU can start with a
PGD aligned virtual address (for realmode).
x86/dump_pagetable was updated to correctly display each region.
Updated documentation on x86_64 memory layout accordingly.
Performance data, after all patches in the series:
Kernbench shows almost no difference (-+ less than 1%):
Before:
Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.63 (1.2695)
User Time 1034.89 (1.18115) System Time 87.056 (0.456416) Percent CPU 1092.9
(13.892) Context Switches 199805 (3455.33) Sleeps 97907.8 (900.636)
After:
Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.489 (1.10636)
User Time 1034.86 (1.36053) System Time 87.764 (0.49345) Percent CPU 1095
(12.7715) Context Switches 199036 (4298.1) Sleeps 97681.6 (1031.11)
Hackbench shows 0% difference on average (hackbench 90 repeated 10 times):
attemp,before,after 1,0.076,0.069 2,0.072,0.069 3,0.066,0.066 4,0.066,0.068
5,0.066,0.067 6,0.066,0.069 7,0.067,0.066 8,0.063,0.067 9,0.067,0.065
10,0.068,0.071 average,0.0677,0.0677
Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Alexander Kuleshov <kuleshovmail@gmail.com>
Cc: Alexander Popov <alpopov@ptsecurity.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jan Beulich <JBeulich@suse.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lv Zheng <lv.zheng@intel.com>
Cc: Mark Salter <msalter@redhat.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: kernel-hardening@lists.openwall.com
Cc: linux-doc@vger.kernel.org
Link: http://lkml.kernel.org/r/1466556426-32664-6-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-06-22 08:47:02 +08:00
|
|
|
/*
|
|
|
|
|
* Various markers are not compile-time constants, so assign them
|
|
|
|
|
* here.
|
|
|
|
|
*/
|
|
|
|
|
#ifdef CONFIG_X86_64
|
|
|
|
|
address_markers[LOW_KERNEL_NR].start_address = PAGE_OFFSET;
|
|
|
|
|
address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
|
|
|
|
|
address_markers[VMEMMAP_START_NR].start_address = VMEMMAP_START;
|
2018-02-14 19:16:52 +08:00
|
|
|
#ifdef CONFIG_MODIFY_LDT_SYSCALL
|
|
|
|
|
address_markers[LDT_NR].start_address = LDT_BASE_ADDR;
|
|
|
|
|
#endif
|
2018-02-14 19:16:55 +08:00
|
|
|
#ifdef CONFIG_KASAN
|
|
|
|
|
address_markers[KASAN_SHADOW_START_NR].start_address = KASAN_SHADOW_START;
|
|
|
|
|
address_markers[KASAN_SHADOW_END_NR].start_address = KASAN_SHADOW_END;
|
|
|
|
|
#endif
|
x86/mm: Implement ASLR for kernel memory regions
Randomizes the virtual address space of kernel memory regions for
x86_64. This first patch adds the infrastructure and does not randomize
any region. The following patches will randomize the physical memory
mapping, vmalloc and vmemmap regions.
This security feature mitigates exploits relying on predictable kernel
addresses. These addresses can be used to disclose the kernel modules
base addresses or corrupt specific structures to elevate privileges
bypassing the current implementation of KASLR. This feature can be
enabled with the CONFIG_RANDOMIZE_MEMORY option.
The order of each memory region is not changed. The feature looks at the
available space for the regions based on different configuration options
and randomizes the base and space between each. The size of the physical
memory mapping is the available physical memory. No performance impact
was detected while testing the feature.
Entropy is generated using the KASLR early boot functions now shared in
the lib directory (originally written by Kees Cook). Randomization is
done on PGD & PUD page table levels to increase possible addresses. The
physical memory mapping code was adapted to support PUD level virtual
addresses. This implementation on the best configuration provides 30,000
possible virtual addresses in average for each memory region. An
additional low memory page is used to ensure each CPU can start with a
PGD aligned virtual address (for realmode).
x86/dump_pagetable was updated to correctly display each region.
Updated documentation on x86_64 memory layout accordingly.
Performance data, after all patches in the series:
Kernbench shows almost no difference (-+ less than 1%):
Before:
Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.63 (1.2695)
User Time 1034.89 (1.18115) System Time 87.056 (0.456416) Percent CPU 1092.9
(13.892) Context Switches 199805 (3455.33) Sleeps 97907.8 (900.636)
After:
Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.489 (1.10636)
User Time 1034.86 (1.36053) System Time 87.764 (0.49345) Percent CPU 1095
(12.7715) Context Switches 199036 (4298.1) Sleeps 97681.6 (1031.11)
Hackbench shows 0% difference on average (hackbench 90 repeated 10 times):
attemp,before,after 1,0.076,0.069 2,0.072,0.069 3,0.066,0.066 4,0.066,0.068
5,0.066,0.067 6,0.066,0.069 7,0.067,0.066 8,0.063,0.067 9,0.067,0.065
10,0.068,0.071 average,0.0677,0.0677
Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Alexander Kuleshov <kuleshovmail@gmail.com>
Cc: Alexander Popov <alpopov@ptsecurity.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jan Beulich <JBeulich@suse.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lv Zheng <lv.zheng@intel.com>
Cc: Mark Salter <msalter@redhat.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: kernel-hardening@lists.openwall.com
Cc: linux-doc@vger.kernel.org
Link: http://lkml.kernel.org/r/1466556426-32664-6-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-06-22 08:47:02 +08:00
|
|
|
#endif
|
2008-04-17 23:40:45 +08:00
|
|
|
#ifdef CONFIG_X86_32
|
2010-07-21 06:19:46 +08:00
|
|
|
address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
|
|
|
|
|
address_markers[VMALLOC_END_NR].start_address = VMALLOC_END;
|
2008-04-17 23:40:45 +08:00
|
|
|
# ifdef CONFIG_HIGHMEM
|
2010-07-21 06:19:46 +08:00
|
|
|
address_markers[PKMAP_BASE_NR].start_address = PKMAP_BASE;
|
2008-04-17 23:40:45 +08:00
|
|
|
# endif
|
2010-07-21 06:19:46 +08:00
|
|
|
address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
|
2017-12-21 01:51:31 +08:00
|
|
|
address_markers[CPU_ENTRY_AREA_NR].start_address = CPU_ENTRY_AREA_BASE;
|
2008-04-17 23:40:45 +08:00
|
|
|
#endif
|
2008-04-17 23:40:45 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
__initcall(pt_dump_init);
|