• Thomas Garnier's avatar
    x86/mm: Implement ASLR for kernel memory regions · 0483e1fa
    Thomas Garnier authored
    Randomizes the virtual address space of kernel memory regions for
    x86_64. This first patch adds the infrastructure and does not randomize
    any region. The following patches will randomize the physical memory
    mapping, vmalloc and vmemmap regions.
    
    This security feature mitigates exploits relying on predictable kernel
    addresses. These addresses can be used to disclose the kernel modules
    base addresses or corrupt specific structures to elevate privileges
    bypassing the current implementation of KASLR. This feature can be
    enabled with the CONFIG_RANDOMIZE_MEMORY option.
    
    The order of each memory region is not changed. The feature looks at the
    available space for the regions based on different configuration options
    and randomizes the base and space between each. The size of the physical
    memory mapping is the available physical memory. No performance impact
    was detected while testing the feature.
    
    Entropy is generated using the KASLR early boot functions now shared in
    the lib directory (originally written by Kees Cook). Randomization is
    done on PGD & PUD page table levels to increase possible addresses. The
    physical memory mapping code was adapted to support PUD level virtual
    addresses. This implementation on the best configuration provides 30,000
    possible virtual addresses in average for each memory region.  An
    additional low memory page is used to ensure each CPU can start with a
    PGD aligned virtual address (for realmode).
    
    x86/dump_pagetable was updated to correctly display each region.
    
    Updated documentation on x86_64 memory layout accordingly.
    
    Performance data, after all patches in the series:
    
    Kernbench shows almost no difference (-+ less than 1%):
    
    Before:
    
    Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.63 (1.2695)
    User Time 1034.89 (1.18115) System Time 87.056 (0.456416) Percent CPU 1092.9
    (13.892) Context Switches 199805 (3455.33) Sleeps 97907.8 (900.636)
    
    After:
    
    Average Optimal load -j 12 Run (std deviation): Elapsed Time 102.489 (1.10636)
    User Time 1034.86 (1.36053) System Time 87.764 (0.49345) Percent CPU 1095
    (12.7715) Context Switches 199036 (4298.1) Sleeps 97681.6 (1031.11)
    
    Hackbench shows 0% difference on average (hackbench 90 repeated 10 times):
    
    attemp,before,after 1,0.076,0.069 2,0.072,0.069 3,0.066,0.066 4,0.066,0.068
    5,0.066,0.067 6,0.066,0.069 7,0.067,0.066 8,0.063,0.067 9,0.067,0.065
    10,0.068,0.071 average,0.0677,0.0677
    Signed-off-by: default avatarThomas Garnier <thgarnie@google.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Alexander Kuleshov <kuleshovmail@gmail.com>
    Cc: Alexander Popov <alpopov@ptsecurity.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Baoquan He <bhe@redhat.com>
    Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Christian Borntraeger <borntraeger@de.ibm.com>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Dave Young <dyoung@redhat.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Jan Beulich <JBeulich@suse.com>
    Cc: Joerg Roedel <jroedel@suse.de>
    Cc: Jonathan Corbet <corbet@lwn.net>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Juergen Gross <jgross@suse.com>
    Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Lv Zheng <lv.zheng@intel.com>
    Cc: Mark Salter <msalter@redhat.com>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Matt Fleming <matt@codeblueprint.co.uk>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephen Smalley <sds@tycho.nsa.gov>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Toshi Kani <toshi.kani@hpe.com>
    Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Cc: kernel-hardening@lists.openwall.com
    Cc: linux-doc@vger.kernel.org
    Link: http://lkml.kernel.org/r/1466556426-32664-6-git-send-email-keescook@chromium.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    0483e1fa
Kconfig 89.2 KB