| History log of /src/sys/arch/amd64/stand/prekern/elf.c |
| Revision | | Date | Author | Comments |
| 1.22 |
| 04-May-2021 |
khorben | prekern: add support for warning messages
As submitted on port-amd64@ (part 1/3)
Tested on NetBSD/amd64.
|
| 1.21 |
| 07-May-2020 |
maxv | branches: 1.21.6;
Clarify.
|
| 1.20 |
| 07-May-2020 |
maxv | If we encounter relocations from a section that the bootloader dropped,
AND if the section is a note, then skip the relocations.
Considering a note that the bootloader dropped, there are two possible
sides for the relocations: (1) the relocations from the note towards the
rest of the binary, and (2) the relocations from the rest of the binary
towards the note.
We skip (1), which is correct, because the notes do not play any role at
run time. If we encounter (2) however then there is a bug in the kernel,
so add a sanity check against that.
This fixes KASLR since the latest Xen changes (which introduced .note.Xen).
|
| 1.19 |
| 05-May-2020 |
maxv | Gather the section filtering in a single function, and add a sanity check
when relocating, to make sure the section we're accessing is mappable.
Currently this check fails, because of the Xen section, which has RELAs but
is an unmappable unallocated note.
Also improve the prekern ASSERTs while here.
|
| 1.18 |
| 05-Jan-2019 |
maxv | Apply amd64/kobj_machdep.c::rev1.7 to the prekern too, to fix the
relocation with updated binutils.
|
| 1.17 |
| 21-Nov-2017 |
maxv | branches: 1.17.2; 1.17.4; 1.17.6;
Clean up and add some ASSERTs.
|
| 1.16 |
| 17-Nov-2017 |
maxv | style
|
| 1.15 |
| 15-Nov-2017 |
maxv | Small cleanup.
|
| 1.14 |
| 15-Nov-2017 |
maxv | Support large pages on KASLR kernels, in a way that does not reduce
randomness, but on the contrary that increases it.
The size of the kernel sub-blocks is changed to be 1MB. This produces a
kernel with sections that are always < 2MB in size, that can fit a large
page.
Each section is put in a 2MB physical chunk. In this chunk, there is a
padding of approximately 1MB. The prekern uses a random offset aligned to
sh_addralign, to shift the section in physical memory.
For example, physical memory layout created by the bootloader for .text.4
and .rodata.0:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
|+---------------+ |+---------------+ |
|| .text.4 | PAD || .rodata.0 | PAD |
|+---------------+ |+---------------+ |
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
PA PA+2MB PA+4MB
Then, physical memory layout, after having been shifted by the prekern:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
| P +---------------+ | +---------------+ |
| A | .text.4 | PAD | PAD | .rodata.0 | PAD |
| D +---------------+ | +---------------+ |
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
PA PA+2MB PA+4MB
The kernel maps these 2MB physical chunks with 2MB large pages. Therefore,
randomness is enforced at both the virtual and physical levels, and the
resulting entropy is higher than that of our current implementaion until
now.
The padding around the section is filled by the prekern. Not to consume
too much memory, the sections that are smaller than PAGE_SIZE are mapped
with normal pages - because there is no point in optimizing them. In these
normal pages, the same shift is applied.
This change has two additional advantages: (a) the cache attacks based on
the TLB are mostly mitigated, because even if you are able to determine
that a given page-aligned range is mapped as executable you don't know
where exactly within that range the section actually begins, and (b) given
that we are slightly randomizing the physical layout we are making some
rare physical attacks more difficult to conduct.
NOTE: after this change you need to update GENERIC_KASLR / prekern /
bootloader.
|
| 1.13 |
| 14-Nov-2017 |
maxv | Add -Wstrict-prototypes, and fix each warning.
|
| 1.12 |
| 13-Nov-2017 |
maxv | One more ASSERT, won't hurt.
|
| 1.11 |
| 13-Nov-2017 |
maxv | Don't process ELF sections that don't have the ALLOC flag set.
NOTE: you need to update both the prekern and the bootloader after this
change.
|
| 1.10 |
| 13-Nov-2017 |
maxv | Change the mapping logic: don't group sections of the same type into
segments, and rather map each section independently at a random VA.
In particular, .data and .bss are not merged anymore and reside at
different addresses.
|
| 1.9 |
| 09-Nov-2017 |
maxv | Define utility functions as inlines in prekern.h.
|
| 1.8 |
| 09-Nov-2017 |
maxv | Fill in the page padding. Only .text is pre-filled by the ld script, but
this will change in the future.
|
| 1.7 |
| 05-Nov-2017 |
maxv | Mprotect the segments in mm.c using bootspace, and remove the now unused
fields of elfinfo.
|
| 1.6 |
| 01-Nov-2017 |
maxv | Handle absolute symbols. Since my linux_sigcode.S::rev1.4 there are two
Elf_Rela that point to the NULL symbol - which the prekern thought was an
external reference.
In the ELF spec, STN_UNDEF means the value of the symbol is zero.
|
| 1.5 |
| 29-Oct-2017 |
maxv | Fix a few error messages, and be a little more verbose.
|
| 1.4 |
| 29-Oct-2017 |
maxv | Randomize the kernel segments independently. That is to say, put text,
rodata and data at different addresses (and in a random order).
To achieve that, the mapping order in the prekern is changed. Until now,
we were creating the kernel map the following way:
-> choose a random VA
-> map [kernpa_start; kernpa_end[ at this VA
-> parse the ELF structures from there
-> determine where exactly the kernel segments are located
-> relocate etc
Now, we are doing:
-> create a read-only view of [kernpa_start; kernpa_end[
-> from this view, compute the size of the "head" region
-> choose a random VA in the HEAD window, and map the head there
-> for each region in (text, rodata, data, boot)
-> compute the size of the region from the RO view
-> choose a random VA in the KASLR window
-> map the region there
-> relocate etc
Each time we map a region, we initialize its bootspace fields right away.
The "head" region must be put before the other regions in memory, because
the kernel uses (headva + sh_offset) to get the addresses of the symbols,
and the offset is unsigned.
Given that the head does not have an mcmodel constraint, its location is
randomized in a window located below the KASLR window.
The rest of the regions being in the same window, we need to detect
collisions.
Note that the module map is embedded in the "boot" region, and that
therefore its location is randomized too.
|
| 1.3 |
| 29-Oct-2017 |
maxv | Add three functions and start using them; will be more useful soon.
|
| 1.2 |
| 11-Oct-2017 |
maxv | Make sure we're relocating a relocatable kernel.
|
| 1.1 |
| 10-Oct-2017 |
maxv | Add the amd64 prekern. It is a kernel relocator used for Kernel ASLR (see
tech-kern@). It works, but is not yet linked to the build system, because
I can't build a distribution right now.
|
| 1.17.6.1 |
| 10-Jun-2019 |
christos | Sync with HEAD
|
| 1.17.4.1 |
| 18-Jan-2019 |
pgoyette | Synch with HEAD
|
| 1.17.2.2 |
| 03-Dec-2017 |
jdolecek | update from HEAD
|
| 1.17.2.1 |
| 21-Nov-2017 |
jdolecek | file elf.c was added on branch tls-maxphys on 2017-12-03 11:35:48 +0000
|
| 1.21.6.1 |
| 13-May-2021 |
thorpej | Sync with HEAD.
|
