This patch introduces our implementation of KAISER (Kernel Address Isolation to have Side-channels Efficiently Removed), a kernel isolation technique to close hardware side channels on kernel address information. More information about the patch can be found on: https://github.com/IAIK/KAISER From: Richard Fellner <richard.fellner@student.tugraz.at> From: Daniel Gruss <daniel.gruss@iaik.tugraz.at> X-Subject: [RFC, PATCH] x86_64: KAISER - do not map kernel in user mode Date: Thu, 4 May 2017 14:26:50 +0200 Link: http://marc.info/?l=linux-kernel&m=149390087310405&w=2 Kaiser-4.10-SHA1: c4b1831d44c6144d3762ccc72f0c4e71a0c713e5 To: <linux-kernel@vger.kernel.org> To: <kernel-hardening@lists.openwall.com> Cc: <clementine.maurice@iaik.tugraz.at> Cc: <moritz.lipp@iaik.tugraz.at> Cc: Michael Schwarz <michael.schwarz@iaik.tugraz.at> Cc: Richard Fellner <richard.fellner@student.tugraz.at> Cc: Ingo Molnar <mingo@kernel.org> Cc: <kirill.shutemov@linux.intel.com> Cc: <anders.fogh@gdata-adan.de> After several recent works [1,2,3] KASLR on x86_64 was basically considered dead by many researchers. We have been working on an efficient but effective fix for this problem and found that not mapping the kernel space when running in user mode is the solution to this problem [4] (the corresponding paper [5] will be presented at ESSoS17). With this RFC patch we allow anybody to configure their kernel with the flag CONFIG_KAISER to add our defense mechanism. If there are any questions we would love to answer them. We also appreciate any comments! Cheers, Daniel (+ the KAISER team from Graz University of Technology) [1] http://www.ieee-security.org/TC/SP2013/papers/4977a191.pdf [2] https://www.blackhat.com/docs/us-16/materials/us-16-Fogh-Using-Undocumented-CPU-Behaviour-To-See-Into-Kernel-Mode-And-Break-KASLR-In-The-Process.pdf [3] https://www.blackhat.com/docs/us-16/materials/us-16-Jang-Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX.pdf [4] https://github.com/IAIK/KAISER [5] https://gruss.cc/files/kaiser.pdf [patch based also on https://raw.githubusercontent.com/IAIK/KAISER/master/KAISER/0001-KAISER-Kernel-Address-Isolation.patch] Signed-off-by: Richard Fellner <richard.fellner@student.tugraz.at> Signed-off-by: Moritz Lipp <moritz.lipp@iaik.tugraz.at> Signed-off-by: Daniel Gruss <daniel.gruss@iaik.tugraz.at> Signed-off-by: Michael Schwarz <michael.schwarz@iaik.tugraz.at> Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
201 lines
5.2 KiB
C
201 lines
5.2 KiB
C
#include <linux/linkage.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/signal.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/ioport.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/timex.h>
|
|
#include <linux/random.h>
|
|
#include <linux/kprobes.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kernel_stat.h>
|
|
#include <linux/device.h>
|
|
#include <linux/bitops.h>
|
|
#include <linux/acpi.h>
|
|
#include <linux/io.h>
|
|
#include <linux/delay.h>
|
|
|
|
#include <linux/atomic.h>
|
|
#include <asm/timer.h>
|
|
#include <asm/hw_irq.h>
|
|
#include <asm/pgtable.h>
|
|
#include <asm/desc.h>
|
|
#include <asm/apic.h>
|
|
#include <asm/setup.h>
|
|
#include <asm/i8259.h>
|
|
#include <asm/traps.h>
|
|
#include <asm/prom.h>
|
|
|
|
/*
|
|
* ISA PIC or low IO-APIC triggered (INTA-cycle or APIC) interrupts:
|
|
* (these are usually mapped to vectors 0x30-0x3f)
|
|
*/
|
|
|
|
/*
|
|
* The IO-APIC gives us many more interrupt sources. Most of these
|
|
* are unused but an SMP system is supposed to have enough memory ...
|
|
* sometimes (mostly wrt. hw bugs) we get corrupted vectors all
|
|
* across the spectrum, so we really want to be prepared to get all
|
|
* of these. Plus, more powerful systems might have more than 64
|
|
* IO-APIC registers.
|
|
*
|
|
* (these are usually mapped into the 0x30-0xff vector range)
|
|
*/
|
|
|
|
/*
|
|
* IRQ2 is cascade interrupt to second interrupt controller
|
|
*/
|
|
static struct irqaction irq2 = {
|
|
.handler = no_action,
|
|
.name = "cascade",
|
|
.flags = IRQF_NO_THREAD,
|
|
};
|
|
|
|
DEFINE_PER_CPU_USER_MAPPED(vector_irq_t, vector_irq) = {
|
|
[0 ... NR_VECTORS - 1] = VECTOR_UNUSED,
|
|
};
|
|
|
|
int vector_used_by_percpu_irq(unsigned int vector)
|
|
{
|
|
int cpu;
|
|
|
|
for_each_online_cpu(cpu) {
|
|
if (!IS_ERR_OR_NULL(per_cpu(vector_irq, cpu)[vector]))
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
void __init init_ISA_irqs(void)
|
|
{
|
|
struct irq_chip *chip = legacy_pic->chip;
|
|
int i;
|
|
|
|
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_LOCAL_APIC)
|
|
init_bsp_APIC();
|
|
#endif
|
|
legacy_pic->init(0);
|
|
|
|
for (i = 0; i < nr_legacy_irqs(); i++)
|
|
irq_set_chip_and_handler(i, chip, handle_level_irq);
|
|
}
|
|
|
|
void __init init_IRQ(void)
|
|
{
|
|
int i;
|
|
|
|
/*
|
|
* On cpu 0, Assign ISA_IRQ_VECTOR(irq) to IRQ 0..15.
|
|
* If these IRQ's are handled by legacy interrupt-controllers like PIC,
|
|
* then this configuration will likely be static after the boot. If
|
|
* these IRQ's are handled by more mordern controllers like IO-APIC,
|
|
* then this vector space can be freed and re-used dynamically as the
|
|
* irq's migrate etc.
|
|
*/
|
|
for (i = 0; i < nr_legacy_irqs(); i++)
|
|
per_cpu(vector_irq, 0)[ISA_IRQ_VECTOR(i)] = irq_to_desc(i);
|
|
|
|
x86_init.irqs.intr_init();
|
|
}
|
|
|
|
static void __init smp_intr_init(void)
|
|
{
|
|
#ifdef CONFIG_SMP
|
|
/*
|
|
* The reschedule interrupt is a CPU-to-CPU reschedule-helper
|
|
* IPI, driven by wakeup.
|
|
*/
|
|
alloc_intr_gate(RESCHEDULE_VECTOR, reschedule_interrupt);
|
|
|
|
/* IPI for generic function call */
|
|
alloc_intr_gate(CALL_FUNCTION_VECTOR, call_function_interrupt);
|
|
|
|
/* IPI for generic single function call */
|
|
alloc_intr_gate(CALL_FUNCTION_SINGLE_VECTOR,
|
|
call_function_single_interrupt);
|
|
|
|
/* Low priority IPI to cleanup after moving an irq */
|
|
set_intr_gate(IRQ_MOVE_CLEANUP_VECTOR, irq_move_cleanup_interrupt);
|
|
set_bit(IRQ_MOVE_CLEANUP_VECTOR, used_vectors);
|
|
|
|
/* IPI used for rebooting/stopping */
|
|
alloc_intr_gate(REBOOT_VECTOR, reboot_interrupt);
|
|
#endif /* CONFIG_SMP */
|
|
}
|
|
|
|
static void __init apic_intr_init(void)
|
|
{
|
|
smp_intr_init();
|
|
|
|
#ifdef CONFIG_X86_THERMAL_VECTOR
|
|
alloc_intr_gate(THERMAL_APIC_VECTOR, thermal_interrupt);
|
|
#endif
|
|
#ifdef CONFIG_X86_MCE_THRESHOLD
|
|
alloc_intr_gate(THRESHOLD_APIC_VECTOR, threshold_interrupt);
|
|
#endif
|
|
|
|
#ifdef CONFIG_X86_MCE_AMD
|
|
alloc_intr_gate(DEFERRED_ERROR_VECTOR, deferred_error_interrupt);
|
|
#endif
|
|
|
|
#ifdef CONFIG_X86_LOCAL_APIC
|
|
/* self generated IPI for local APIC timer */
|
|
alloc_intr_gate(LOCAL_TIMER_VECTOR, apic_timer_interrupt);
|
|
|
|
/* IPI for X86 platform specific use */
|
|
alloc_intr_gate(X86_PLATFORM_IPI_VECTOR, x86_platform_ipi);
|
|
#ifdef CONFIG_HAVE_KVM
|
|
/* IPI for KVM to deliver posted interrupt */
|
|
alloc_intr_gate(POSTED_INTR_VECTOR, kvm_posted_intr_ipi);
|
|
/* IPI for KVM to deliver interrupt to wake up tasks */
|
|
alloc_intr_gate(POSTED_INTR_WAKEUP_VECTOR, kvm_posted_intr_wakeup_ipi);
|
|
#endif
|
|
|
|
/* IPI vectors for APIC spurious and error interrupts */
|
|
alloc_intr_gate(SPURIOUS_APIC_VECTOR, spurious_interrupt);
|
|
alloc_intr_gate(ERROR_APIC_VECTOR, error_interrupt);
|
|
|
|
/* IRQ work interrupts: */
|
|
# ifdef CONFIG_IRQ_WORK
|
|
alloc_intr_gate(IRQ_WORK_VECTOR, irq_work_interrupt);
|
|
# endif
|
|
|
|
#endif
|
|
}
|
|
|
|
void __init native_init_IRQ(void)
|
|
{
|
|
int i;
|
|
|
|
/* Execute any quirks before the call gates are initialised: */
|
|
x86_init.irqs.pre_vector_init();
|
|
|
|
apic_intr_init();
|
|
|
|
/*
|
|
* Cover the whole vector space, no vector can escape
|
|
* us. (some of these will be overridden and become
|
|
* 'special' SMP interrupts)
|
|
*/
|
|
i = FIRST_EXTERNAL_VECTOR;
|
|
#ifndef CONFIG_X86_LOCAL_APIC
|
|
#define first_system_vector NR_VECTORS
|
|
#endif
|
|
for_each_clear_bit_from(i, used_vectors, first_system_vector) {
|
|
/* IA32_SYSCALL_VECTOR could be used in trap_init already. */
|
|
set_intr_gate(i, irq_entries_start +
|
|
8 * (i - FIRST_EXTERNAL_VECTOR));
|
|
}
|
|
#ifdef CONFIG_X86_LOCAL_APIC
|
|
for_each_clear_bit_from(i, used_vectors, NR_VECTORS)
|
|
set_intr_gate(i, spurious_interrupt);
|
|
#endif
|
|
|
|
if (!acpi_ioapic && !of_ioapic && nr_legacy_irqs())
|
|
setup_irq(2, &irq2);
|
|
|
|
#ifdef CONFIG_X86_32
|
|
irq_ctx_init(smp_processor_id());
|
|
#endif
|
|
}
|