Print this page
uts: Allow for address space randomisation.
Randomise the base addresses of shared objects, non-fixed mappings, the
stack and the heap. Introduce a service, svc:/system/process-security,
and a tool psecflags(1) to control and observe it
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/sun4u/vm/mach_vm_dep.c
+++ new/usr/src/uts/sun4u/vm/mach_vm_dep.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 23 * Use is subject to license terms.
24 24 */
25 25
26 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
27 27 /* All Rights Reserved */
28 28
29 29 /*
30 30 * Portions of this source code were derived from Berkeley 4.3 BSD
31 31 * under license from the Regents of the University of California.
32 32 */
33 33
34 34 /*
35 35 * UNIX machine dependent virtual memory support.
36 36 */
37 37
38 38 #include <sys/vm.h>
|
↓ open down ↓ |
38 lines elided |
↑ open up ↑ |
39 39 #include <sys/exec.h>
40 40 #include <sys/cmn_err.h>
41 41 #include <sys/cpu_module.h>
42 42 #include <sys/cpu.h>
43 43 #include <sys/elf_SPARC.h>
44 44 #include <sys/archsystm.h>
45 45 #include <vm/hat_sfmmu.h>
46 46 #include <sys/memnode.h>
47 47 #include <sys/mem_cage.h>
48 48 #include <vm/vm_dep.h>
49 +#include <sys/random.h>
49 50
50 51 #if defined(__sparcv9) && defined(SF_ERRATA_57)
51 52 caddr_t errata57_limit;
52 53 #endif
53 54
54 55 uint_t page_colors = 0;
55 56 uint_t page_colors_mask = 0;
56 57 uint_t page_coloring_shift = 0;
57 58 int consistent_coloring;
58 59 int update_proc_pgcolorbase_after_fork = 0;
59 60
60 61 uint_t mmu_page_sizes = DEFAULT_MMU_PAGE_SIZES;
61 62 uint_t max_mmu_page_sizes = MMU_PAGE_SIZES;
62 63 uint_t mmu_hashcnt = DEFAULT_MAX_HASHCNT;
63 64 uint_t max_mmu_hashcnt = MAX_HASHCNT;
64 65 size_t mmu_ism_pagesize = DEFAULT_ISM_PAGESIZE;
65 66
66 67 /*
67 68 * The sun4u hardware mapping sizes which will always be supported are
68 69 * 8K, 64K, 512K and 4M. If sun4u based machines need to support other
69 70 * page sizes, platform or cpu specific routines need to modify the value.
70 71 * The base pagesize (p_szc == 0) must always be supported by the hardware.
71 72 */
72 73 int mmu_exported_pagesize_mask = (1 << TTE8K) | (1 << TTE64K) |
73 74 (1 << TTE512K) | (1 << TTE4M);
74 75 uint_t mmu_exported_page_sizes;
75 76
76 77 uint_t szc_2_userszc[MMU_PAGE_SIZES];
77 78 uint_t userszc_2_szc[MMU_PAGE_SIZES];
78 79
79 80 extern uint_t vac_colors_mask;
80 81 extern int vac_shift;
81 82
82 83 hw_pagesize_t hw_page_array[] = {
83 84 {MMU_PAGESIZE, MMU_PAGESHIFT, 0, MMU_PAGESIZE >> MMU_PAGESHIFT},
84 85 {MMU_PAGESIZE64K, MMU_PAGESHIFT64K, 0,
85 86 MMU_PAGESIZE64K >> MMU_PAGESHIFT},
86 87 {MMU_PAGESIZE512K, MMU_PAGESHIFT512K, 0,
87 88 MMU_PAGESIZE512K >> MMU_PAGESHIFT},
88 89 {MMU_PAGESIZE4M, MMU_PAGESHIFT4M, 0, MMU_PAGESIZE4M >> MMU_PAGESHIFT},
89 90 {MMU_PAGESIZE32M, MMU_PAGESHIFT32M, 0,
90 91 MMU_PAGESIZE32M >> MMU_PAGESHIFT},
91 92 {MMU_PAGESIZE256M, MMU_PAGESHIFT256M, 0,
92 93 MMU_PAGESIZE256M >> MMU_PAGESHIFT},
93 94 {0, 0, 0, 0}
94 95 };
95 96
96 97 /*
97 98 * Maximum page size used to map 64-bit memory segment kmem64_base..kmem64_end
98 99 */
99 100 int max_bootlp_tteszc = TTE4M;
100 101
101 102 /*
102 103 * use_text_pgsz64k and use_text_pgsz512k allow the user to turn on these
103 104 * additional text page sizes for USIII-IV+ and OPL by changing the default
104 105 * values via /etc/system.
105 106 */
106 107 int use_text_pgsz64K = 0;
107 108 int use_text_pgsz512K = 0;
108 109
109 110 /*
110 111 * Maximum and default segment size tunables for user heap, stack, private
111 112 * and shared anonymous memory, and user text and initialized data.
112 113 */
113 114 size_t max_uheap_lpsize = MMU_PAGESIZE4M;
114 115 size_t default_uheap_lpsize = MMU_PAGESIZE;
115 116 size_t max_ustack_lpsize = MMU_PAGESIZE4M;
116 117 size_t default_ustack_lpsize = MMU_PAGESIZE;
117 118 size_t max_privmap_lpsize = MMU_PAGESIZE4M;
118 119 size_t max_uidata_lpsize = MMU_PAGESIZE;
119 120 size_t max_utext_lpsize = MMU_PAGESIZE4M;
120 121 size_t max_shm_lpsize = MMU_PAGESIZE4M;
121 122
122 123 void
123 124 adjust_data_maxlpsize(size_t ismpagesize)
124 125 {
125 126 if (max_uheap_lpsize == MMU_PAGESIZE4M) {
126 127 max_uheap_lpsize = ismpagesize;
127 128 }
128 129 if (max_ustack_lpsize == MMU_PAGESIZE4M) {
129 130 max_ustack_lpsize = ismpagesize;
|
↓ open down ↓ |
71 lines elided |
↑ open up ↑ |
130 131 }
131 132 if (max_privmap_lpsize == MMU_PAGESIZE4M) {
132 133 max_privmap_lpsize = ismpagesize;
133 134 }
134 135 if (max_shm_lpsize == MMU_PAGESIZE4M) {
135 136 max_shm_lpsize = ismpagesize;
136 137 }
137 138 }
138 139
139 140 /*
141 + * The maximum amount a randomized mapping will be slewed. We should perhaps
142 + * arrange things so these tunables can be separate for mmap, mmapobj, and
143 + * ld.so
144 + */
145 +volatile size_t aslr_max_map_skew = 256 * 1024 * 1024; /* 256MB */
146 +
147 +/*
140 148 * map_addr_proc() is the routine called when the system is to
141 149 * choose an address for the user. We will pick an address
142 150 * range which is just below the current stack limit. The
143 151 * algorithm used for cache consistency on machines with virtual
144 152 * address caches is such that offset 0 in the vnode is always
145 153 * on a shm_alignment'ed aligned address. Unfortunately, this
146 154 * means that vnodes which are demand paged will not be mapped
147 155 * cache consistently with the executable images. When the
148 156 * cache alignment for a given object is inconsistent, the
149 157 * lower level code must manage the translations so that this
150 158 * is not seen here (at the cost of efficiency, of course).
151 159 *
152 160 * Every mapping will have a redzone of a single page on either side of
153 161 * the request. This is done to leave one page unmapped between segments.
154 162 * This is not required, but it's useful for the user because if their
155 163 * program strays across a segment boundary, it will catch a fault
156 164 * immediately making debugging a little easier. Currently the redzone
157 165 * is mandatory.
158 166 *
159 167 *
160 168 * addrp is a value/result parameter.
161 169 * On input it is a hint from the user to be used in a completely
162 170 * machine dependent fashion. For MAP_ALIGN, addrp contains the
163 171 * minimal alignment, which must be some "power of two" multiple of
164 172 * pagesize.
165 173 *
166 174 * On output it is NULL if no address can be found in the current
167 175 * processes address space or else an address that is currently
168 176 * not mapped for len bytes with a page of red zone on either side.
169 177 * If vacalign is true, then the selected address will obey the alignment
170 178 * constraints of a vac machine based on the given off value.
171 179 */
172 180 /*ARGSUSED4*/
173 181 void
174 182 map_addr_proc(caddr_t *addrp, size_t len, offset_t off, int vacalign,
175 183 caddr_t userlimit, struct proc *p, uint_t flags)
176 184 {
177 185 struct as *as = p->p_as;
178 186 caddr_t addr;
179 187 caddr_t base;
180 188 size_t slen;
181 189 uintptr_t align_amount;
182 190 int allow_largepage_alignment = 1;
183 191
184 192 base = p->p_brkbase;
185 193 if (userlimit < as->a_userlimit) {
186 194 /*
187 195 * This happens when a program wants to map something in
188 196 * a range that's accessible to a program in a smaller
189 197 * address space. For example, a 64-bit program might
190 198 * be calling mmap32(2) to guarantee that the returned
191 199 * address is below 4Gbytes.
192 200 */
193 201 ASSERT(userlimit > base);
194 202 slen = userlimit - base;
195 203 } else {
196 204 slen = p->p_usrstack - base -
197 205 ((p->p_stk_ctl + PAGEOFFSET) & PAGEMASK);
198 206 }
199 207
200 208 /* Make len be a multiple of PAGESIZE */
201 209 len = (len + PAGEOFFSET) & PAGEMASK;
202 210
203 211 /*
204 212 * If the request is larger than the size of a particular
205 213 * mmu level, then we use that level to map the request.
206 214 * But this requires that both the virtual and the physical
207 215 * addresses be aligned with respect to that level, so we
208 216 * do the virtual bit of nastiness here.
209 217 *
210 218 * For 32-bit processes, only those which have specified
211 219 * MAP_ALIGN or an addr will be aligned on a page size > 4MB. Otherwise
212 220 * we can potentially waste up to 256MB of the 4G process address
213 221 * space just for alignment.
214 222 */
215 223 if (p->p_model == DATAMODEL_ILP32 && ((flags & MAP_ALIGN) == 0 ||
216 224 ((uintptr_t)*addrp) != 0)) {
217 225 allow_largepage_alignment = 0;
218 226 }
219 227 if ((mmu_page_sizes == max_mmu_page_sizes) &&
220 228 allow_largepage_alignment &&
221 229 (len >= MMU_PAGESIZE256M)) { /* 256MB mappings */
222 230 align_amount = MMU_PAGESIZE256M;
223 231 } else if ((mmu_page_sizes == max_mmu_page_sizes) &&
224 232 allow_largepage_alignment &&
225 233 (len >= MMU_PAGESIZE32M)) { /* 32MB mappings */
226 234 align_amount = MMU_PAGESIZE32M;
227 235 } else if (len >= MMU_PAGESIZE4M) { /* 4MB mappings */
228 236 align_amount = MMU_PAGESIZE4M;
229 237 } else if (len >= MMU_PAGESIZE512K) { /* 512KB mappings */
230 238 align_amount = MMU_PAGESIZE512K;
231 239 } else if (len >= MMU_PAGESIZE64K) { /* 64KB mappings */
232 240 align_amount = MMU_PAGESIZE64K;
233 241 } else {
234 242 /*
235 243 * Align virtual addresses on a 64K boundary to ensure
236 244 * that ELF shared libraries are mapped with the appropriate
237 245 * alignment constraints by the run-time linker.
238 246 */
239 247 align_amount = ELF_SPARC_MAXPGSZ;
240 248 if ((flags & MAP_ALIGN) && ((uintptr_t)*addrp != 0) &&
241 249 ((uintptr_t)*addrp < align_amount))
242 250 align_amount = (uintptr_t)*addrp;
243 251 }
244 252
245 253 /*
246 254 * 64-bit processes require 1024K alignment of ELF shared libraries.
247 255 */
248 256 if (p->p_model == DATAMODEL_LP64)
249 257 align_amount = MAX(align_amount, ELF_SPARCV9_MAXPGSZ);
250 258 #ifdef VAC
251 259 if (vac && vacalign && (align_amount < shm_alignment))
252 260 align_amount = shm_alignment;
253 261 #endif
254 262
255 263 if ((flags & MAP_ALIGN) && ((uintptr_t)*addrp > align_amount)) {
256 264 align_amount = (uintptr_t)*addrp;
257 265 }
|
↓ open down ↓ |
108 lines elided |
↑ open up ↑ |
258 266
259 267 ASSERT(ISP2(align_amount));
260 268 ASSERT(align_amount == 0 || align_amount >= PAGESIZE);
261 269
262 270 /*
263 271 * Look for a large enough hole starting below the stack limit.
264 272 * After finding it, use the upper part.
265 273 */
266 274 as_purge(as);
267 275 off = off & (align_amount - 1);
276 +
268 277 if (as_gap_aligned(as, len, &base, &slen, AH_HI, NULL, align_amount,
269 278 PAGESIZE, off) == 0) {
270 279 caddr_t as_addr;
271 280
272 281 /*
273 282 * addr is the highest possible address to use since we have
274 283 * a PAGESIZE redzone at the beginning and end.
275 284 */
276 285 addr = base + slen - (PAGESIZE + len);
277 286 as_addr = addr;
278 287 /*
279 288 * Round address DOWN to the alignment amount and
280 289 * add the offset in.
|
↓ open down ↓ |
3 lines elided |
↑ open up ↑ |
281 290 * If addr is greater than as_addr, len would not be large
282 291 * enough to include the redzone, so we must adjust down
283 292 * by the alignment amount.
284 293 */
285 294 addr = (caddr_t)((uintptr_t)addr & (~(align_amount - 1l)));
286 295 addr += (long)off;
287 296 if (addr > as_addr) {
288 297 addr -= align_amount;
289 298 }
290 299
300 + /*
301 + * If randomization is requested, slew the allocation
302 + * backwards, within the same gap, by a random amount.
303 + *
304 + * XXX: This will fall over in processes like Java, which
305 + * commonly have a great many small mappings.
306 + */
307 + if (flags & _MAP_RANDOMIZE) {
308 + uint32_t slew;
309 + uint32_t maxslew;
310 +
311 + (void) random_get_pseudo_bytes((uint8_t *)&slew,
312 + sizeof (slew));
313 +
314 + maxslew = MIN(aslr_max_map_skew, (addr - base));
315 + /*
316 + * Don't allow ASLR to cause mappings to fail below
317 + * because of SF erratum #57
318 + */
319 + maxslew = MIN(maxslew, (addr - errata57_limit));
320 +
321 + slew = slew % MIN(MIN(aslr_max_map_skew, (addr - base)),
322 + addr - errata57_limit);
323 + addr -= P2ALIGN(slew, align_amount);
324 + }
325 +
291 326 ASSERT(addr > base);
292 327 ASSERT(addr + len < base + slen);
293 328 ASSERT(((uintptr_t)addr & (align_amount - 1l)) ==
294 329 ((uintptr_t)(off)));
295 330 *addrp = addr;
296 331
297 332 #if defined(SF_ERRATA_57)
298 333 if (AS_TYPE_64BIT(as) && addr < errata57_limit) {
299 334 *addrp = NULL;
300 335 }
301 336 #endif
302 337 } else {
303 338 *addrp = NULL; /* no more virtual space */
304 339 }
305 340 }
306 341
307 342 /*
308 343 * Platform-dependent page scrub call.
309 344 */
310 345 void
311 346 pagescrub(page_t *pp, uint_t off, uint_t len)
312 347 {
313 348 /*
314 349 * For now, we rely on the fact that pagezero() will
315 350 * always clear UEs.
316 351 */
317 352 pagezero(pp, off, len);
318 353 }
319 354
320 355 /*ARGSUSED*/
321 356 void
322 357 sync_data_memory(caddr_t va, size_t len)
323 358 {
324 359 cpu_flush_ecache();
325 360 }
326 361
327 362 /*
328 363 * platform specific large pages for kernel heap support
329 364 */
330 365 void
331 366 mmu_init_kcontext()
332 367 {
333 368 extern void set_kcontextreg();
334 369
335 370 if (kcontextreg)
336 371 set_kcontextreg();
337 372 }
338 373
339 374 void
340 375 contig_mem_init(void)
341 376 {
|
↓ open down ↓ |
41 lines elided |
↑ open up ↑ |
342 377 /* not applicable to sun4u */
343 378 }
344 379
345 380 /*ARGSUSED*/
346 381 caddr_t
347 382 contig_mem_prealloc(caddr_t alloc_base, pgcnt_t npages)
348 383 {
349 384 /* not applicable to sun4u */
350 385 return (alloc_base);
351 386 }
352 -
353 -size_t
354 -exec_get_spslew(void)
355 -{
356 - return (0);
357 -}
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX