[PATCH] 2.6.27: add a kernel hacking option to protect kernel memory between different modules

[PATCH] 2.6.27: add a kernel hacking option to protect kernel memory between different modules

[Pengfei Hu]

At first I'm a newbie in linux kernel and my English is not so good.
So don't laugh at me:)
In linux kernel, there are only memory protections between user
processes and between user processes and kernel. There is no
protection between different kernel modules (common concept, not refer
loadable kernel). The reason is the kernel's requirement for
efficiency and simplicity. But now more and more embed application use
linux. In the traditional embed system, all the task run in kernel and
share the memory. Using kernel thread can immigrate these application
easily. So there will be many task run in the kernel. And there will
be more and more memory bugs. Vxworks 6.0 provide memory protection
between tasks. In linux, I write a patch adding a kernel hacking
option to do it.
Basicly, it allocate module ID for kernel memory. Only memory's owner
module can access it and avoid accidental access form other module. To
achieve this goal, the simplest way is setting page table's present
flag when enter the module. And clear present flag when leave the
module. But can't do it in SMP because page table is shared among all
CPU. Though we can use multi kernel page table, but it will make thing
very complex and hardly immigrate to other arch (MIPS) without
hardware page table. I use a way to always clear present flag and very
CPU use it's own TLB access memory. Maintain a address-module table.
When allocate page record it's owner module ID in the table and clear
present flag. In page fault, look at address-module table. If the page
belong the current module then set present flag and load TLB. And then
clear present flag again immediately but this time don't invalide TLB.
Keep the page in this CPU's TLB. Though there is a time window, it's
inevitable and not so serious.
Because only part of memory need protect and many memory shoud be
share in kernel. So it is necessary to allocate shared memory and
provide another set of interface for protected memory allocating. This
set of interface should be very simple and when turn off the kernel
hacking option it will equal to original interface. There are two
possible way to do this. One way is provide another functions such as
alloc_pages_p kmalloc_p for alloc_pages kmalloc. When turn off the
option, define the macro as alloc_pages kmalloc. This way will add
many function in kernel. The other way that I current use is use the
original interface, and add a set of bit flag. When turn off the
option define the flag as 0. Because kmap_high and vmalloc don't have
flag input parameter. We can use the most lower bit of kmap_high's
page parameter and the most higher bit of vmalloc's size parameter.
Because these bit can't be use normally.
I only modify the __alloc_pages_internal and __free_pages. Using it as
a basic, other function like slab and vmalloc can be modify easily.
And I only modify smp_apic_timer_interrupt and do_IRQ. I think it is
not very necessary to modify other interrupt handler.
This patch is on 2.6.27. It does not include PAE and x86-64. It's only
a conceptual thing. If everyone agree me then I'll finish it.
                                                     Pengfei Hu

diff -Naur old/arch/x86/Kconfig.debug new/arch/x86/Kconfig.debug
--- old/arch/x86/Kconfig.debug	2008-10-10 06:13:53.000000000 +0800
+++ new/arch/x86/Kconfig.debug	2008-11-01 17:56:01.000000000 +0800
@@ -67,6 +67,14 @@
 	  This results in a large slowdown, but helps to find certain types
 	  of memory corruptions.

+config DEBUG_KM_PROTECT
+        bool "Debug kernel memory protect"
+        depends on DEBUG_KERNEL && SLUB
+        help
+          Change page table's present flag to prevent other module's accidental
+          access. This results in a large slowdown and waste more memory, but
+          helps to find certain types of memory corruptions.
+
 config DEBUG_PER_CPU_MAPS
 	bool "Debug access to per_cpu maps"
 	depends on DEBUG_KERNEL
diff -Naur old/arch/x86/kernel/apic_32.c new/arch/x86/kernel/apic_32.c
--- old/arch/x86/kernel/apic_32.c	2008-10-10 06:13:53.000000000 +0800
+++ new/arch/x86/kernel/apic_32.c	2008-11-02 12:08:16.000000000 +0800
@@ -28,6 +28,7 @@
 #include <linux/acpi_pmtmr.h>
 #include <linux/module.h>
 #include <linux/dmi.h>
+#include <linux/km_protect.h>

 #include <asm/atomic.h>
 #include <asm/smp.h>
@@ -618,6 +619,9 @@
 void smp_apic_timer_interrupt(struct pt_regs *regs)
 {
 	struct pt_regs *old_regs = set_irq_regs(regs);
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	unsigned short temp = km_set_id(0);
+#endif

 	/*
 	 * NOTE! We'd better ACK the irq immediately,
@@ -634,6 +638,9 @@
 	irq_exit();

 	set_irq_regs(old_regs);
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	km_set_id(temp);
+#endif
 }

 int setup_profiling_timer(unsigned int multiplier)
diff -Naur old/arch/x86/kernel/irq_32.c new/arch/x86/kernel/irq_32.c
--- old/arch/x86/kernel/irq_32.c	2008-10-10 06:13:53.000000000 +0800
+++ new/arch/x86/kernel/irq_32.c	2008-11-02 12:08:17.000000000 +0800
@@ -15,6 +15,7 @@
 #include <linux/notifier.h>
 #include <linux/cpu.h>
 #include <linux/delay.h>
+#include <linux/km_protect.h>

 #include <asm/apic.h>
 #include <asm/uaccess.h>
@@ -225,6 +226,9 @@
 	/* high bit used in ret_from_ code */
 	int overflow, irq = ~regs->orig_ax;
 	struct irq_desc *desc = irq_desc + irq;
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	unsigned short temp = km_set_id(0);
+#endif

 	if (unlikely((unsigned)irq >= NR_IRQS)) {
 		printk(KERN_EMERG "%s: cannot handle IRQ %d\n",
@@ -245,6 +249,9 @@

 	irq_exit();
 	set_irq_regs(old_regs);
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	km_set_id(temp);
+#endif
 	return 1;
 }

diff -Naur old/arch/x86/mm/fault.c new/arch/x86/mm/fault.c
--- old/arch/x86/mm/fault.c	2008-10-10 06:13:53.000000000 +0800
+++ new/arch/x86/mm/fault.c	2008-11-01 17:56:01.000000000 +0800
@@ -26,6 +26,7 @@
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
 #include <linux/kdebug.h>
+#include <linux/km_protect.h>

 #include <asm/system.h>
 #include <asm/desc.h>
@@ -844,6 +845,10 @@
 	if (is_errata93(regs, address))
 		return;

+#ifdef CONFIG_DEBUG_KM_PROTECT
+	if ((0 != tsk->km_id) && km_valid_addr(address))
+		return;
+#endif
 /*
  * Oops. The kernel tried to access some bad page. We'll have to
  * terminate things with extreme prejudice.
diff -Naur old/arch/x86/mm/km_protect.c new/arch/x86/mm/km_protect.c
--- old/arch/x86/mm/km_protect.c	1970-01-01 08:00:00.000000000 +0800
+++ new/arch/x86/mm/km_protect.c	2008-11-02 18:13:55.000000000 +0800
@@ -0,0 +1,169 @@
+/*
+ * (C) 2008, Pengfei Hu
+ */
+
+#include <linux/bootmem.h>
+#include <linux/proc_fs.h>
+#include <linux/buffer_head.h>
+#include <linux/km_protect.h>
+
+unsigned short cur_km_id;
+unsigned short *km_table;
+
+void km_test1(void)
+{
+	volatile int val;
+	unsigned long addr;
+	unsigned short km_id = km_alloc_id();
+	km_set_id(km_id);
+	addr = __get_free_page(GFP_KERNEL | __GFP_KM_PROTECT);
+	if (addr) {
+		val = *(int *)addr;
+		km_set_id(0);
+		printk(KERN_EMERG "After km_set_id(0):\n");
+		val = *(int *)addr;
+		free_pages(addr, 1);
+	}
+	else {
+		printk(KERN_EMERG "__get_free_page failed\n");
+	}
+}
+unsigned long km_test_addr;
+unsigned short km_test_id;
+spinlock_t km_test_lock;
+
+int km_thread1(void * arg)
+{
+	volatile int val;
+	struct task_struct *tsk = current;
+	set_task_comm(tsk, "km_thread1");
+	printk(KERN_INFO "PID: %x\n", current->pid);
+	spin_lock(&km_test_lock);
+	if (0 == km_test_id) {
+		km_test_id = km_alloc_id();
+		km_set_id(km_test_id);
+		km_test_addr = __get_free_page(GFP_KERNEL | __GFP_KM_PROTECT);
+		if (!km_test_addr) {
+			printk(KERN_INFO "__get_free_page failed\n");
+			goto no_mem;
+		}
+	}
+	else {
+		if (!km_test_addr)
+			goto no_mem;
+		km_set_id(km_test_id);
+	}
+	spin_unlock(&km_test_lock);
+	while(1) {
+		val = *(int *)km_test_addr;
+		udelay(1000);
+	}
+no_mem:	
+	spin_unlock(&km_test_lock);
+	return -1;
+}
+int km_thread2(void * arg)
+{
+	volatile int val;
+	struct task_struct *tsk = current;
+	set_task_comm(tsk, "km_thread2");
+	int i;
+	printk(KERN_INFO "PID: %x\n", current->pid);
+	for(i = 0; i++; i < 100)
+		udelay(20000);
+	while(1) {
+		if (km_test_addr)
+			val = *(int *)km_test_addr;
+		udelay(1000);
+	}
+	return 0;
+}
+void km_test2(void)
+{
+	spin_lock_init(&km_test_lock);
+	kernel_thread(km_thread1, 0, CLONE_FS | CLONE_SIGHAND);
+	kernel_thread(km_thread1, 0, CLONE_FS | CLONE_SIGHAND);
+	kernel_thread(km_thread2, 0, CLONE_FS | CLONE_SIGHAND);
+}
+int km_protect_write(struct file *file, const char __user * buffer,
+		unsigned long count, void *data)
+{
+	char buf[8];
+	unsigned long len = min((unsigned long)sizeof(buf) - 1, count);
+	unsigned long cmd;
+	if (copy_from_user(buf, buffer, len))
+		return count;
+	buf[len] = 0;
+	sscanf(buf, "%li", &cmd);
+	switch (cmd) {
+	case 1:
+		km_test1();
+		break;
+	case 2:
+		km_test2();
+		break;
+	default:
+		printk(KERN_INFO "Command error!\n");
+	}
+	return strnlen(buf, len);
+}
+int km_protect_read(char *buf, char **start, off_t offset,
+		int count, int *eof, void *data)
+{
+	*eof = 1;
+	return sprintf(buf, "\n");
+}
+void __init km_protect_init(void)
+{
+	km_table = (unsigned short *)alloc_bootmem(KM_TABLE_SIZE);
+	if (!km_table) {
+		printk(KERN_EMERG "km_protect: alloc km_table failed!\n");
+		return;
+	}
+	memset(km_table, 0, KM_TABLE_SIZE);
+}
+void __init km_protect_dbginit(void)
+{
+	struct proc_dir_entry *e;
+	e = create_proc_entry("km_protect", 0, NULL);
+	if (!e) {
+		printk(KERN_EMERG "km_protect: Create proc file failed!\n");
+		return;
+	}
+	e->read_proc = km_protect_read;
+	e->write_proc = km_protect_write;
+	e->data = NULL;
+}
+void km_protect_addr(unsigned long addr, int numpages)
+{
+	pte_t *kpte;
+	unsigned int level;
+	WARN_ON(0 == current->km_id);
+	while (numpages > 0)
+	{
+		kpte = lookup_address(addr, &level);
+		km_table[__pa(addr) >> PAGE_SHIFT] = current->km_id;
+		kpte->pte &= ~(_PAGE_PRESENT);
+		__flush_tlb_one(addr);
+		numpages--;
+		addr += PAGE_SIZE;
+	}
+}
+void km_unprotect_addr(unsigned long addr, int numpages)
+{
+	pte_t *kpte;
+	unsigned int level;
+	if (0 == km_table[__pa(addr) >> PAGE_SHIFT])
+		return;
+	while (numpages > 0)
+	{
+		WARN_ON(km_table[__pa(addr) >> PAGE_SHIFT] != current->km_id);
+		kpte = lookup_address(addr, &level);
+		kpte->pte |= _PAGE_PRESENT;
+		__flush_tlb_one(addr);
+		km_table[__pa(addr) >> PAGE_SHIFT] = 0;
+		numpages--;
+		addr += PAGE_SIZE;
+	}
+}
+
diff -Naur old/arch/x86/mm/Makefile new/arch/x86/mm/Makefile
--- old/arch/x86/mm/Makefile	2008-10-10 06:13:53.000000000 +0800
+++ new/arch/x86/mm/Makefile	2008-11-01 17:56:01.000000000 +0800
@@ -22,3 +22,4 @@
 obj-$(CONFIG_ACPI_NUMA)		+= srat_$(BITS).o

 obj-$(CONFIG_MEMTEST)		+= memtest.o
+obj-$(CONFIG_DEBUG_KM_PROTECT) += km_protect.o
diff -Naur old/include/linux/gfp.h new/include/linux/gfp.h
--- old/include/linux/gfp.h	2008-10-10 06:13:53.000000000 +0800
+++ new/include/linux/gfp.h	2008-11-01 17:56:01.000000000 +0800
@@ -43,6 +43,11 @@
 #define __GFP_REPEAT	((__force gfp_t)0x400u)	/* See above */
 #define __GFP_NOFAIL	((__force gfp_t)0x800u)	/* See above */
 #define __GFP_NORETRY	((__force gfp_t)0x1000u)/* See above */
+#ifdef CONFIG_DEBUG_KM_PROTECT
+#define __GFP_KM_PROTECT	((__force gfp_t)0x2000u)/* Kernel memory protect */
+#else
+#define __GFP_KM_PROTECT	((__force gfp_t)0x0u)/* Kernel memory protect */
+#endif
 #define __GFP_COMP	((__force gfp_t)0x4000u)/* Add compound page metadata */
 #define __GFP_ZERO	((__force gfp_t)0x8000u)/* Return zeroed page on success */
 #define __GFP_NOMEMALLOC ((__force gfp_t)0x10000u) /* Don't use
emergency reserves */
diff -Naur old/include/linux/km_protect.h new/include/linux/km_protect.h
--- old/include/linux/km_protect.h	1970-01-01 08:00:00.000000000 +0800
+++ new/include/linux/km_protect.h	2008-11-02 12:18:47.000000000 +0800
@@ -0,0 +1,76 @@
+/*
+ * (C) 2008, Pengfei Hu
+ */
+
+#ifndef _LINUX_KM_PROTECT_H
+#define	_LINUX_KM_PROTECT_H
+
+#include <asm/tlbflush.h>
+#include <asm/pgtable.h>
+#include <asm/current.h>
+
+#define MAX_KM_ID 65535
+#define KM_TABLE_SIZE 256*1024*sizeof(unsigned short)
+
+extern unsigned short cur_km_id;
+extern unsigned short *km_table;
+
+#ifdef CONFIG_DEBUG_KM_PROTECT
+
+void __init km_protect_init(void);
+void __init km_protect_dbginit(void);
+void km_protect_addr(unsigned long addr, int numpages);
+void km_unprotect_addr(unsigned long addr, int numpages);
+static inline unsigned short km_alloc_id(void)
+{
+	if(cur_km_id < MAX_KM_ID)
+		return ++cur_km_id;
+	return 0;
+}
+static inline unsigned short km_set_id(unsigned short km_id)
+{
+	if (current->km_id != km_id) {
+		unsigned short prev = current->km_id;
+		current->km_id = km_id;
+		if (prev != 0)
+			__flush_tlb_all();
+		return prev;
+	}
+	return km_id;
+}
+static inline bool km_valid_addr(unsigned long addr)
+{
+	pte_t *kpte;
+	unsigned int level;
+	volatile int v;
+	if (km_table[__pa(addr) >> PAGE_SHIFT] != current->km_id)
+		return false;
+	kpte = lookup_address(addr, &level);
+	kpte->pte |= _PAGE_PRESENT;
+//	set_pte_atomic(kpte, pfn_pte(pte_pfn(*kpte),
__pgprot(pgprot_val(pte_pgprot(*kpte)) |
pgprot_val(__pgprot(_PAGE_PRESENT)))));
+	__flush_tlb_one(addr);
+	/* Load page into tlb */
+	v = *(int *)addr;
+	kpte->pte &= ~(_PAGE_PRESENT);
+	return true;
+}
+#else /* CONFIG_DEBUG_KM_PROTECT */
+
+static inline void __init km_protect_init(void)
+{
+}
+static inline void __init km_protect_dbginit(void)
+{
+}
+static inline unsigned short km_alloc_id()
+{
+	return 0;
+}
+static inline unsigned short km_set_id(unsigned short km_id)
+{
+	return 0;
+}
+
+#endif /* CONFIG_DEBUG_KM_PROTECT */
+
+#endif	/* _LINUX_KM_PROTECT_H */
diff -Naur old/include/linux/sched.h new/include/linux/sched.h
--- old/include/linux/sched.h	2008-10-10 06:13:53.000000000 +0800
+++ new/include/linux/sched.h	2008-11-01 17:56:01.000000000 +0800
@@ -1060,6 +1060,9 @@
 	 */
 	unsigned char fpu_counter;
 	s8 oomkilladj; /* OOM kill score adjustment (bit shift). */
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	unsigned short km_id;
+#endif
 #ifdef CONFIG_BLK_DEV_IO_TRACE
 	unsigned int btrace_seq;
 #endif
diff -Naur old/init/main.c new/init/main.c
--- old/init/main.c	2008-10-10 06:13:53.000000000 +0800
+++ new/init/main.c	2008-11-01 17:56:01.000000000 +0800
@@ -60,6 +60,7 @@
 #include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/idr.h>
+#include <linux/km_protect.h>

 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -644,6 +645,7 @@
 #endif
 	vfs_caches_init_early();
 	cpuset_init_early();
+	km_protect_init();
 	mem_init();
 	enable_debug_pagealloc();
 	cpu_hotplug_init();
@@ -678,6 +680,7 @@
 #ifdef CONFIG_PROC_FS
 	proc_root_init();
 #endif
+	km_protect_dbginit();
 	cgroup_init();
 	cpuset_init();
 	taskstats_init_early();
diff -Naur old/kernel/fork.c new/kernel/fork.c
--- old/kernel/fork.c	2008-10-10 06:13:53.000000000 +0800
+++ new/kernel/fork.c	2008-11-01 17:56:01.000000000 +0800
@@ -932,6 +932,9 @@
 	if (!p)
 		goto fork_out;

+#ifdef CONFIG_DEBUG_KM_PROTECT
+	p->km_id = 0;
+#endif
 	rt_mutex_init_task(p);

 #ifdef CONFIG_PROVE_LOCKING
diff -Naur old/kernel/sched.c new/kernel/sched.c
--- old/kernel/sched.c	2008-10-10 06:13:53.000000000 +0800
+++ new/kernel/sched.c	2008-11-01 17:56:01.000000000 +0800
@@ -2606,6 +2606,10 @@
 	 */
 	arch_enter_lazy_cpu_mode();

+#ifdef CONFIG_DEBUG_KM_PROTECT
+	if (prev->km_id != 0)
+		__flush_tlb_all();
+#endif
 	if (unlikely(!mm)) {
 		next->active_mm = oldmm;
 		atomic_inc(&oldmm->mm_count);
diff -Naur old/mm/page_alloc.c new/mm/page_alloc.c
--- old/mm/page_alloc.c	2008-10-10 06:13:53.000000000 +0800
+++ new/mm/page_alloc.c	2008-11-01 17:56:01.000000000 +0800
@@ -46,6 +46,7 @@
 #include <linux/page-isolation.h>
 #include <linux/memcontrol.h>
 #include <linux/debugobjects.h>
+#include <linux/km_protect.h>

 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -1638,6 +1639,10 @@
 		show_mem();
 	}
 got_pg:
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	if ((gfp_mask & __GFP_KM_PROTECT) && (!PageHighMem(page)))
+		km_protect_addr((unsigned long)page_address(page), (1 << order));
+#endif
 	return page;
 }
 EXPORT_SYMBOL(__alloc_pages_internal);
@@ -1689,6 +1694,10 @@
 			free_hot_page(page);
 		else
 			__free_pages_ok(page, order);
+#ifdef CONFIG_DEBUG_KM_PROTECT
+	if (!PageHighMem(page))
+		km_unprotect_addr((unsigned long)page_address(page), (1 << order));
+#endif
 	}
 }

Re: [PATCH] 2.6.27: add a kernel hacking option to protect kernel memory between different modules

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 1774 bytes --]

On Sun, 02 Nov 2008 22:15:11 +0800, Pengfei Hu said:

> efficiency and simplicity. But now more and more embed application use
> linux. In the traditional embed system, all the task run in kernel and
> share the memory. Using kernel thread can immigrate these application
> easily. So there will be many task run in the kernel.

So the target is embedded systems doing all sorts of stupid-crazy kernel
thread tricks...

> +          Change page table's present flag to prevent other module's accidental
> +          access. This results in a large slowdown and waste more memory, but
> +          helps to find certain types of memory corruptions.

And your solution is to create a large slowdown, which will just make them
look for ways to make it go faster... perhaps including even *more* stupid-crazy
kernel thread tricks?

Can you point at any bugs/failure modes that this patch would detect, but
would *not* be found by any of the already-existing memory debugging tools?

Is it at all sane to expect that a reasonable setting can be done for
things like slab and vmalloc?  What happens when multiple modules allocate
out of the same slab, or even worse, get vmalloc/kmalloc for *different*
things on the same physical page?  It seems that unless you can separate
memory allocations by module, this isn't going to provide a lot of help in
finding memory allocation/usage issues.

And I won't even *start* on all the data structures in the kernel that are
shared across modules - do a 'cat /proc/slabinfo' or equivalent, and ask
yourself how many of those you could tag as "private to module A", or
"read/write by B, read-only by C, no-access by others".

You *really* don't want to re-invent the IBM MVS-style "GETMAIN/FREEMAIN SP=nnn"
mess. Trust me on this one. ;)


[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: [PATCH] 2.6.27: add a kernel hacking option to protect kernel memory between different modules

[Pengfei Hu]

>
> And your solution is to create a large slowdown, which will just make them
> look for ways to make it go faster... perhaps including even *more* stupid-crazy
> kernel thread tricks?
>

Maybe you don't like it, but it is true. My company's product use
linux but most of
programmer even don'nt knot splin lock. There are many bugs in their code. It is
nessary to avoid mistiake automaticly. My patch is just a kernel
hacking option and
it won't slowdonw kernel in release version. How do you think
CONFIG_DEBUG_PAGEALLOC,
it also slowdonw kernel. And if you ever used bounds checker or valgrind, they
slowdown even worse.

> Can you point at any bugs/failure modes that this patch would detect, but
> would *not* be found by any of the already-existing memory debugging tools?

You know the worst bug of memory allocation is dangling pointer if tow module
use one allocator. Although there are some tool can detect this bug, but all of
them works in user space. They can use in kernel.

> Is it at all sane to expect that a reasonable setting can be done for
> things like slab and vmalloc?  What happens when multiple modules allocate
> out of the same slab, or even worse, get vmalloc/kmalloc for *different*
> things on the same physical page?  It seems that unless you can separate
> memory allocations by module, this isn't going to provide a lot of help in
> finding memory allocation/usage issues.
>

I want to let every registered module use it own caches just like
general caches.
The unit of vmalloc's size is page, so it won't have any trouble. The
protection must
work on page. I know the current code of kernel doesn't need this "private page"
feature. But maybe in the future it will get some help. And this
feature is compitable
with the current "globle page". It just like kernel support
SCHED_FIFO. Do you think
SCHED_FIFO is helpful to normal linux system?