Method of jailhouse.bin randomization loading

Abstract

A jailhouse.bin randomization loading method, including a preparation stage and a loading running stage, in the preparation stage, modifying an existing jailhouse.bin compilation framework and parsing and saving jailhouse.o relocation section content, in the loading running stage, according to the saved jailhouse.o relocation section content, obtaining the relocation information of jailhouse.bin, and according to the actual loading base address, performing the relocation correction, so that the code of jailhouse.bin in the memory can access the correct data. The present application realizes the relocation correction of the code and data of jailhouse.bin in the memory by generating the relocation section information of jailhouse.bin, so that the randomization of jailhouse.bin is still functional.

Description

Technical Field

[0001] This invention relates to the field of virtualization driver optimization technology, specifically to a method for randomized loading of jailhouse.bin. Background Technology

[0002] Jailhouse is a statically partitioned virtualization solution that does not support any device emulation. The jailhouse.ko driver in the rootcell loads jailhouse.bin into a reserved physical memory area. Jailhouse.bin then becomes the jailhouse hypervisor code, providing partitioned virtualization functionality for jailhouse. Currently, jailhouse.ko must load jailhouse.bin into a fixed kernel virtual address; otherwise, it will not function correctly.

[0003] The existing jailhouse solution requires jailhouse.bin to be loaded into a fixed root cell kernel virtual address, which has two drawbacks:

[0004] 1) If this kernel address is occupied by another module, jailhouse will fail to load;

[0005] 2) The address is fixed, and the code is vulnerable to attacks, such as control flow hijacking attacks. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a method for randomized loading of jailhouse.bin, comprising a preparation phase and a loading and execution phase. In the preparation phase, the existing jailhouse.bin compilation framework is modified, and the contents of the jailhouse.o relocation section are parsed and saved. In the loading and execution phase, based on the saved jailhouse.o relocation section contents, the relocatable information of jailhouse.bin is obtained, and relocatability correction is performed according to the actual loaded base address, enabling the code in jailhouse.bin in memory to access the correct data.

[0007] The preparation phase includes the following steps:

[0008] Step S1: Modify the existing code that directly uses JAILHOUSE_BASE as a constant, and replace it with a global variable;

[0009] Step S2: Modify the existing jailhouse.bin compilation framework, find the jailhouse hypervisor Makefile, and add the -q option before the original -T linking command;

[0010] Step S3: Parse the contents of the jailhouse.o relocation section, and output the relocation entries and their corresponding sign values ​​and relative offsets;

[0011] Step S4: Record the relocation entries output in step S3, along with their corresponding symbol values ​​and relative offsets, in a specific format, and hardcode them into the code to prepare for relocation correction.

[0012] In step S3, the parsed relocation section content includes the location in the code segment or data segment that needs to be relocated, the relocation type, and the target value that needs to be relocated and corrected.

[0013] The loading and running phase includes the following steps:

[0014] Step Sa: Using the jailhouse user-space tool, execute jailhouse enable cmd;

[0015] Step Sb: The jailhouse user-space tool sends commands to the corresponding processing functions registered in jailhouse.ko via ioctl;

[0016] Step Sc: jailhouse.ko reads the jailhouse.bin firmware content from the hard drive;

[0017] Step Sd: Map a block of physical memory reserved by the system for the jailhouse hypervisor to a random virtual address;

[0018] Step Se: Update the actual address of the symbol based on the hard-coded symbol and offset value, as well as the current actual loaded base address;

[0019] Step Sf: Based on the relocation section information of the saved hypervisor.o, correct the code segment and data segment of jailhouse.bin that currently needs relocation correction.

[0020] In step Sf, based on the relocation section information of the saved hypervisor.o, the code segment and data segment of jailhouse.bin that need to be relocated are corrected according to the standard process indicated by the ELF relocation table entry format.

[0021] The randomized loading method for jailhouse.bin provided by this invention generates relocatable section information for jailhouse.bin, thereby enabling relocatable correction of the jailhouse.bin code and data in memory, so that the randomized jailhouse.bin still functions normally. Attached Figure Description

[0022] Figure 1 : Flowchart of the implementation of the jailhouse.bin randomized loading method of the present invention. Detailed Implementation

[0023] To gain a better understanding of the technical solution and beneficial effects of the present invention, the technical solution of the present invention and its beneficial effects are described in detail below with reference to the accompanying drawings.

[0024] This invention addresses the drawback of existing jailhouse.bin files that must be loaded to a fixed address by proposing a randomized loading method for jailhouse.bin. This method breaks the restriction of loading to a fixed address, increases the difficulty for malicious attackers to attack the system, and improves the code security of jailhouse.

[0025] This invention loads the code of jailhouse.bin into a random virtual address space in jailhouse.ko. Based on the relocatability information of jailhouse.bin, it performs relocatability correction according to the actual loading base address (i.e., the virtual address space to be written to). This ensures that the code of jailhouse.bin in memory can access the correct data and remains executable code, thus guaranteeing that jailhouse.bin functions normally after being loaded into a random base address.

[0026] In practice, the official jailhouse master version is used, along with an ARM Linux physical machine and gcc11 (ld needs to include the -q option). The process is divided into two phases: the preparation phase and the loading and running phase.

[0027] I. Preparation Stage

[0028] 1. Modify the existing code that directly uses JAILHOUSE_BASE as a constant, and replace it with a global variable.

[0029] 2. Modify the existing jailhouse.bin compilation framework. Locate the Makefile of the jailhouse hypervisor and add the -q option before the original -T linking command. This will generate additional relocation section information in the generated no-pie / no-pic jailhouse.o without affecting the jailhouse.bin code before and after the modification (the hash value of jailhouse.bin before and after is the same).

[0030] 3. Parse the contents of the jailhouse.o relocation section, including the location in the code or data segment that needs to be relocated, the relocation type, and the target value that needs to be corrected by the relocation. Output the relocation entry of type ABS, along with its corresponding symbol value and relative offset (base address JAILHOUSE_BASE). These relocation entries represent the locations (including code and data segments) that need to be actually corrected after jailhouse.bin is randomly loaded.

[0031] 4. Hardcode the information that needs to be corrected in step 3 into the code according to a certain recording format to prepare for subsequent relocation correction.

[0032] II. Loading and Running Phase

[0033] 1. Users can execute jailhouse enable cmd using the jailhouse user-space tool.

[0034] 2. The jailhouse user-space tool sends commands to the corresponding processing functions registered in jailhouse.ko via ioctl.

[0035] 3. jailhouse.ko reads the jailhouse.bin firmware content from the hard drive.

[0036] 4. Map a block of physical memory reserved by the system for the jailhouse hypervisor to a random virtual address.

[0037] 5. Copy the jailhouse.bin firmware code to the virtual address space that was just mapped (i.e., copy it to the reserved memory).

[0038] 6. Update the actual address of the symbol based on the hard-coded symbol and offset value, as well as the currently loaded base address.

[0039] 7. Based on the relocation section information of the saved hypervisor.o, and following the standard procedure indicated by the ELF relocation table entry format, correct the code segment and data segment of jailhouse.bin that currently needs relocation correction.

[0040] 8. Continue with the existing operations.

[0041] The randomized loading method for jailhouse.bin provided by this invention breaks the restriction that jailhouse.bin must be loaded to a fixed address, thereby: 1) avoiding the failure of jailhouse.bin loading due to the fixed address being occupied; 2) after the loading base address is randomized, the difficulty for malicious attackers to attack the system is effectively increased, and the security of jailhouse code is improved.

[0042] Although the present invention has been described using the above preferred embodiments, it is not intended to limit the scope of protection of the present invention. Any changes and modifications made by those skilled in the art to the above embodiments without departing from the spirit and scope of the present invention shall still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A method for randomized loading of jailhouse.bin, including a preparation phase and a loading / running phase. The preparation phase includes the following steps: Step S1: Modify the existing code that directly uses JAILHOUSE_BASE as a constant, and replace it with a global variable; Step S2: Modify the existing jailhouse.bin compilation framework, find the jailhouse hypervisor Makefile, and add the -q option before the original -T linking command; Step S3: Parse the contents of the jailhouse.o relocation section, and output the relocation entries and their corresponding sign values ​​and relative offsets; Step S4: Record the relocation entries output in step S3, along with their corresponding symbol values ​​and relative offsets, in a specific format, and hardcode them into the code to prepare for relocation correction. The loading and running phase includes the following steps: Step Sa: Using the jailhouse user-space tool, execute jailhouse enable cmd; Step Sb: The jailhouse user-space tool sends commands to the corresponding processing functions registered in jailhouse.ko via ioctl; Step Sc: jailhouse.ko reads the jailhouse.bin firmware content from the hard drive; Step Sd: Map a block of physical memory reserved by the system for the jailhouse hypervisor to a random virtual address; Step Se: Update the actual address of the symbol based on the hard-coded symbol and offset value, as well as the current actual loaded base address; Step Sf: Based on the saved relocation section information of hypervisor.o, correct the code segment and data segment of jailhouse.bin that currently needs relocation correction; During the preparation phase, the existing jailhouse.bin compilation framework is modified and the contents of the jailhouse.o relocation section are parsed and saved. During the loading and running phase, the relocatable information of jailhouse.bin is obtained based on the saved contents of the jailhouse.o relocation section. According to the actual loaded base address, the relocatability is corrected so that the code of jailhouse.bin in memory can access the correct data.

2. The method for randomized loading of jailhouse.bin as described in claim 1, characterized in that, In step S3, the parsed relocation section content includes the location in the code segment or data segment that needs to be relocated, the relocation type, and the target value that needs to be relocated and corrected.

3. The method for randomized loading of jailhouse.bin as described in claim 1, characterized in that, In step Sf, based on the relocation section information of the saved hypervisor.o, the code segment and data segment of jailhouse.bin that need to be relocated are corrected according to the standard process indicated by the ELF relocation table entry format.

Images