mbox series

[v5,00/21] arm64: refactor boot flow

Message ID 20220624150651.1358849-1-ardb@kernel.org (mailing list archive)
Headers show
Series arm64: refactor boot flow | expand

Message

Ard Biesheuvel June 24, 2022, 3:06 p.m. UTC 
This series aims to streamline the boot flow with respect to cache
maintenance and redundant copying of data in memory.

Additionally, this series removes the little dance we do to create a
kernel mapping, relocate the kernel, run the KASLR init code, tear down
the old mapping and create a new one, relocate the kernel again, and
finally enter the kernel proper. Instead, it invokes a minimal C
function 'kaslr_early_init()' while running from the ID map which
includes a temporary mapping of the FDT. This change represents a
substantial chunk of the diffstat, as it requires some work to
instantiate code that can run safely from an arbitrary load address.

Changes since v4:
- drop all patches related to WXN support for the time being
- move assignment of vabits_actual earlier in the boot
- avoid TCR_T0SZ() macro as it is not quite appropriate for calculating
  the value of t0sz itself (as opposed to its representation in TCR)
- ensure that module randomization is done before modules may be loaded,
  which might we way before init runs (via request_module())

Changes since v3:
- drop changes for entering with the MMU enabled for now;
- reject mmap() and mprotect() calls with PROT_WRITE and PROT_EXEC flags
  passed when WXN is in effect; this essentially matches the behavior of
  both selinux and PaX, and most distros (including Android) can already
  deal with this just fine;
- defer KASLR initialization to an initcall() to the extent possible.
- add Anshuman's ack to a couple of patches

Changes since v2:
- create a separate, initial ID map that is discarded after boot, and
  create the permanent ID map from C code using the ordinary memory
  mapping code;
- refactor the extended ID map handling, and along with it, simplify the
  early memory mapping macros, so that we can deal with an extended ID
  map that requires multiple table entries at intermediate levels;
- eliminate all variable assignments with the MMU off from the happy
  flow;
- replace temporary FDT mapping in TTBR1 with a FDT mapping in the
  initial ID map;
- use read-only attributes for all code mappings, so we can boot with
  WXN enabled if we elect to do so.

Changes since v1:
- Remove the dodgy handling of the KASLR seed, which was necessary to
  avoid doing two iterations of the setup/teardown of the page tables.
  This is now dealt with by creating the TTBR1 page tables while
  executing from TTBR0, and so all memory manipulations are still done
  with the MMU and caches on.
- Only boot from EFI with the MMU and caches on if the image was not
  moved around in memory. Otherwise, we cannot rely on the firmware's ID
  map to have created an executable mapping for the copied code.

[0] https://lore.kernel.org/all/20220304175657.2744400-1-ardb@kernel.org/
[1] https://lore.kernel.org/all/20220330154205.2483167-1-ardb@kernel.org/
[2] https://lore.kernel.org/all/20220613144550.3760857-1-ardb@kernel.org/

Cc: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>

Ard Biesheuvel (21):
  arm64: head: move kimage_vaddr variable into C file
  arm64: mm: make vabits_actual a build time constant if possible
  arm64: head: move assignment of idmap_t0sz to C code
  arm64: head: drop idmap_ptrs_per_pgd
  arm64: head: simplify page table mapping macros (slightly)
  arm64: head: switch to map_memory macro for the extended ID map
  arm64: head: split off idmap creation code
  arm64: kernel: drop unnecessary PoC cache clean+invalidate
  arm64: head: pass ID map root table address to __enable_mmu()
  arm64: mm: provide idmap pointer to cpu_replace_ttbr1()
  arm64: head: add helper function to remap regions in early page tables
  arm64: head: cover entire kernel image in initial ID map
  arm64: head: use relative references to the RELA and RELR tables
  arm64: head: create a temporary FDT mapping in the initial ID map
  arm64: idreg-override: use early FDT mapping in ID map
  arm64: head: factor out TTBR1 assignment into a macro
  arm64: head: populate kernel page tables with MMU and caches on
  arm64: head: record CPU boot mode after enabling the MMU
  arm64: kaslr: defer initialization to initcall where permitted
  arm64: head: avoid relocating the kernel twice for KASLR
  arm64: setup: drop early FDT pointer helpers

 arch/arm64/include/asm/assembler.h      |  31 +-
 arch/arm64/include/asm/kernel-pgtable.h |  18 +-
 arch/arm64/include/asm/memory.h         |   4 +
 arch/arm64/include/asm/mmu_context.h    |  16 +-
 arch/arm64/include/asm/setup.h          |   3 -
 arch/arm64/kernel/Makefile              |   2 +-
 arch/arm64/kernel/cpufeature.c          |   2 +-
 arch/arm64/kernel/head.S                | 458 ++++++++------------
 arch/arm64/kernel/hyp-stub.S            |   4 +-
 arch/arm64/kernel/idreg-override.c      |  17 +-
 arch/arm64/kernel/image-vars.h          |   4 +
 arch/arm64/kernel/kaslr.c               | 149 +------
 arch/arm64/kernel/pi/Makefile           |  33 ++
 arch/arm64/kernel/pi/kaslr_early.c      | 112 +++++
 arch/arm64/kernel/setup.c               |  15 -
 arch/arm64/kernel/sleep.S               |   1 +
 arch/arm64/kernel/suspend.c             |   2 +-
 arch/arm64/kernel/vmlinux.lds.S         |  19 +-
 arch/arm64/mm/init.c                    |  15 +-
 arch/arm64/mm/kasan_init.c              |   4 +-
 arch/arm64/mm/mmu.c                     |  55 ++-
 arch/arm64/mm/proc.S                    |  10 +-
 22 files changed, 505 insertions(+), 469 deletions(-)
 create mode 100644 arch/arm64/kernel/pi/Makefile
 create mode 100644 arch/arm64/kernel/pi/kaslr_early.c

Comments

Will Deacon June 24, 2022, 5:13 p.m. UTC | #1 
On Fri, 24 Jun 2022 17:06:30 +0200, Ard Biesheuvel wrote:
> This series aims to streamline the boot flow with respect to cache
> maintenance and redundant copying of data in memory.
> 
> Additionally, this series removes the little dance we do to create a
> kernel mapping, relocate the kernel, run the KASLR init code, tear down
> the old mapping and create a new one, relocate the kernel again, and
> finally enter the kernel proper. Instead, it invokes a minimal C
> function 'kaslr_early_init()' while running from the ID map which
> includes a temporary mapping of the FDT. This change represents a
> substantial chunk of the diffstat, as it requires some work to
> instantiate code that can run safely from an arbitrary load address.
> 
> [...]

Applied to arm64 (for-next/boot), thanks!

[01/21] arm64: head: move kimage_vaddr variable into C file
        https://git.kernel.org/arm64/c/475031b6ed43
[02/21] arm64: mm: make vabits_actual a build time constant if possible
        https://git.kernel.org/arm64/c/0d9b1ffefabe
[03/21] arm64: head: move assignment of idmap_t0sz to C code
        https://git.kernel.org/arm64/c/e8d13cced5c5
[04/21] arm64: head: drop idmap_ptrs_per_pgd
        https://git.kernel.org/arm64/c/ebd9aea1f27e
[05/21] arm64: head: simplify page table mapping macros (slightly)
        https://git.kernel.org/arm64/c/53519ddf5894
[06/21] arm64: head: switch to map_memory macro for the extended ID map
        https://git.kernel.org/arm64/c/50fcd39d24c2
[07/21] arm64: head: split off idmap creation code
        https://git.kernel.org/arm64/c/e42ade29e3bc
[08/21] arm64: kernel: drop unnecessary PoC cache clean+invalidate
        https://git.kernel.org/arm64/c/2e945851e268
[09/21] arm64: head: pass ID map root table address to __enable_mmu()
        https://git.kernel.org/arm64/c/723d3a8ed172
[10/21] arm64: mm: provide idmap pointer to cpu_replace_ttbr1()
        https://git.kernel.org/arm64/c/1682c45b9206
[11/21] arm64: head: add helper function to remap regions in early page tables
        https://git.kernel.org/arm64/c/b013c1e1c659
[12/21] arm64: head: cover entire kernel image in initial ID map
        https://git.kernel.org/arm64/c/c3cee924bd85
[13/21] arm64: head: use relative references to the RELA and RELR tables
        https://git.kernel.org/arm64/c/d7bea550279d
[14/21] arm64: head: create a temporary FDT mapping in the initial ID map
        https://git.kernel.org/arm64/c/f70b3a23324a
[15/21] arm64: idreg-override: use early FDT mapping in ID map
        https://git.kernel.org/arm64/c/a004393f45d9
[16/21] arm64: head: factor out TTBR1 assignment into a macro
        https://git.kernel.org/arm64/c/c0be8f18a3bf
[17/21] arm64: head: populate kernel page tables with MMU and caches on
        https://git.kernel.org/arm64/c/6495b9ba6271
[18/21] arm64: head: record CPU boot mode after enabling the MMU
        https://git.kernel.org/arm64/c/005e12676af0
[19/21] arm64: kaslr: defer initialization to initcall where permitted
        https://git.kernel.org/arm64/c/fc5a89f75d2a
[20/21] arm64: head: avoid relocating the kernel twice for KASLR
        https://git.kernel.org/arm64/c/aacd149b6238
[21/21] arm64: setup: drop early FDT pointer helpers
        https://git.kernel.org/arm64/c/7559d9f97581

Cheers,