From patchwork Fri Jun 24 15:06:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 12894759 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B05F4C43334 for ; Fri, 24 Jun 2022 15:16:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=R3x63SaHKCaSCpwNCqzjpBCHs3GKksCj0FBJytWLfhI=; b=FJOsxEicV2YRmb IHRnw0KNn0l6Ii6hpIPPsfIy80pxDBVhm4zAeIbeHOqfj60q5PAFew8znLT9LEANTDLrowuFcWa4R tTSoqZ1wSua4stVhWVoberzSRrtAHbiUgnUB8SdZMijLjKI+Cz61/w3KKikENCYAIur3RmDKGhN5j lY+bZaR7e9ACkluMezxJOnsjzfDvCTdc182yA3XUAgpXP4DVrWqMv4c6a1UnLTNut+mgrGOzPsmKk djybekbQT/ct3LqEKdsOQ7Y6BkNDHtIXP2LbchF1YWd3vfWIXfBaUfTbOP3IXz6c9N4mvh4Tzinx+ d/hohsp6f6hfOoHR9hXw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1o4l20-002mSF-UQ; Fri, 24 Jun 2022 15:15:37 +0000 Received: from ams.source.kernel.org ([2604:1380:4601:e00::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1o4kuZ-002iZ5-UT for linux-arm-kernel@lists.infradead.org; Fri, 24 Jun 2022 15:07:57 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A1049B826EE; Fri, 24 Jun 2022 15:07:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 862F8C385A9; Fri, 24 Jun 2022 15:07:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1656083273; bh=WxMd2U0vEe6WJJERzTfuNkhM0m3g5WG4XwgS4+lXDls=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jUkG4bAaraBNwuhm6LrHClD6MMoaCqmK+tGOuGFLUAajcvZ/X9CWdtZUmCdgchexG Mp+EX59/NWAT7qEZjsLCkh5A6bL2/wrqygfAj0JMTsFQzyEPQHL6p6UtfgEjxTidaP yNAfQnE40hC5DLHtcoWElynrI+8KwlP3FYPPyl95W4y751vf6AbwDQyrllHbwnsp89 2bXHVCsy5Q2FldbdJw0xNORzckknhOuTFIEuuZtS1QYbux2PauiMHLHuFdQKjP+lX3 t9f3dLXnXIQiQbQWBp6E1lt1MfBGOv2wY25vAV30ksuI6bpSoA2U1AX6fwDzg8IAxv +320bf+62+09Q== From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org Cc: Ard Biesheuvel , Marc Zyngier , Will Deacon , Mark Rutland , Kees Cook , Catalin Marinas , Mark Brown , Anshuman Khandual Subject: [PATCH v5 19/21] arm64: kaslr: defer initialization to initcall where permitted Date: Fri, 24 Jun 2022 17:06:49 +0200 Message-Id: <20220624150651.1358849-20-ardb@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220624150651.1358849-1-ardb@kernel.org> References: <20220624150651.1358849-1-ardb@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5546; h=from:subject; bh=WxMd2U0vEe6WJJERzTfuNkhM0m3g5WG4XwgS4+lXDls=; b=owEB7QES/pANAwAKAcNPIjmS2Y8kAcsmYgBitdMHzs0uEKk6T3vZzs4kDBCgJ/oR6NzhisKS1Cjx U1VSCryJAbMEAAEKAB0WIQT72WJ8QGnJQhU3VynDTyI5ktmPJAUCYrXTBwAKCRDDTyI5ktmPJOmEC/ kBMoArv60ibtd47Vwy/e69SmQJ8AcW7g5z/cP+suxNC2YvLH1Zu4dgbUWPZu5ORZjoNY5ANOVqUIkV 8uvKjh1/W7AFRai2rHWyQFOMrWHKCgit0E1ZMQpXQPrlng2pquqDY0TV829cj2JtZD73X+LGOmnIiJ 7HCoOyZmQr7JG0fuhCBQ1v4FAHTuhRVWbsdLrnLtx5n9+hgShFLsby51dlSFr8dNjEyCdNSjz3tIpY cJC9W0UrtJJww8alUTLjCIk4s5fzTUctwx84L3lMMYfiYCF8QrBnMuJR2Ol/pwgEtp4HFBRgyXlpAT V4DvWkTTsnzeoDPdW0n475sEuhHfDMQfd6r5DKYP/Kf8PjRKs1rsDMrftxj+JbbgycdlJhVJU1FQuU PF2x9G0qMr674pHMV1SSNexZhjAwYk51upZO4BwyzcdBZWDqnzcVCrN9iSXAqrPmVZA7cEkLhXGW3I LI0gZDTTv78kMKfIDZ8SHaA6K4pc2lwjglHfsy5i8LJc8= X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220624_080756_343526_03E622FA X-CRM114-Status: GOOD ( 23.48 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The early KASLR init code runs extremely early, and anything that could be deferred until later should be. So let's defer the randomization of the module region until much later - this also simplifies the arithmetic, given that we no longer have to reason about the link time vs load time placement of the core kernel explicitly. Also get rid of the global status variable, and infer the status reported by the diagnostic print from other KASLR related context. While at it, get rid of the special case for KASAN without KASAN_VMALLOC, which never occurs in practice. Signed-off-by: Ard Biesheuvel --- arch/arm64/kernel/kaslr.c | 95 +++++++++----------- 1 file changed, 40 insertions(+), 55 deletions(-) diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c index d5542666182f..3edee81d8ea7 100644 --- a/arch/arm64/kernel/kaslr.c +++ b/arch/arm64/kernel/kaslr.c @@ -20,14 +20,6 @@ #include #include -enum kaslr_status { - KASLR_ENABLED, - KASLR_DISABLED_CMDLINE, - KASLR_DISABLED_NO_SEED, - KASLR_DISABLED_FDT_REMAP, -}; - -static enum kaslr_status __initdata kaslr_status; u64 __ro_after_init module_alloc_base; u16 __initdata memstart_offset_seed; @@ -63,15 +55,9 @@ struct arm64_ftr_override kaslr_feature_override __initdata; u64 __init kaslr_early_init(void) { void *fdt; - u64 seed, offset, mask, module_range; + u64 seed, offset, mask; unsigned long raw; - /* - * Set a reasonable default for module_alloc_base in case - * we end up running with module randomization disabled. - */ - module_alloc_base = (u64)_etext - MODULES_VSIZE; - /* * Try to map the FDT early. If this fails, we simply bail, * and proceed with KASLR disabled. We will make another @@ -79,7 +65,6 @@ u64 __init kaslr_early_init(void) */ fdt = get_early_fdt_ptr(); if (!fdt) { - kaslr_status = KASLR_DISABLED_FDT_REMAP; return 0; } @@ -93,7 +78,6 @@ u64 __init kaslr_early_init(void) * return 0 if that is the case. */ if (kaslr_feature_override.val & kaslr_feature_override.mask & 0xf) { - kaslr_status = KASLR_DISABLED_CMDLINE; return 0; } @@ -106,7 +90,6 @@ u64 __init kaslr_early_init(void) seed ^= raw; if (!seed) { - kaslr_status = KASLR_DISABLED_NO_SEED; return 0; } @@ -126,19 +109,43 @@ u64 __init kaslr_early_init(void) /* use the top 16 bits to randomize the linear region */ memstart_offset_seed = seed >> 48; - if (!IS_ENABLED(CONFIG_KASAN_VMALLOC) && - (IS_ENABLED(CONFIG_KASAN_GENERIC) || - IS_ENABLED(CONFIG_KASAN_SW_TAGS))) - /* - * KASAN without KASAN_VMALLOC does not expect the module region - * to intersect the vmalloc region, since shadow memory is - * allocated for each module at load time, whereas the vmalloc - * region is shadowed by KASAN zero pages. So keep modules - * out of the vmalloc region if KASAN is enabled without - * KASAN_VMALLOC, and put the kernel well within 4 GB of the - * module region. - */ - return offset % SZ_2G; + return offset; +} + +static int __init kaslr_init(void) +{ + u64 module_range; + u32 seed; + + /* + * Set a reasonable default for module_alloc_base in case + * we end up running with module randomization disabled. + */ + module_alloc_base = (u64)_etext - MODULES_VSIZE; + + if (kaslr_feature_override.val & kaslr_feature_override.mask & 0xf) { + pr_info("KASLR disabled on command line\n"); + return 0; + } + + if (!kaslr_offset()) { + pr_warn("KASLR disabled due to lack of seed\n"); + return 0; + } + + pr_info("KASLR enabled\n"); + + /* + * KASAN without KASAN_VMALLOC does not expect the module region to + * intersect the vmalloc region, since shadow memory is allocated for + * each module at load time, whereas the vmalloc region will already be + * shadowed by KASAN zero pages. + */ + BUILD_BUG_ON((IS_ENABLED(CONFIG_KASAN_GENERIC) || + IS_ENABLED(CONFIG_KASAN_SW_TAGS)) && + !IS_ENABLED(CONFIG_KASAN_VMALLOC)); + + seed = get_random_u32(); if (IS_ENABLED(CONFIG_RANDOMIZE_MODULE_REGION_FULL)) { /* @@ -150,8 +157,7 @@ u64 __init kaslr_early_init(void) * resolved normally.) */ module_range = SZ_2G - (u64)(_end - _stext); - module_alloc_base = max((u64)_end + offset - SZ_2G, - (u64)MODULES_VADDR); + module_alloc_base = max((u64)_end - SZ_2G, (u64)MODULES_VADDR); } else { /* * Randomize the module region by setting module_alloc_base to @@ -163,33 +169,12 @@ u64 __init kaslr_early_init(void) * when ARM64_MODULE_PLTS is enabled. */ module_range = MODULES_VSIZE - (u64)(_etext - _stext); - module_alloc_base = (u64)_etext + offset - MODULES_VSIZE; } /* use the lower 21 bits to randomize the base of the module region */ module_alloc_base += (module_range * (seed & ((1 << 21) - 1))) >> 21; module_alloc_base &= PAGE_MASK; - return offset; -} - -static int __init kaslr_init(void) -{ - switch (kaslr_status) { - case KASLR_ENABLED: - pr_info("KASLR enabled\n"); - break; - case KASLR_DISABLED_CMDLINE: - pr_info("KASLR disabled on command line\n"); - break; - case KASLR_DISABLED_NO_SEED: - pr_warn("KASLR disabled due to lack of seed\n"); - break; - case KASLR_DISABLED_FDT_REMAP: - pr_warn("KASLR disabled due to FDT remapping failure\n"); - break; - } - return 0; } -core_initcall(kaslr_init) +subsys_initcall(kaslr_init)