From patchwork Mon Jun 25 22:38:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 10488265 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E49FF602B3 for ; Tue, 26 Jun 2018 08:41:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C0B0128A51 for ; Tue, 26 Jun 2018 08:41:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4EA2E2893E; Tue, 26 Jun 2018 08:41:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 27EB028A32 for ; Tue, 26 Jun 2018 08:40:41 +0000 (UTC) Received: (qmail 24188 invoked by uid 550); 26 Jun 2018 08:38:58 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Delivered-To: moderator for kernel-hardening@lists.openwall.com Received: (qmail 10124 invoked from network); 25 Jun 2018 22:41:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:in-reply-to:message-id:references:subject:from:to :cc; bh=O8CLfxcg9OKod1ivZbkoSyCm0ci4+lg3Z3Y3PZu7UvE=; b=JTPUZE/GxynGfFI/4iONF3uw/WeFYQQ6M8VlMNpH0ZU14R2j6KAhlDygiRO8VAM6mA ZdcZeH12M1U29XH1GW8SRT0wgsbQRIbdMDswzReTGwaA0leh5WI03ZFGy0y7Dl49vAU5 Sug/SHF5odExmWhLk9f4hadKAg3Tgyk5CprBUgh74KSIeH94nJmc/MD1uB60tFkq+POa h1k9A2kw3lVjvWiwSu4MGNl5eJm2gngU04RttYcXYlRJQMv8KMkK3JIQTn6sLq0AlEhe 91aP9Do3SAyXhpoRrxYL+ajHGHFbE/Ya+FyYKgV5DQClYCY9iiK4KNd0qjCCaCtUx4zd jcZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:in-reply-to:message-id :references:subject:from:to:cc; bh=O8CLfxcg9OKod1ivZbkoSyCm0ci4+lg3Z3Y3PZu7UvE=; b=A0SXMJPRlw6++1CYJ2rl5R0X69kdjdbKg+OP6dKAwnbU3sl8dbj16DicRJs9ukcik1 9kqxA9Yu2WHAlAUtw3vk/+4tS0ZEDznMDmDhkSlN+TNa3b9FslS066ceYn1mrOfewhjF uxM6rhPzrNZYhsQ5EcfUus0nsZK6zc+orajK08T7aFPVLIvucJa2yV0GfkWCgMN4x7XM gEQqt+fhsWq7ilQE/M9BdPZw417bTK1VdEO1dEQCI/3Vb0127UgzJeclw/6LVCTppzmw S15UnjcHVTi3Z6JSiyTlMyUmjN8UyA1TT5HsvKUNCDswy++aCh7fGTBTpM4Lsw7PGvjy NRyQ== X-Gm-Message-State: APt69E24YvrEXh6IGo+wCRh29mJPRMEd2NShB0mUa+mCgzC4+Cfl2gy2 dSJ185p7YyD6bdWdwoxMbNZRx1VKetvnnPmlbIkK0fOz2D/ZaxRPSav7TQIBmRhUn656EngOE9o nEY/E7dFZm5bii83ERx8e2y9zUQ/W1/sWMSpzRXwa0a8v7+m0FIWhxRg2fdbCskwNOLGWm7s1ze XT/gFIAKMI X-Google-Smtp-Source: ADUXVKIZhgOfpWOU7eftUZZ/WQuPZZDkCs20b0atPoQ+qjy3MlJIB7NY/ZTFjvwbwXinU8dvuEvN7+PTWr1jsQ== MIME-Version: 1.0 X-Received: by 2002:a25:ba8c:: with SMTP id s12-v6mr4018875ybg.6.1529966472111; Mon, 25 Jun 2018 15:41:12 -0700 (PDT) Date: Mon, 25 Jun 2018 15:38:54 -0700 In-Reply-To: <20180625224014.134829-1-thgarnie@google.com> Message-Id: <20180625224014.134829-7-thgarnie@google.com> References: <20180625224014.134829-1-thgarnie@google.com> X-Mailer: git-send-email 2.18.0.rc2.346.g013aa6912e-goog Subject: [PATCH v5 06/27] x86/entry/64: Adapt assembly for PIE support From: Thomas Garnier To: kernel-hardening@lists.openwall.com Cc: Thomas Garnier , Andy Lutomirski , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, "Kirill A. Shutemov" , Tom Lendacky , linux-kernel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Change the assembly code to use only relative references of symbols for the kernel to be PIE compatible. Position Independent Executable (PIE) support will allow to extend the KASLR randomization range 0xffffffff80000000. Signed-off-by: Thomas Garnier --- arch/x86/entry/entry_64.S | 18 ++++++++++++------ arch/x86/kernel/relocate_kernel_64.S | 8 +++----- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index c6f3677e6105..e738d8d0e308 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -191,7 +191,7 @@ ENTRY(entry_SYSCALL_64_trampoline) * spill RDI and restore it in a second-stage trampoline. */ pushq %rdi - movq $entry_SYSCALL_64_stage2, %rdi + movabsq $entry_SYSCALL_64_stage2, %rdi JMP_NOSPEC %rdi END(entry_SYSCALL_64_trampoline) @@ -1277,7 +1277,8 @@ ENTRY(error_entry) movl %ecx, %eax /* zero extend */ cmpq %rax, RIP+8(%rsp) je .Lbstep_iret - cmpq $.Lgs_change, RIP+8(%rsp) + leaq .Lgs_change(%rip), %rcx + cmpq %rcx, RIP+8(%rsp) jne .Lerror_entry_done /* @@ -1482,10 +1483,10 @@ ENTRY(nmi) * resume the outer NMI. */ - movq $repeat_nmi, %rdx + leaq repeat_nmi(%rip), %rdx cmpq 8(%rsp), %rdx ja 1f - movq $end_repeat_nmi, %rdx + leaq end_repeat_nmi(%rip), %rdx cmpq 8(%rsp), %rdx ja nested_nmi_out 1: @@ -1539,7 +1540,8 @@ nested_nmi: pushq %rdx pushfq pushq $__KERNEL_CS - pushq $repeat_nmi + leaq repeat_nmi(%rip), %rdx + pushq %rdx /* Put stack back */ addq $(6*8), %rsp @@ -1578,7 +1580,11 @@ first_nmi: addq $8, (%rsp) /* Fix up RSP */ pushfq /* RFLAGS */ pushq $__KERNEL_CS /* CS */ - pushq $1f /* RIP */ + pushq $0 /* Futur return address */ + pushq %rax /* Save RAX */ + leaq 1f(%rip), %rax /* RIP */ + movq %rax, 8(%rsp) /* Put 1f on return address */ + popq %rax /* Restore RAX */ iretq /* continues at repeat_nmi below */ UNWIND_HINT_IRET_REGS 1: diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S index a7227dfe1a2b..0c0fc259a4e2 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -208,11 +208,9 @@ identity_mapped: movq %rax, %cr3 lea PAGE_SIZE(%r8), %rsp call swap_pages - jmp *virtual_mapped_addr(%rip) - - /* Absolute value for PIE support */ -virtual_mapped_addr: - .quad virtual_mapped + movabsq $virtual_mapped, %rax + pushq %rax + ret virtual_mapped: movq RSP(%r8), %rsp