| Message ID | 20190730191303.206365-1-thgarnie@chromium.org (mailing list archive) |
|---|---|
| Headers | show |
| Series | x86: PIE support to extend KASLR randomization | expand |
On Tue, Jul 30, 2019 at 12:12:44PM -0700, Thomas Garnier wrote: > These patches make some of the changes necessary to build the kernel as > Position Independent Executable (PIE) on x86_64. Another patchset will > add the PIE option and larger architecture changes. Yeah, about this: do we have a longer writeup about the actual benefits of all this and why we should take this all? After all, after looking at the first couple of asm patches, it is posing restrictions to how we deal with virtual addresses in asm (only RIP-relative addressing in 64-bit mode, MOVs with 64-bit immediates, etc, for example) and I'm willing to bet money that some future unrelated change will break PIE sooner or later. And I'd like to have a better justification why we should enforce those new "rules" unconditionally. Thx.
On Tue, Aug 06, 2019 at 05:43:47PM +0200, Borislav Petkov wrote: > On Tue, Jul 30, 2019 at 12:12:44PM -0700, Thomas Garnier wrote: > > These patches make some of the changes necessary to build the kernel as > > Position Independent Executable (PIE) on x86_64. Another patchset will > > add the PIE option and larger architecture changes. > > Yeah, about this: do we have a longer writeup about the actual benefits > of all this and why we should take this all? After all, after looking > at the first couple of asm patches, it is posing restrictions to how > we deal with virtual addresses in asm (only RIP-relative addressing in > 64-bit mode, MOVs with 64-bit immediates, etc, for example) and I'm > willing to bet money that some future unrelated change will break PIE > sooner or later. Possibly objtool can help here; it should be possible to teach it about these rules, and then it will yell when violated. That should avoid regressions.
On Tue, Aug 6, 2019 at 8:51 AM Peter Zijlstra <peterz@infradead.org> wrote: > > On Tue, Aug 06, 2019 at 05:43:47PM +0200, Borislav Petkov wrote: > > On Tue, Jul 30, 2019 at 12:12:44PM -0700, Thomas Garnier wrote: > > > These patches make some of the changes necessary to build the kernel as > > > Position Independent Executable (PIE) on x86_64. Another patchset will > > > add the PIE option and larger architecture changes. > > > > Yeah, about this: do we have a longer writeup about the actual benefits > > of all this and why we should take this all? After all, after looking > > at the first couple of asm patches, it is posing restrictions to how > > we deal with virtual addresses in asm (only RIP-relative addressing in > > 64-bit mode, MOVs with 64-bit immediates, etc, for example) and I'm > > willing to bet money that some future unrelated change will break PIE > > sooner or later. The goal is being able to extend the range of addresses where the kernel can be placed with KASLR. I will look at clarifying that in the future. > > Possibly objtool can help here; it should be possible to teach it about > these rules, and then it will yell when violated. That should avoid > regressions. > I will look into that as well.
On Thu, Aug 29, 2019 at 12:55 PM Thomas Garnier <thgarnie@chromium.org> wrote: > > On Tue, Aug 6, 2019 at 8:51 AM Peter Zijlstra <peterz@infradead.org> wrote: > > > > On Tue, Aug 06, 2019 at 05:43:47PM +0200, Borislav Petkov wrote: > > > On Tue, Jul 30, 2019 at 12:12:44PM -0700, Thomas Garnier wrote: > > > > These patches make some of the changes necessary to build the kernel as > > > > Position Independent Executable (PIE) on x86_64. Another patchset will > > > > add the PIE option and larger architecture changes. > > > > > > Yeah, about this: do we have a longer writeup about the actual benefits > > > of all this and why we should take this all? After all, after looking > > > at the first couple of asm patches, it is posing restrictions to how > > > we deal with virtual addresses in asm (only RIP-relative addressing in > > > 64-bit mode, MOVs with 64-bit immediates, etc, for example) and I'm > > > willing to bet money that some future unrelated change will break PIE > > > sooner or later. > > The goal is being able to extend the range of addresses where the > kernel can be placed with KASLR. I will look at clarifying that in the > future. > > > > > Possibly objtool can help here; it should be possible to teach it about > > these rules, and then it will yell when violated. That should avoid > > regressions. > > > > I will look into that as well. Following a discussion with Kees. I will explore objtool in the follow-up patchset as we still have more elaborate pie changes in the second set. I like the idea overall and I think it would be great if it works.
Minor changes based on feedback and rebase from v8. Splitting the previous serie in two. This part contains assembly code changes required for PIE but without any direct dependencies with the rest of the patchset. Changes: - patch v9 (assembly): - Moved to relative reference for sync_core based on feedback. - x86/crypto had multiple algorithms deleted, removed PIE changes to them. - fix typo on comment end line. - patch v8 (assembly): - Fix issues in crypto changes (thanks to Eric Biggers). - Remove unnecessary jump table change. - Change author and signoff to chromium email address. - patch v7 (assembly): - Split patchset and reorder changes. - patch v6: - Rebase on latest changes in jump tables and crypto. - Fix wording on couple commits. - Revisit checkpatch warnings. - Moving to @chromium.org. - patch v5: - Adapt new crypto modules for PIE. - Improve per-cpu commit message. - Fix xen 32-bit build error with .quad. - Remove extra code for ftrace. - patch v4: - Simplify early boot by removing global variables. - Modify the mcount location script for __mcount_loc intead of the address read in the ftrace implementation. - Edit commit description to explain better where the kernel can be located. - Streamlined the testing done on each patch proposal. Always testing hibernation, suspend, ftrace and kprobe to ensure no regressions. - patch v3: - Update on message to describe longer term PIE goal. - Minor change on ftrace if condition. - Changed code using xchgq. - patch v2: - Adapt patch to work post KPTI and compiler changes - Redo all performance testing with latest configs and compilers - Simplify mov macro on PIE (MOVABS now) - Reduce GOT footprint - patch v1: - Simplify ftrace implementation. - Use gcc mstack-protector-guard-reg=%gs with PIE when possible. - rfc v3: - Use --emit-relocs instead of -pie to reduce dynamic relocation space on mapped memory. It also simplifies the relocation process. - Move the start the module section next to the kernel. Remove the need for -mcmodel=large on modules. Extends module space from 1 to 2G maximum. - Support for XEN PVH as 32-bit relocations can be ignored with --emit-relocs. - Support for GOT relocations previously done automatically with -pie. - Remove need for dynamic PLT in modules. - Support dymamic GOT for modules. - rfc v2: - Add support for global stack cookie while compiler default to fs without mcmodel=kernel - Change patch 7 to correctly jump out of the identity mapping on kexec load preserve. These patches make some of the changes necessary to build the kernel as Position Independent Executable (PIE) on x86_64. Another patchset will add the PIE option and larger architecture changes. The patches: - 1, 3-11: Change in assembly code to be PIE compliant. - 2: Add a new _ASM_MOVABS macro to fetch a symbol address generically. diffstat: crypto/aegis128-aesni-asm.S | 6 +- crypto/aesni-intel_asm.S | 8 +-- crypto/aesni-intel_avx-x86_64.S | 3 - crypto/camellia-aesni-avx-asm_64.S | 42 +++++++-------- crypto/camellia-aesni-avx2-asm_64.S | 44 ++++++++-------- crypto/camellia-x86_64-asm_64.S | 8 +-- crypto/cast5-avx-x86_64-asm_64.S | 50 ++++++++++-------- crypto/cast6-avx-x86_64-asm_64.S | 44 +++++++++------- crypto/des3_ede-asm_64.S | 96 ++++++++++++++++++++++++------------ crypto/ghash-clmulni-intel_asm.S | 4 - crypto/glue_helper-asm-avx.S | 4 - crypto/glue_helper-asm-avx2.S | 6 +- crypto/sha256-avx2-asm.S | 18 ++++-- entry/entry_64.S | 16 ++++-- include/asm/alternative.h | 6 +- include/asm/asm.h | 1 include/asm/paravirt_types.h | 25 +++++++-- include/asm/pm-trace.h | 2 include/asm/processor.h | 6 +- kernel/acpi/wakeup_64.S | 31 ++++++----- kernel/head_64.S | 16 +++--- kernel/relocate_kernel_64.S | 2 power/hibernate_asm_64.S | 4 - 23 files changed, 261 insertions(+), 181 deletions(-) Patchset is based on next-20190729.