From patchwork Tue Jul 18 22:33:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 9850041 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8D9D760392 for ; Tue, 18 Jul 2017 22:36:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 79018285B7 for ; Tue, 18 Jul 2017 22:36:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6CDA3285CD; Tue, 18 Jul 2017 22:36:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 65FCA285B7 for ; Tue, 18 Jul 2017 22:36:30 +0000 (UTC) Received: (qmail 27856 invoked by uid 550); 18 Jul 2017 22:34:42 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 27651 invoked from network); 18 Jul 2017 22:34:40 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=0IOrZ5vmTnoQQnJwdlMPnvoRTi0l7sF4vc118JWoh8U=; b=UJ23AlBrp9ARBxTtccm0l+c6O6GZc6LdFjWWWxNalrWtI0qzp9mZ5wphJTkIrbRbqp T3C+rSapApff9g712xXAkZK22caNSTVzieN9ZZcIQpffPpNXHQNR/4DDI+riVJZ1XBS6 vG/NW0G+485lV88tiKoUhNxdEv7tunWdla9dMyqqVeENX4I91GNdetT1gfdh5hWpNSmA iVzDemz+kDdkCnjkwEl57BaSUNtt0mHEkWZ84yzDXoFnI86H+jR8+10mN1fwobQBSREj LP3pnQgcUrRnD4sc+/9trGFnGVinC2BegNGvoIALh7uL5nST9z6nEqpWHkGwAvtBOzMA 04pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=0IOrZ5vmTnoQQnJwdlMPnvoRTi0l7sF4vc118JWoh8U=; b=kowF3qt1AcK9/v0nK0mSXMWka1csCsEWGHAzVDwbuGlfuooif3xYFmR/VcIpaTS3mR 9hh/n0hFRR8lDKYWbFy4t4SeRiyl/0t8g3TkKgiZ087+LA1D/jPNseJlh3sUMch9Kudf 4Zti0vxu/wR5xzY9eNW+knFzuhQHJxQDVocWEQ8r43BLVhztT+lnNNF4M2SBM05FiZ+t K4WoIDpfrcXAv1Po928MQp1O797wi5jFeBVmNuC4DOAgtJttd5N1sfYtF9elGLOhZR0w 4M9fB5sQhrpsIKBg9UaNPk03fFoXM5IYc4tBRG0IZcfOZ5EqLtC5iVVC9hQ66zDxKKUD bmvw== X-Gm-Message-State: AIVw1125Tol6aOqzNnGD1//H/EZ5+24pvwxTBH58M0FamGS4IOUKTt0w /uhH1LrE5/kgZb3V X-Received: by 10.98.210.70 with SMTP id c67mr1039313pfg.6.1500417268434; Tue, 18 Jul 2017 15:34:28 -0700 (PDT) From: Thomas Garnier To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Matthias Kaehlcke , Boris Ostrovsky , Juergen Gross , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Andy Lutomirski , Borislav Petkov , "Kirill A . Shutemov" , Brian Gerst , Borislav Petkov , Christian Borntraeger , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Tejun Heo , Christoph Lameter , Kees Cook , Paul Gortmaker , Chris Metcalf , "Paul E . McKenney" , Andrew Morton , Christopher Li , Dou Liyang , Masahiro Yamada , Daniel Borkmann , Markus Trippelsdorf , Peter Foley , Steven Rostedt , Tim Chen , Ard Biesheuvel , Catalin Marinas , Matthew Wilcox , Michal Hocko , Rob Landley , Jiri Kosina , "H . J . Lu" , Paul Bolle , Baoquan He , Daniel Micay Cc: x86@kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, xen-devel@lists.xenproject.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, linux-arch@vger.kernel.org, linux-sparse@vger.kernel.org, kernel-hardening@lists.openwall.com Date: Tue, 18 Jul 2017 15:33:23 -0700 Message-Id: <20170718223333.110371-13-thgarnie@google.com> X-Mailer: git-send-email 2.13.2.932.g7449e964c-goog In-Reply-To: <20170718223333.110371-1-thgarnie@google.com> References: <20170718223333.110371-1-thgarnie@google.com> Subject: [kernel-hardening] [RFC 12/22] x86/boot/64: Adapt assembly for PIE support X-Virus-Scanned: ClamAV using ClamSMTP Change the assembly code to use only relative references of symbols for the kernel to be PIE compatible. Early at boot, the kernel is mapped at a temporary address while preparing the page table. To know the changes needed for the page table with KASLR, the boot code calculate the difference between the expected address of the kernel and the one chosen by KASLR. It does not work with PIE because all symbols in code are relatives. Instead of getting the future relocated virtual address, you will get the current temporary mapping. The solution is using global variables that will be relocated as expected. Position Independent Executable (PIE) support will allow to extended the KASLR randomization range below the -2G memory limit. Signed-off-by: Thomas Garnier --- arch/x86/kernel/head_64.S | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S index 6225550883df..7e4f7a83a15a 100644 --- a/arch/x86/kernel/head_64.S +++ b/arch/x86/kernel/head_64.S @@ -78,8 +78,23 @@ startup_64: call __startup_64 popq %rsi - movq $(early_top_pgt - __START_KERNEL_map), %rax + movq _early_top_pgt_offset(%rip), %rax jmp 1f + + /* + * Position Independent Code takes only relative references in code + * meaning a global variable address is relative to RIP and not its + * future virtual address. Global variables can be used instead as they + * are still relocated on the expected kernel mapping address. + */ + .align 8 +_early_top_pgt_offset: + .quad early_top_pgt - __START_KERNEL_map +_init_top_offset: + .quad init_top_pgt - __START_KERNEL_map +_va_jump: + .quad 2f + ENTRY(secondary_startup_64) /* * At this point the CPU runs in 64bit mode CS.L = 1 CS.D = 0, @@ -98,7 +113,8 @@ ENTRY(secondary_startup_64) /* Sanitize CPU configuration */ call verify_cpu - movq $(init_top_pgt - __START_KERNEL_map), %rax + movq _init_top_offset(%rip), %rax + 1: /* Enable PAE mode, PGE and LA57 */ @@ -113,9 +129,8 @@ ENTRY(secondary_startup_64) movq %rax, %cr3 /* Ensure I am executing from virtual addresses */ - movq $1f, %rax - jmp *%rax -1: + jmp *_va_jump(%rip) +2: /* Check if nx is implemented */ movl $0x80000001, %eax @@ -211,11 +226,12 @@ ENTRY(secondary_startup_64) * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect, * address given in m16:64. */ - pushq $.Lafter_lret # put return address on stack for unwinder + leaq .Lafter_lret(%rip), %rax + pushq %rax # put return address on stack for unwinder xorq %rbp, %rbp # clear frame pointer - movq initial_code(%rip), %rax + leaq initial_code(%rip), %rax pushq $__KERNEL_CS # set correct cs - pushq %rax # target address in negative space + pushq (%rax) # target address in negative space lretq .Lafter_lret: ENDPROC(secondary_startup_64)