From patchwork Mon Aug 14 12:53:59 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 9898833 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 06938602BA for ; Mon, 14 Aug 2017 12:58:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EF766285F2 for ; Mon, 14 Aug 2017 12:58:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E446128606; Mon, 14 Aug 2017 12:58:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 6B3BD285F2 for ; Mon, 14 Aug 2017 12:58:18 +0000 (UTC) Received: (qmail 26445 invoked by uid 550); 14 Aug 2017 12:55:45 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 25924 invoked from network); 14 Aug 2017 12:55:37 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=sOJNY1eYh5bDxGiJvi6hs9jLiu0I/1qCSyfPxJxe6SE=; b=Isb5uCpqdbjlAMTmd5ZLIj8OgNjk3sOURmY2473eaqnGItq/2YP+p5reKIxNxFzWy5 GNlauikOpeIkS9WORCGVLsPNRccH1OoLSCZ7ik13x2BK3bGHwnvUTjoICiTumsgpQB82 ddeYjWeoxRIXStNptJd8y0vZlHhQnALYvAb3c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=sOJNY1eYh5bDxGiJvi6hs9jLiu0I/1qCSyfPxJxe6SE=; b=uJDiZpJ1SCbRU0NkAJDbd7V7oGe/LdgPYTWA3e0JWBq3JLD8BXVxLDmWlVBviV8aMR iz2XjrI+6Jxzn1H7Kjd8QGWCi+j7b2J36CnSdfcK1rvpNepB+CE8jtU6W3vD0mOYPVP9 9Br7iI0bDEb2TqD9KyOtKypEfqXSbnyP82XUuNQss7Bk1pbwEVOGzXdZN2kPe0Rj2amp hKSc0m84kekrluKrP2TAR8KuXV4/b/6A9Xlowfm+s7u34BwSlObPoOXXSx6uF0Soz0QV l5T48hcgxXD4vaNKmqi7GiH84r8TttD5rJ6M5BifX8IaI4qbssN0H3XCwMWTh1qJvw4W 41DQ== X-Gm-Message-State: AHYfb5iBvfS0rmCVjiWEaCsp/BPfzfIV8wO6g5En1INq9UzG6QEUw0sO LjkGdLihoLdnC0lwJyFWag== X-Received: by 10.28.225.139 with SMTP id y133mr3741806wmg.41.1502715325455; Mon, 14 Aug 2017 05:55:25 -0700 (PDT) From: Ard Biesheuvel To: kernel-hardening@lists.openwall.com Cc: linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Arnd Bergmann , Nicolas Pitre , Russell King , Kees Cook , Thomas Garnier , Marc Zyngier , Mark Rutland , Tony Lindgren , Matt Fleming , Dave Martin Date: Mon, 14 Aug 2017 13:53:59 +0100 Message-Id: <20170814125411.22604-19-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170814125411.22604-1-ard.biesheuvel@linaro.org> References: <20170814125411.22604-1-ard.biesheuvel@linaro.org> Subject: [kernel-hardening] [PATCH 18/30] ARM: kernel: make vmlinux buildable as a PIE executable X-Virus-Scanned: ClamAV using ClamSMTP Update the build flags and linker script to allow vmlinux to be build as a PIE binary, which retains relocation information about absolute symbol references so that they can be fixed up at runtime. This will be used for implementing KASLR, Cc: Russell King Signed-off-by: Ard Biesheuvel --- arch/arm/Kconfig | 4 ++++ arch/arm/Makefile | 5 +++++ arch/arm/include/asm/assembler.h | 7 ++++++- arch/arm/kernel/vmlinux.lds.S | 9 +++++++++ include/linux/hidden.h | 21 ++++++++++++++++++++ 5 files changed, 45 insertions(+), 1 deletion(-) diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index 61a0cb15067e..300add3b8023 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -2085,6 +2085,10 @@ config DMI firmware need to be enabled. This would require the DMI subsystem to be enabled much earlier than we do on ARM, which is non-trivial. +config RELOCATABLE + bool + select HAVE_ARCH_PREL32_RELOCATIONS + endmenu menu "CPU Power Management" diff --git a/arch/arm/Makefile b/arch/arm/Makefile index 47d3a1ab08d2..88d9c33e24f5 100644 --- a/arch/arm/Makefile +++ b/arch/arm/Makefile @@ -52,6 +52,11 @@ AS += -EL LD += -EL endif +ifeq ($(CONFIG_RELOCATABLE),y) +KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h -fpic +LDFLAGS_vmlinux += -pie -shared -Bsymbolic +endif + # # The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and # later may result in code being generated that handles signed short and signed diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h index 09b6b28f2595..b2254c1dc2de 100644 --- a/arch/arm/include/asm/assembler.h +++ b/arch/arm/include/asm/assembler.h @@ -550,7 +550,12 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) * mov_l - move a constant value or [relocated] address into a register */ .macro mov_l, dst:req, imm:req, cond - .if __LINUX_ARM_ARCH__ < 7 + .if CONFIG_RELOCATABLE == 1 + ldr_l \dst, 333f, \cond + .section ".data.rel.ro.local", "aw", %progbits +333: .long \imm + .previous + .elseif __LINUX_ARM_ARCH__ < 7 ldr\cond \dst, =\imm .else W(movw\cond\()) \dst, #:lower16:\imm diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S index c83a7ba737d6..5853d4be2067 100644 --- a/arch/arm/kernel/vmlinux.lds.S +++ b/arch/arm/kernel/vmlinux.lds.S @@ -89,6 +89,9 @@ SECTIONS #endif *(.discard) *(.discard.*) + *(.ARM.exidx.discard.text) + *(.interp .dynamic) + *(.dynsym .dynstr .hash) } . = PAGE_OFFSET + TEXT_OFFSET; @@ -209,6 +212,12 @@ SECTIONS __smpalt_end = .; } #endif + .rel.dyn : ALIGN(8) { + __rel_begin = .; + *(.rel .rel.* .rel.dyn) + } + __rel_end = ADDR(.rel.dyn) + SIZEOF(.rel.dyn); + .init.pv_table : { __pv_table_begin = .; *(.pv_table) diff --git a/include/linux/hidden.h b/include/linux/hidden.h new file mode 100644 index 000000000000..49b7823eed6e --- /dev/null +++ b/include/linux/hidden.h @@ -0,0 +1,21 @@ + +/* + * GCC assumes that we are building shared libraries or hosted binaries + * when the -fpic or -fpie switches are used. This results in all references + * to symbols with external linkage to be redirected via entries in the global + * offset table (GOT), which keeps .text pages clean and reduces the footprint + * of CoWed dirty pages to the GOT itself. It also allows symbol preemption, + * which is mandatory under ELF rules for shared libraries. + * + * For the kernel, we use PIC so that we can relocate the executable image at + * runtime. This does not involve CoW or symbol preemption, and we'd rather + * have relative references instead of absolute ones whenever possible. + * So set the default visibility to hidden: this informs the compiler that + * none of our symbols will ever be exported from a shared library, allowing + * it to use relative references where possible. + * + * Note that simply passing -fvisibility=hidden is not sufficient to achieve + * this: In that case, definitions will be marked hidden, but declarations + * will not, and we still end up with GOT entries unnecessarily. + */ +#pragma GCC visibility push(hidden)