From patchwork Sun Sep 3 12:07:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 9936149 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5D7636037D for ; Sun, 3 Sep 2017 12:11:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4F5DF286A9 for ; Sun, 3 Sep 2017 12:11:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 440C5286B3; Sun, 3 Sep 2017 12:11:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 400F3286A9 for ; Sun, 3 Sep 2017 12:11:40 +0000 (UTC) Received: (qmail 15936 invoked by uid 550); 3 Sep 2017 12:09:24 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 15819 invoked from network); 3 Sep 2017 12:09:22 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Hqn+0bHw8nmLyvvolzNRRNcjYA3kR2Yv0OagMNXwE/g=; b=bokN+GMyPBnF0cZGqZzxWaco9fCPGb0W75cG2x9ii3sAyCTFHfvqaUr4P7AFY6s1uG k73NSCQtNLGx/PjzHaTGmjz/1G2m4zNHQfSkFHz/CXgJ8DS1zsSKepZfIf9g5BZUNsmq oDeWlsyc8fLQg6lsPKb2L4Jc7mrOQiaE3bHVI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Hqn+0bHw8nmLyvvolzNRRNcjYA3kR2Yv0OagMNXwE/g=; b=J0eoC8B46qIHqZioGDyzCnuwy5cGuuw1MIAmq9ZHjFO0SU22BsJbUCWMHY5RUef7oh PbjbN/5SDi9jQ/vrD+9LpRbnPOIPKmTsbOuGCxXJgoDtoMarTVu5mczKDpKB2iZPlVTx xAId2V+AKXC+dccn5lcRW7N0GPly1NKJMtGg36YC3MUM+SGHAmXruvrchvm9aRcWGRRS 31MOeVioHZWz/XX2RbTS1AJ8SW29N0HsfDt+9+XYvjan9RPfoQebUepdpSH65p+zyJVf I4lnJlsV5wEwaXiHHtxgcfKcziGqrE4Vc0qRkGscn3KLu+zzbB75TmoV+DxaRILG9gjy 7NjQ== X-Gm-Message-State: AHPjjUi632f9m44MoJDBFcXFUAxqXS+eNP2skd6iNqYtm9xKe6GoKOV+ 0KLRm64Q54KBtADM X-Google-Smtp-Source: ADKCNb7dOX7fGbcAyOpzUIMihufZlgoXnfT+D4oV4q+9QMX5SgAlqdxRodxtf2oJNygebRDp92uOqQ== X-Received: by 10.28.196.77 with SMTP id u74mr1621268wmf.99.1504440551257; Sun, 03 Sep 2017 05:09:11 -0700 (PDT) From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org, kernel-hardening@lists.openwall.com Cc: Ard Biesheuvel , Arnd Bergmann , Nicolas Pitre , Russell King , Kees Cook , Thomas Garnier , Marc Zyngier , Mark Rutland , Tony Lindgren , Matt Fleming , Dave Martin Date: Sun, 3 Sep 2017 13:07:45 +0100 Message-Id: <20170903120757.14968-18-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170903120757.14968-1-ard.biesheuvel@linaro.org> References: <20170903120757.14968-1-ard.biesheuvel@linaro.org> Subject: [kernel-hardening] [PATCH v2 17/29] ARM: kernel: use relative phys-to-virt patch tables X-Virus-Scanned: ClamAV using ClamSMTP Replace the contents of the __pv_table entries with relative references so that we don't have to relocate them at runtime when running the KASLR kernel. This ensures these quantities are invariant under runtime relocation, which makes any cache maintenance after runtime relocation unnecessary. Cc: Russell King Signed-off-by: Ard Biesheuvel Reviewed-by: Nicolas Pitre --- arch/arm/include/asm/memory.h | 6 +++--- arch/arm/kernel/head.S | 21 ++++++++++---------- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h index 1f54e4e98c1e..47a984e3a244 100644 --- a/arch/arm/include/asm/memory.h +++ b/arch/arm/include/asm/memory.h @@ -195,7 +195,7 @@ extern const void *__pv_table_begin, *__pv_table_end; __asm__("@ __pv_stub\n" \ "1: " instr " %0, %1, %2\n" \ " .pushsection .pv_table,\"a\"\n" \ - " .long 1b\n" \ + " .long 1b - .\n" \ " .popsection\n" \ : "=r" (to) \ : "r" (from), "I" (type)) @@ -204,7 +204,7 @@ extern const void *__pv_table_begin, *__pv_table_end; __asm__ volatile("@ __pv_stub_mov\n" \ "1: mov %R0, %1\n" \ " .pushsection .pv_table,\"a\"\n" \ - " .long 1b\n" \ + " .long 1b - .\n" \ " .popsection\n" \ : "=r" (t) \ : "I" (__PV_BITS_7_0)) @@ -214,7 +214,7 @@ extern const void *__pv_table_begin, *__pv_table_end; "1: adds %Q0, %1, %2\n" \ " adc %R0, %R0, #0\n" \ " .pushsection .pv_table,\"a\"\n" \ - " .long 1b\n" \ + " .long 1b - .\n" \ " .popsection\n" \ : "+r" (y) \ : "r" (x), "I" (__PV_BITS_31_24) \ diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S index 62c961849035..5d685e86148c 100644 --- a/arch/arm/kernel/head.S +++ b/arch/arm/kernel/head.S @@ -593,8 +593,7 @@ ENDPROC(__fixup_pv_table) .text __fixup_a_pv_table: - mov_l r6, __pv_offset - add r6, r6, r3 + adr_l r6, __pv_offset ldr r0, [r6, #HIGH_OFFSET] @ pv_offset high word ldr r6, [r6, #LOW_OFFSET] @ pv_offset low word mov r6, r6, lsr #24 @@ -612,22 +611,22 @@ __fixup_a_pv_table: orr r6, r6, r7, lsl #12 orr r6, #0x4000 b 2f -1: add r7, r3 - ldrh ip, [r7, #2] +1: add r7, r4 + ldrh ip, [r7, #-2] ARM_BE8(rev16 ip, ip) tst ip, #0x4000 and ip, #0x8f00 orrne ip, r6 @ mask in offset bits 31-24 orreq ip, r0 @ mask in offset bits 7-0 ARM_BE8(rev16 ip, ip) - strh ip, [r7, #2] + strh ip, [r7, #-2] bne 2f - ldrh ip, [r7] + ldrh ip, [r7, #-4] ARM_BE8(rev16 ip, ip) bic ip, #0x20 orr ip, ip, r0, lsr #16 ARM_BE8(rev16 ip, ip) - strh ip, [r7] + strh ip, [r7, #-4] 2: cmp r4, r5 ldrcc r7, [r4], #4 @ use branch for delay slot bcc 1b @@ -639,7 +638,8 @@ ARM_BE8(rev16 ip, ip) moveq r0, #0x400000 @ set bit 22, mov to mvn instruction #endif b 2f -1: ldr ip, [r7, r3] +1: ldr ip, [r7, r4]! + add r4, r4, #4 #ifdef CONFIG_CPU_ENDIAN_BE8 @ in BE8, we load data in BE, but instructions still in LE bic ip, ip, #0xff000000 @@ -654,9 +654,9 @@ ARM_BE8(rev16 ip, ip) biceq ip, ip, #0x400000 @ clear bit 22 orreq ip, ip, r0 @ mask in offset bits 7-0 #endif - str ip, [r7, r3] + str ip, [r7] 2: cmp r4, r5 - ldrcc r7, [r4], #4 @ use branch for delay slot + ldrcc r7, [r4] @ use branch for delay slot bcc 1b ret lr #endif @@ -664,7 +664,6 @@ ENDPROC(__fixup_a_pv_table) ENTRY(fixup_pv_table) stmfd sp!, {r4 - r7, lr} - mov r3, #0 @ no offset mov r4, r0 @ r0 = table start add r5, r0, r1 @ r1 = table size bl __fixup_a_pv_table