From patchwork Wed Oct 4 21:19:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 9985559 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CF213605A8 for ; Wed, 4 Oct 2017 21:23:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C001028C2C for ; Wed, 4 Oct 2017 21:23:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B3D6628C2F; Wed, 4 Oct 2017 21:23:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id A42F428C2C for ; Wed, 4 Oct 2017 21:23:30 +0000 (UTC) Received: (qmail 15726 invoked by uid 550); 4 Oct 2017 21:21:20 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 15584 invoked from network); 4 Oct 2017 21:21:15 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=FZn2BTTeAA7a+eAtuF7mg0mBm8diQ6NMr/yKYolawbw=; b=PcBoWG/Kt1iUfj8SRhQPJ1t4CJJnAtOWFvHJYcNjI5OjPHqdWtFCFZcf3FPHn6x7QY 7DzLSa94ugLwaIv3lFX4bSGdfDMT7bAPzZ1Q0zyjyE+FXhTVvJkUCEHcHEDT6s2XTOHZ xZGo1wvfTL9uX9k9k9bT8handeNraitxDrEi9+yVQsMhhhsA4O7WPIlzadOeHGBiTejY ntyjMx8LOwEjV14z33ompITrP8jSZdvRFZZzSmv+6TZOGOWGyKpEzyDBv9jAj2njPxQy a3KZJd2hfPr4/i8bjgQLQyZ6T45+yoCaaMGieCB455zCfgalwJgHUTBr0K7boKjgZFaG f36g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=FZn2BTTeAA7a+eAtuF7mg0mBm8diQ6NMr/yKYolawbw=; b=W/KSX7m7JU11jYMvlQLV8T3RyOH4j1Mzki2DLvnImCqEoDPMcBhb+VHGGx/oG+pCJh 6/eeooaBk4AimXB5sn5QpW84AavAEnDRET2yL2Us3EOI45rrri63p+NFweAKtCBdpi/d 2pmELxp2WYpda9Q63CTqriY9WAWA4WCgsKkQzw4k36cSZvxJlqeH2fCnhv5BhiPty2VQ VxvEr+Q8PDvixawsK94kegmQ74UZyB0IFhYNK9O5mwbPSBvbzn7QtuL+k7hSa5FlFpBg SfV+swNFtgz+/32t8vc8jEqekhIMUbF91BR5/M1iRO9wG8V8EcZFMF5NfKzfFJ3UyBsy 1JHg== X-Gm-Message-State: AHPjjUgD3OZ2punnTHrazu3st+eNk7ADgwbwpZa5KpBbdQa5QT4p1EWG KveowJZVzaBkgfuBWkieUFiXJg== X-Google-Smtp-Source: AOwi7QD0CJPXEo9jc3CuWd8aOkjiVIgOLGVJx6ZJ8OO06ZYBhHG0SaAuQIeoS1nNkHiEfyX7ulDkeg== X-Received: by 10.84.240.196 with SMTP id l4mr20874504plt.399.1507152063367; Wed, 04 Oct 2017 14:21:03 -0700 (PDT) From: Thomas Garnier To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Boris Ostrovsky , Alexey Dobriyan , Andrew Morton , Paul Gortmaker , Chris Metcalf , "Paul E . McKenney" , Nicolas Pitre , Borislav Petkov , "Luis R . Rodriguez" , Greg Kroah-Hartman , Christopher Li , Steven Rostedt , Jason Baron , Dou Liyang , "Rafael J . Wysocki" , Mika Westerberg , Lukas Wunner , Masahiro Yamada , Alexei Starovoitov , Daniel Borkmann , Markus Trippelsdorf , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Rik van Riel , David Howells , Ard Biesheuvel , Waiman Long , Kyle Huey , Andrey Ryabinin , Jonathan Corbet , Matthew Wilcox , Michal Hocko , Peter Foley , Paul Bolle , Jiri Kosina , Rob Landley , "H . J . Lu" , Baoquan He , =?UTF-8?q?Jan=20H=20=2E=20Sch=C3=B6nherr?= , Daniel Micay Cc: x86@kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, virtualization@lists.linux-foundation.org, xen-devel@lists.xenproject.org, linux-arch@vger.kernel.org, linux-sparse@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com Date: Wed, 4 Oct 2017 14:19:46 -0700 Message-Id: <20171004212003.28296-11-thgarnie@google.com> X-Mailer: git-send-email 2.14.2.920.gcf0c67979c-goog In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Subject: [kernel-hardening] [RFC v3 10/27] x86/boot/64: Adapt assembly for PIE support X-Virus-Scanned: ClamAV using ClamSMTP Change the assembly code to use only relative references of symbols for the kernel to be PIE compatible. Early at boot, the kernel is mapped at a temporary address while preparing the page table. To know the changes needed for the page table with KASLR, the boot code calculate the difference between the expected address of the kernel and the one chosen by KASLR. It does not work with PIE because all symbols in code are relatives. Instead of getting the future relocated virtual address, you will get the current temporary mapping. The solution is using global variables that will be relocated as expected. Position Independent Executable (PIE) support will allow to extended the KASLR randomization range below the -2G memory limit. Signed-off-by: Thomas Garnier --- arch/x86/kernel/head_64.S | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S index 42e32c2e51bb..32d1899f48df 100644 --- a/arch/x86/kernel/head_64.S +++ b/arch/x86/kernel/head_64.S @@ -86,8 +86,21 @@ startup_64: popq %rsi /* Form the CR3 value being sure to include the CR3 modifier */ - addq $(early_top_pgt - __START_KERNEL_map), %rax + addq _early_top_pgt_offset(%rip), %rax jmp 1f + + /* + * Position Independent Code takes only relative references in code + * meaning a global variable address is relative to RIP and not its + * future virtual address. Global variables can be used instead as they + * are still relocated on the expected kernel mapping address. + */ + .align 8 +_early_top_pgt_offset: + .quad early_top_pgt - __START_KERNEL_map +_init_top_offset: + .quad init_top_pgt - __START_KERNEL_map + ENTRY(secondary_startup_64) UNWIND_HINT_EMPTY /* @@ -116,7 +129,7 @@ ENTRY(secondary_startup_64) popq %rsi /* Form the CR3 value being sure to include the CR3 modifier */ - addq $(init_top_pgt - __START_KERNEL_map), %rax + addq _init_top_offset(%rip), %rax 1: /* Enable PAE mode, PGE and LA57 */ @@ -131,7 +144,7 @@ ENTRY(secondary_startup_64) movq %rax, %cr3 /* Ensure I am executing from virtual addresses */ - movq $1f, %rax + movabs $1f, %rax jmp *%rax 1: UNWIND_HINT_EMPTY @@ -230,11 +243,12 @@ ENTRY(secondary_startup_64) * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect, * address given in m16:64. */ - pushq $.Lafter_lret # put return address on stack for unwinder + leaq .Lafter_lret(%rip), %rax + pushq %rax # put return address on stack for unwinder xorq %rbp, %rbp # clear frame pointer - movq initial_code(%rip), %rax + leaq initial_code(%rip), %rax pushq $__KERNEL_CS # set correct cs - pushq %rax # target address in negative space + pushq (%rax) # target address in negative space lretq .Lafter_lret: END(secondary_startup_64)