From patchwork Wed May 23 19:54:00 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 10422263 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B53346032A for ; Wed, 23 May 2018 19:57:24 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A3465291D5 for ; Wed, 23 May 2018 19:57:24 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 96A26291D8; Wed, 23 May 2018 19:57:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 83208291D5 for ; Wed, 23 May 2018 19:57:23 +0000 (UTC) Received: (qmail 22359 invoked by uid 550); 23 May 2018 19:55:25 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 22216 invoked from network); 23 May 2018 19:55:22 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=n+hT/tI6DARv83j+5jWLT/DgioPots97FP2Az+kjvJM=; b=YePHzzlvAHXjNdKFsBx8oYVui1urQCLhValA9ZKtDk7tY0uKVy0e2Esn1XqM4d8g09 fVgMp0Sh1OjpdkmXiXjlTJOLEy5ZvnXc70RNLIpJ6eZhWpsY9Va6WrXL0Dt1BIwLSPda LT6z5GpE4yol+qo6Fz3+lnK075E/ewm1QnLjuS2EKWgE7Y5ms9rOP0QsUCtgwktDkHDv 53eu+xkJSnrAE70aSVgvcKurVvrTLpgko3kWHETk47ItRzpFXVHn08WGoPPm5iFHqwol v5aidMHNBdWqTdH9+GiZoIBP4hmyJYyPgub8OTkuMOkyr0ucJ2TDpgeEVRrqf4HriQB1 XbAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=n+hT/tI6DARv83j+5jWLT/DgioPots97FP2Az+kjvJM=; b=j85pnyqF52EqIgg9VcY04BANxmM5cm6Kjl+Sgh8cAjWyafc3nvuhd/n5ztJpGhRfY0 vy7Sa6GBjHsmiAlYuyPLx5erThgKma1bqNT6fcNKVGDPVKZJl0w9Q3iNMC2De/dfoYgP ZvUsPmuk0qT0avs2KGgI4SRy8W5PUzhLisQxcRQ5E+UDAginzybUUx6YFCFfDdwho7mN xYydb1UcODHzVcJOuiD6hnoJS082DmDDc88oe/Xk9orGHpNjks+h0B+kr2uJWPIOEu2Y Ep70PDXgaQMLruoDTDZmJKcHymy+zdjeVjJgUDlVvFBI+fQ3+/JUs5adY/x/8diDBlXt W33g== X-Gm-Message-State: ALKqPwegCc7cEy04I4S6eTH1VspfEhwoyKuEsTA9xQP+lZnFQ4wPzlOl pgoriLT+pwSZFuXzZu/npxYF/A== X-Google-Smtp-Source: AB8JxZptrP0Yh15zd2pXKTm+cI4nKABKW3GGczk5O13tRc0ITLscZCd69jAaRTMC9dnwQt1Rvn4drQ== X-Received: by 2002:a62:a21e:: with SMTP id m30-v6mr4180489pff.251.1527105310758; Wed, 23 May 2018 12:55:10 -0700 (PDT) From: Thomas Garnier To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Greg Kroah-Hartman , Thomas Garnier , Philippe Ombredanne , Kate Stewart , Arnaldo Carvalho de Melo , Yonghong Song , Andrey Ryabinin , Kees Cook , Tom Lendacky , "Kirill A . Shutemov" , Andy Lutomirski , Dominik Brodowski , Borislav Petkov , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Alok Kataria , Steven Rostedt , Jan Kiszka , Tejun Heo , Christoph Lameter , Dennis Zhou , Boris Ostrovsky , Alexey Dobriyan , Masami Hiramatsu , Cao jin , Francis Deslauriers , "Paul E . McKenney" , Nicolas Pitre , Andrew Morton , Randy Dunlap , "Luis R . Rodriguez" , Arnd Bergmann , Christopher Li , Jason Baron , Mika Westerberg , Lukas Wunner , Dou Liyang , Sergey Senozhatsky , Petr Mladek , Masahiro Yamada , Ingo Molnar , Nicholas Piggin , "H . J . Lu" , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , David Woodhouse , Dave Hansen , Rik van Riel , Jia Zhang , Ricardo Neri , Jonathan Corbet , Jan Beulich , Matthias Kaehlcke , Baoquan He , =?UTF-8?q?Jan=20H=20=2E=20Sch=C3=B6nherr?= , Daniel Micay Cc: x86@kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, virtualization@lists.linux-foundation.org, xen-devel@lists.xenproject.org, linux-arch@vger.kernel.org, linux-sparse@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH v3 06/27] x86/entry/64: Adapt assembly for PIE support Date: Wed, 23 May 2018 12:54:00 -0700 Message-Id: <20180523195421.180248-7-thgarnie@google.com> X-Mailer: git-send-email 2.17.0.441.gb46fe60e1d-goog In-Reply-To: <20180523195421.180248-1-thgarnie@google.com> References: <20180523195421.180248-1-thgarnie@google.com> X-Virus-Scanned: ClamAV using ClamSMTP Change the assembly code to use only relative references of symbols for the kernel to be PIE compatible. Position Independent Executable (PIE) support will allow to extended the KASLR randomization range below the -2G memory limit. Signed-off-by: Thomas Garnier --- arch/x86/entry/entry_64.S | 18 ++++++++++++------ arch/x86/kernel/relocate_kernel_64.S | 8 +++----- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index c9648b287d7f..8638dca78191 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -191,7 +191,7 @@ ENTRY(entry_SYSCALL_64_trampoline) * spill RDI and restore it in a second-stage trampoline. */ pushq %rdi - movq $entry_SYSCALL_64_stage2, %rdi + movabsq $entry_SYSCALL_64_stage2, %rdi JMP_NOSPEC %rdi END(entry_SYSCALL_64_trampoline) @@ -1279,7 +1279,8 @@ ENTRY(error_entry) movl %ecx, %eax /* zero extend */ cmpq %rax, RIP+8(%rsp) je .Lbstep_iret - cmpq $.Lgs_change, RIP+8(%rsp) + leaq .Lgs_change(%rip), %rcx + cmpq %rcx, RIP+8(%rsp) jne .Lerror_entry_done /* @@ -1484,10 +1485,10 @@ ENTRY(nmi) * resume the outer NMI. */ - movq $repeat_nmi, %rdx + leaq repeat_nmi(%rip), %rdx cmpq 8(%rsp), %rdx ja 1f - movq $end_repeat_nmi, %rdx + leaq end_repeat_nmi(%rip), %rdx cmpq 8(%rsp), %rdx ja nested_nmi_out 1: @@ -1541,7 +1542,8 @@ nested_nmi: pushq %rdx pushfq pushq $__KERNEL_CS - pushq $repeat_nmi + leaq repeat_nmi(%rip), %rdx + pushq %rdx /* Put stack back */ addq $(6*8), %rsp @@ -1580,7 +1582,11 @@ first_nmi: addq $8, (%rsp) /* Fix up RSP */ pushfq /* RFLAGS */ pushq $__KERNEL_CS /* CS */ - pushq $1f /* RIP */ + pushq $0 /* Futur return address */ + pushq %rax /* Save RAX */ + leaq 1f(%rip), %rax /* RIP */ + movq %rax, 8(%rsp) /* Put 1f on return address */ + popq %rax /* Restore RAX */ iretq /* continues at repeat_nmi below */ UNWIND_HINT_IRET_REGS 1: diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S index a7227dfe1a2b..0c0fc259a4e2 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -208,11 +208,9 @@ identity_mapped: movq %rax, %cr3 lea PAGE_SIZE(%r8), %rsp call swap_pages - jmp *virtual_mapped_addr(%rip) - - /* Absolute value for PIE support */ -virtual_mapped_addr: - .quad virtual_mapped + movabsq $virtual_mapped, %rax + pushq %rax + ret virtual_mapped: movq RSP(%r8), %rsp