From patchwork Tue May 29 22:15:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 10437281 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 07602601E9 for ; Tue, 29 May 2018 22:19:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E36352890F for ; Tue, 29 May 2018 22:19:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D67E52891B; Tue, 29 May 2018 22:19:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id E6ED72890F for ; Tue, 29 May 2018 22:19:14 +0000 (UTC) Received: (qmail 17528 invoked by uid 550); 29 May 2018 22:17:11 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 17435 invoked from network); 29 May 2018 22:17:06 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=YDtWImwpMLwiWcow09kfiVgGJI/8lP8E5mcdAOjfZno=; b=WhreX7WFUwPV8zt8xd8t/49JQVRgxrnl/oqGeAFsWH4VpacEoFQBslxFcFtUHWdsb/ fOZU9GaBkY6ngjJA9044Sp91M6RxNm4Qr2V9VFk+yV+RMP1EiMPHYGEKeW6H/SWJo7u5 Rgg9ElJxV2Hulf7PGHA8buPXv94AdKA4reUiVtwOLk9VT56uzVmUnGpbwGFmf3XgzvuZ zpUaDq/r5EBg0SKtf8mepHw4GawFTKeQ4iVoK+O7uUatABtH5PcXYh7UmvxXcWjX6Wlq llBnTDtvZTHvQk1b58fwA6/pLccfU3UBl2BYRnNvjDXvil2KOEzjEbOCc+sbv54zDKjt /oNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=YDtWImwpMLwiWcow09kfiVgGJI/8lP8E5mcdAOjfZno=; b=UppD95mF8ps6fjGST2lCHvLIDFey1RA88I+nhbP5Ouv0kQ75P7NhWQA3F2FEvBPq3D PWmeDX2seGXx0BNASSzuRGH03M77+rsDn0F1CyQpc3DOHKzhuwydsY526S32UZb3ZeNi 7N/g+VqZys39LRDy7AyiUgRsXT9WwnzaxH+O95uGQzx6f+Gg+ZanVdTjYPUA4HJapuvW xW0riD6tkKebQJ857/dewWEqI1Kod95pcaqRyfNkbz+oZ956zzw7i4sA3ppMFD66X1JM 9/1b905CUK/Z/8/nUOxVOC/6WktpFT0PJFVfgRn91ilTIbTyoi2+d0MBuROZrX3kxDIt Al4Q== X-Gm-Message-State: ALKqPwdpcMvVxOylK/Edbk5aaSaUkKJmq8A2ZkMa/j3Ii461WvNDG8tj GFEVmIlbC+lFzGrN34f5sj9NZaFvbYk= X-Google-Smtp-Source: ADUXVKLAIoPB9qtIf76zzdZ+i4Fd8yg4lMmvrGSsTC7KuaEoPZyDXLamFE4WymWXm3zlcWSxccLVqQ== X-Received: by 2002:a63:5fcb:: with SMTP id t194-v6mr175358pgb.176.1527632214156; Tue, 29 May 2018 15:16:54 -0700 (PDT) From: Thomas Garnier To: kernel-hardening@lists.openwall.com Cc: Thomas Garnier , Skip Josh Poimboeuf , Skip Dave Hansen , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, Andy Lutomirski , Dominik Brodowski , Borislav Petkov , "Kirill A. Shutemov" , Tom Lendacky , linux-kernel@vger.kernel.org Subject: [PATCH v4 06/27] x86/entry/64: Adapt assembly for PIE support Date: Tue, 29 May 2018 15:15:07 -0700 Message-Id: <20180529221625.33541-7-thgarnie@google.com> X-Mailer: git-send-email 2.17.0.921.gf22659ad46-goog In-Reply-To: <20180529221625.33541-1-thgarnie@google.com> References: <20180529221625.33541-1-thgarnie@google.com> X-Virus-Scanned: ClamAV using ClamSMTP Change the assembly code to use only relative references of symbols for the kernel to be PIE compatible. Position Independent Executable (PIE) support will allow to extend the KASLR randomization range 0xffffffff80000000. Signed-off-by: Thomas Garnier --- arch/x86/entry/entry_64.S | 18 ++++++++++++------ arch/x86/kernel/relocate_kernel_64.S | 8 +++----- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index 3166b9674429..1cbf4c3616a8 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -191,7 +191,7 @@ ENTRY(entry_SYSCALL_64_trampoline) * spill RDI and restore it in a second-stage trampoline. */ pushq %rdi - movq $entry_SYSCALL_64_stage2, %rdi + movabsq $entry_SYSCALL_64_stage2, %rdi JMP_NOSPEC %rdi END(entry_SYSCALL_64_trampoline) @@ -1276,7 +1276,8 @@ ENTRY(error_entry) movl %ecx, %eax /* zero extend */ cmpq %rax, RIP+8(%rsp) je .Lbstep_iret - cmpq $.Lgs_change, RIP+8(%rsp) + leaq .Lgs_change(%rip), %rcx + cmpq %rcx, RIP+8(%rsp) jne .Lerror_entry_done /* @@ -1481,10 +1482,10 @@ ENTRY(nmi) * resume the outer NMI. */ - movq $repeat_nmi, %rdx + leaq repeat_nmi(%rip), %rdx cmpq 8(%rsp), %rdx ja 1f - movq $end_repeat_nmi, %rdx + leaq end_repeat_nmi(%rip), %rdx cmpq 8(%rsp), %rdx ja nested_nmi_out 1: @@ -1538,7 +1539,8 @@ nested_nmi: pushq %rdx pushfq pushq $__KERNEL_CS - pushq $repeat_nmi + leaq repeat_nmi(%rip), %rdx + pushq %rdx /* Put stack back */ addq $(6*8), %rsp @@ -1577,7 +1579,11 @@ first_nmi: addq $8, (%rsp) /* Fix up RSP */ pushfq /* RFLAGS */ pushq $__KERNEL_CS /* CS */ - pushq $1f /* RIP */ + pushq $0 /* Futur return address */ + pushq %rax /* Save RAX */ + leaq 1f(%rip), %rax /* RIP */ + movq %rax, 8(%rsp) /* Put 1f on return address */ + popq %rax /* Restore RAX */ iretq /* continues at repeat_nmi below */ UNWIND_HINT_IRET_REGS 1: diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S index a7227dfe1a2b..0c0fc259a4e2 100644 --- a/arch/x86/kernel/relocate_kernel_64.S +++ b/arch/x86/kernel/relocate_kernel_64.S @@ -208,11 +208,9 @@ identity_mapped: movq %rax, %cr3 lea PAGE_SIZE(%r8), %rsp call swap_pages - jmp *virtual_mapped_addr(%rip) - - /* Absolute value for PIE support */ -virtual_mapped_addr: - .quad virtual_mapped + movabsq $virtual_mapped, %rax + pushq %rax + ret virtual_mapped: movq RSP(%r8), %rsp