All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dave.Martin@arm.com (Dave Martin)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH 02/30] ARM: assembler: introduce adr_l, ldr_l and str_l macros
Date: Mon, 14 Aug 2017 16:50:02 +0100	[thread overview]
Message-ID: <20170814155002.GV6321@e103592.cambridge.arm.com> (raw)
In-Reply-To: <CAKv+Gu87G93X36TdAEiMC46Uz_PqXEi_4LSftnUdkQ8HRCxWiA@mail.gmail.com>

On Mon, Aug 14, 2017 at 04:38:02PM +0100, Ard Biesheuvel wrote:
> On 14 August 2017 at 16:29, Dave Martin <Dave.Martin@arm.com> wrote:
> > On Mon, Aug 14, 2017 at 01:53:43PM +0100, Ard Biesheuvel wrote:
> >> Like arm64, ARM supports position independent code sequences that
> >> produce symbol references with a greater reach than the ordinary
> >> adr/ldr instructions.
> >>
> >> Currently, we use open coded instruction sequences involving literals
> >> and arithmetic operations. Instead, we can use movw/movt pairs on v7
> >> CPUs, circumventing the D-cache entirely. For older CPUs, we can emit
> >> the literal into a subsection, allowing it to be emitted out of line
> >> while retaining the ability to perform arithmetic on label offsets.
> >>
> >> E.g., on pre-v7 CPUs, we can emit a PC-relative reference as follows:
> >>
> >>        ldr          <reg>, 222f
> >>   111: add          <reg>, <reg>, pc
> >>        .subsection  1
> >>   222: .long        <sym> - (111b + 8)
> >>        .previous
> >>
> >> This is allowed by the assembler because, unlike ordinary sections,
> >> subsections are combined into a single section into the object file,
> >> and so the label references are not true cross-section references that
> >> are visible as relocations. Note that we could even do something like
> >>
> >>        add          <reg>, pc, #(222f - 111f) & ~0xfff
> >>        ldr          <reg>, [<reg>, #(222f - 111f) & 0xfff]
> >>   111: add          <reg>, <reg>, pc
> >>        .subsection  1
> >>   222: .long        <sym> - (111b + 8)
> >>        .previous
> >
> > This is reinventing ldr=
> >
> > I seem to remember ldr= barfing on things that .long happily accepts
> > though, was this the reason?
> >
> 
> Yes. ldr = does not accept expressions involving symbols, only plain
> symbols or expressions that evaluate to constants.
> 
> So something like
> 
> ldr <reg>, =<sym> - <label>
> 
> is rejected while the equivalent
> 
> ldr <reg>, 0f
> 0: .long <sym> - <label>
> 
> does work.

I wouldn't bother trying to rationalise gas' behaviour here.  I think
it's an accident of implementation rather than there being some
fundamental reason for it.

AFAICT gas could quite happily resolve ldr= in exactly the same way as
.long and thus not have this problem.  But we can't rewrite history.

[...]

> >> +     .macro          __adldst_l, op, reg, sym, tmp, c
> >> +     .if             __LINUX_ARM_ARCH__ < 7
> >> +     ldr\c           \tmp, 111f
> >> +     .subsection     1
> >> +     .align          2
> >> +111: .long           \sym - (222f + ARM_PC_BIAS)
> >
> > See above comment about ldr=.
> >
> >> +     .previous
> >> +     .else
> >> +     W(movw\c\())    \tmp, #:lower16:\sym - (222f + ARM_PC_BIAS)
> >> +     W(movt\c\())    \tmp, #:upper16:\sym - (222f + ARM_PC_BIAS)
> >
> > Why W()?
> >
> > There are no narrow forms of these instructions anyway -- if there were
> > then they couldn't accommodate a 16-bit immediate.
> >
> 
> That's a trick, actually, which I failed to add a comment for.
> 
> We use .arm sections in the thumb2 kernel, and using these macros
> there would result in the wrong offset to be used. Adding the .w
> suffix forces an error in the assembler which even results in a fairly
> meaningful error message complaining about using .w in ARM code.

Ewww... I think it'd be best to add a comment explaining that.

There's a fair change someone will trip over this at some point (or
worse, "fix" the assembly errors).

> 
> >> +     .endif
> >> +222:
> >> +     .ifc            \op, add
> >> +     add\c           \reg, \tmp, pc
> >> +     .elseif         CONFIG_THUMB2_KERNEL == 1
> >> +     add             \tmp, \tmp, pc
> >> +     \op\c           \reg, [\tmp]
> >
> > Shame
> >         \op\c           \reg, [pc, \tmp]
> > doesn't work.
> >
> > But it doesn't, apparently.
> >
> 
> No, thumb2 does not allow that

Meh.  Oh well.

[...]

Cheers
---Dave

WARNING: multiple messages have this Message-ID (diff)
From: Dave Martin <Dave.Martin@arm.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>,
	Kees Cook <keescook@chromium.org>, Arnd Bergmann <arnd@arndb.de>,
	Nicolas Pitre <nico@linaro.org>,
	Marc Zyngier <marc.zyngier@arm.com>,
	Kernel Hardening <kernel-hardening@lists.openwall.com>,
	Russell King <linux@armlinux.org.uk>,
	Tony Lindgren <tony@atomide.com>,
	"linux-arm-kernel@lists.infradead.org"
	<linux-arm-kernel@lists.infradead.org>,
	Thomas Garnier <thgarnie@google.com>,
	Matt Fleming <matt@codeblueprint.co.uk>
Subject: [kernel-hardening] Re: [PATCH 02/30] ARM: assembler: introduce adr_l, ldr_l and str_l macros
Date: Mon, 14 Aug 2017 16:50:02 +0100	[thread overview]
Message-ID: <20170814155002.GV6321@e103592.cambridge.arm.com> (raw)
In-Reply-To: <CAKv+Gu87G93X36TdAEiMC46Uz_PqXEi_4LSftnUdkQ8HRCxWiA@mail.gmail.com>

On Mon, Aug 14, 2017 at 04:38:02PM +0100, Ard Biesheuvel wrote:
> On 14 August 2017 at 16:29, Dave Martin <Dave.Martin@arm.com> wrote:
> > On Mon, Aug 14, 2017 at 01:53:43PM +0100, Ard Biesheuvel wrote:
> >> Like arm64, ARM supports position independent code sequences that
> >> produce symbol references with a greater reach than the ordinary
> >> adr/ldr instructions.
> >>
> >> Currently, we use open coded instruction sequences involving literals
> >> and arithmetic operations. Instead, we can use movw/movt pairs on v7
> >> CPUs, circumventing the D-cache entirely. For older CPUs, we can emit
> >> the literal into a subsection, allowing it to be emitted out of line
> >> while retaining the ability to perform arithmetic on label offsets.
> >>
> >> E.g., on pre-v7 CPUs, we can emit a PC-relative reference as follows:
> >>
> >>        ldr          <reg>, 222f
> >>   111: add          <reg>, <reg>, pc
> >>        .subsection  1
> >>   222: .long        <sym> - (111b + 8)
> >>        .previous
> >>
> >> This is allowed by the assembler because, unlike ordinary sections,
> >> subsections are combined into a single section into the object file,
> >> and so the label references are not true cross-section references that
> >> are visible as relocations. Note that we could even do something like
> >>
> >>        add          <reg>, pc, #(222f - 111f) & ~0xfff
> >>        ldr          <reg>, [<reg>, #(222f - 111f) & 0xfff]
> >>   111: add          <reg>, <reg>, pc
> >>        .subsection  1
> >>   222: .long        <sym> - (111b + 8)
> >>        .previous
> >
> > This is reinventing ldr=
> >
> > I seem to remember ldr= barfing on things that .long happily accepts
> > though, was this the reason?
> >
> 
> Yes. ldr = does not accept expressions involving symbols, only plain
> symbols or expressions that evaluate to constants.
> 
> So something like
> 
> ldr <reg>, =<sym> - <label>
> 
> is rejected while the equivalent
> 
> ldr <reg>, 0f
> 0: .long <sym> - <label>
> 
> does work.

I wouldn't bother trying to rationalise gas' behaviour here.  I think
it's an accident of implementation rather than there being some
fundamental reason for it.

AFAICT gas could quite happily resolve ldr= in exactly the same way as
.long and thus not have this problem.  But we can't rewrite history.

[...]

> >> +     .macro          __adldst_l, op, reg, sym, tmp, c
> >> +     .if             __LINUX_ARM_ARCH__ < 7
> >> +     ldr\c           \tmp, 111f
> >> +     .subsection     1
> >> +     .align          2
> >> +111: .long           \sym - (222f + ARM_PC_BIAS)
> >
> > See above comment about ldr=.
> >
> >> +     .previous
> >> +     .else
> >> +     W(movw\c\())    \tmp, #:lower16:\sym - (222f + ARM_PC_BIAS)
> >> +     W(movt\c\())    \tmp, #:upper16:\sym - (222f + ARM_PC_BIAS)
> >
> > Why W()?
> >
> > There are no narrow forms of these instructions anyway -- if there were
> > then they couldn't accommodate a 16-bit immediate.
> >
> 
> That's a trick, actually, which I failed to add a comment for.
> 
> We use .arm sections in the thumb2 kernel, and using these macros
> there would result in the wrong offset to be used. Adding the .w
> suffix forces an error in the assembler which even results in a fairly
> meaningful error message complaining about using .w in ARM code.

Ewww... I think it'd be best to add a comment explaining that.

There's a fair change someone will trip over this at some point (or
worse, "fix" the assembly errors).

> 
> >> +     .endif
> >> +222:
> >> +     .ifc            \op, add
> >> +     add\c           \reg, \tmp, pc
> >> +     .elseif         CONFIG_THUMB2_KERNEL == 1
> >> +     add             \tmp, \tmp, pc
> >> +     \op\c           \reg, [\tmp]
> >
> > Shame
> >         \op\c           \reg, [pc, \tmp]
> > doesn't work.
> >
> > But it doesn't, apparently.
> >
> 
> No, thumb2 does not allow that

Meh.  Oh well.

[...]

Cheers
---Dave

  reply	other threads:[~2017-08-14 15:50 UTC|newest]

Thread overview: 120+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-08-14 12:53 [PATCH 00/30] implement KASLR for ARM Ard Biesheuvel
2017-08-14 12:53 ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 01/30] asm-generic: add .data.rel.ro sections to __ro_after_init Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 14:26   ` Arnd Bergmann
2017-08-14 14:26     ` [kernel-hardening] " Arnd Bergmann
2017-08-14 12:53 ` [PATCH 02/30] ARM: assembler: introduce adr_l, ldr_l and str_l macros Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 15:29   ` Dave Martin
2017-08-14 15:29     ` [kernel-hardening] " Dave Martin
2017-08-14 15:38     ` Ard Biesheuvel
2017-08-14 15:38       ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 15:50       ` Dave Martin [this message]
2017-08-14 15:50         ` Dave Martin
2017-08-14 16:18         ` Nicolas Pitre
2017-08-14 16:18           ` [kernel-hardening] " Nicolas Pitre
2017-08-14 16:22           ` Ard Biesheuvel
2017-08-14 16:22             ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 16:33             ` Nicolas Pitre
2017-08-14 16:33               ` [kernel-hardening] " Nicolas Pitre
2017-08-14 16:42             ` Russell King - ARM Linux
2017-08-14 16:42               ` [kernel-hardening] " Russell King - ARM Linux
2017-08-14 16:56               ` Ard Biesheuvel
2017-08-14 16:56                 ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 15:32   ` Dave Martin
2017-08-14 15:32     ` [kernel-hardening] " Dave Martin
2017-08-14 15:40     ` Ard Biesheuvel
2017-08-14 15:40       ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 15:53       ` Dave Martin
2017-08-14 15:53         ` [kernel-hardening] " Dave Martin
2017-08-14 12:53 ` [PATCH 03/30] ARM: head-common.S: use PC-relative insn sequence for __proc_info Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 04/30] ARM: head-common.S: use PC-relative insn sequence for idmap creation Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 05/30] ARM: head.S: use PC-relative insn sequence for secondary_data Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 06/30] ARM: kernel: use relative references for UP/SMP alternatives Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 07/30] ARM: head: use PC-relative insn sequence for __smp_alt Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 08/30] ARM: sleep.S: use PC-relative insn sequence for sleep_save_sp/mpidr_hash Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 09/30] ARM: head.S: use PC-relative insn sequences for __fixup_pv_table Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 10/30] ARM: head.S: use PC relative insn sequence to calculate PHYS_OFFSET Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 11/30] ARM: kvm: replace open coded VA->PA calculations with adr_l call Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 12/30] arm-soc: exynos: replace open coded VA->PA conversions Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 13/30] arm-soc: mvebu: replace open coded VA->PA conversion Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 14/30] arm-soc: various: replace open coded VA->PA calculation of pen_release Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 15/30] ARM: kernel: switch to relative exception tables Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 16/30] ARM: kernel: use relative phys-to-virt patch tables Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:53 ` [PATCH 17/30] arm-soc: tegra: make sleep asm code runtime relocatable Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 14:42   ` Dave Martin
2017-08-14 14:42     ` [kernel-hardening] " Dave Martin
2017-08-14 14:49     ` Ard Biesheuvel
2017-08-14 14:49       ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 15:29       ` Dave Martin
2017-08-14 15:29         ` [kernel-hardening] " Dave Martin
2017-08-14 12:53 ` [PATCH 18/30] ARM: kernel: make vmlinux buildable as a PIE executable Ard Biesheuvel
2017-08-14 12:53   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 19/30] ARM: kernel: use PC-relative symbol references in MMU switch code Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 20/30] ARM: kernel: use PC relative symbol references in suspend/resume code Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 16:02   ` Nicolas Pitre
2017-08-14 16:02     ` [kernel-hardening] " Nicolas Pitre
2017-08-14 18:14     ` Ard Biesheuvel
2017-08-14 18:14       ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 18:37       ` Nicolas Pitre
2017-08-14 18:37         ` [kernel-hardening] " Nicolas Pitre
2017-08-14 12:54 ` [PATCH 21/30] ARM: mm: export default vmalloc base address Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 22/30] ARM: kernel: refer to swapper_pg_dir via its symbol Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 23/30] ARM: kernel: implement randomization of the kernel load address Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 24/30] ARM: decompressor: explicitly map decompressor binary cacheable Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 25/30] ARM: compressed: factor out zImage header and make it extensible Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 26/30] ARM: decompressor: add KASLR support Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 27/30] efi/libstub: add 'max' parameter to efi_random_alloc() Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 28/30] efi/libstub: check for vmalloc= command line argument Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 29/30] efi/libstub: arm: reserve bootloader supplied initrd in memory map Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-18 11:48   ` Ard Biesheuvel
2017-08-18 11:48     ` [kernel-hardening] " Ard Biesheuvel
2017-08-21 10:37   ` Mark Rutland
2017-08-21 10:37     ` [kernel-hardening] " Mark Rutland
2017-08-21 10:39     ` Ard Biesheuvel
2017-08-21 10:39       ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 12:54 ` [PATCH 30/30] efi/libstub: arm: implement KASLR Ard Biesheuvel
2017-08-14 12:54   ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 15:30 ` [PATCH 00/30] implement KASLR for ARM Arnd Bergmann
2017-08-14 15:30   ` [kernel-hardening] " Arnd Bergmann
2017-08-14 15:49   ` Ard Biesheuvel
2017-08-14 15:49     ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 16:03     ` Arnd Bergmann
2017-08-14 16:03       ` [kernel-hardening] " Arnd Bergmann
2017-08-14 16:28       ` Nicolas Pitre
2017-08-14 16:28         ` [kernel-hardening] " Nicolas Pitre
2017-08-14 17:28         ` Ard Biesheuvel
2017-08-14 17:28           ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 18:01           ` Nicolas Pitre
2017-08-14 18:01             ` [kernel-hardening] " Nicolas Pitre
2017-08-14 18:08             ` Ard Biesheuvel
2017-08-14 18:08               ` [kernel-hardening] " Ard Biesheuvel
2017-08-14 16:16     ` Nicolas Pitre
2017-08-14 16:16       ` [kernel-hardening] " Nicolas Pitre

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170814155002.GV6321@e103592.cambridge.arm.com \
    --to=dave.martin@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.