kernel-hardening.lists.openwall.com archive mirror
 help / color / mirror / Atom feed
From: Thomas Garnier <thgarnie@chromium.org>
To: kernel-hardening@lists.openwall.com
Cc: kristen@linux.intel.com, keescook@chromium.org,
	Herbert Xu <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
	"H. Peter Anvin" <hpa@zytor.com>,
	x86@kernel.org, Andy Lutomirski <luto@kernel.org>,
	Juergen Gross <jgross@suse.com>,
	Thomas Hellstrom <thellstrom@vmware.com>,
	"VMware, Inc." <pv-drivers@vmware.com>,
	"Rafael J. Wysocki" <rjw@rjwysocki.net>,
	Len Brown <len.brown@intel.com>, Pavel Machek <pavel@ucw.cz>,
	Peter Zijlstra <peterz@infradead.org>,
	Nadav Amit <namit@vmware.com>,
	Thomas Garnier <thgarnie@chromium.org>,
	Jann Horn <jannh@google.com>, Feng Tang <feng.tang@intel.com>,
	Maran Wilson <maran.wilson@oracle.com>,
	Enrico Weigelt <info@metux.net>,
	Allison Randal <allison@lohutok.net>,
	Alexios Zavras <alexios.zavras@intel.com>,
	linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
	virtualization@lists.linux-foundation.org,
	linux-pm@vger.kernel.org
Subject: [PATCH v9 00/11] x86: PIE support to extend KASLR randomization
Date: Tue, 30 Jul 2019 12:12:44 -0700	[thread overview]
Message-ID: <20190730191303.206365-1-thgarnie@chromium.org> (raw)

Minor changes based on feedback and rebase from v8.

Splitting the previous serie in two. This part contains assembly code
changes required for PIE but without any direct dependencies with the
rest of the patchset.

Changes:
 - patch v9 (assembly):
   - Moved to relative reference for sync_core based on feedback.
   - x86/crypto had multiple algorithms deleted, removed PIE changes to them.
   - fix typo on comment end line.
 - patch v8 (assembly):
   - Fix issues in crypto changes (thanks to Eric Biggers).
   - Remove unnecessary jump table change.
   - Change author and signoff to chromium email address.
 - patch v7 (assembly):
   - Split patchset and reorder changes.
 - patch v6:
   - Rebase on latest changes in jump tables and crypto.
   - Fix wording on couple commits.
   - Revisit checkpatch warnings.
   - Moving to @chromium.org.
 - patch v5:
   - Adapt new crypto modules for PIE.
   - Improve per-cpu commit message.
   - Fix xen 32-bit build error with .quad.
   - Remove extra code for ftrace.
 - patch v4:
   - Simplify early boot by removing global variables.
   - Modify the mcount location script for __mcount_loc intead of the address
     read in the ftrace implementation.
   - Edit commit description to explain better where the kernel can be located.
   - Streamlined the testing done on each patch proposal. Always testing
     hibernation, suspend, ftrace and kprobe to ensure no regressions.
 - patch v3:
   - Update on message to describe longer term PIE goal.
   - Minor change on ftrace if condition.
   - Changed code using xchgq.
 - patch v2:
   - Adapt patch to work post KPTI and compiler changes
   - Redo all performance testing with latest configs and compilers
   - Simplify mov macro on PIE (MOVABS now)
   - Reduce GOT footprint
 - patch v1:
   - Simplify ftrace implementation.
   - Use gcc mstack-protector-guard-reg=%gs with PIE when possible.
 - rfc v3:
   - Use --emit-relocs instead of -pie to reduce dynamic relocation space on
     mapped memory. It also simplifies the relocation process.
   - Move the start the module section next to the kernel. Remove the need for
     -mcmodel=large on modules. Extends module space from 1 to 2G maximum.
   - Support for XEN PVH as 32-bit relocations can be ignored with
     --emit-relocs.
   - Support for GOT relocations previously done automatically with -pie.
   - Remove need for dynamic PLT in modules.
   - Support dymamic GOT for modules.
 - rfc v2:
   - Add support for global stack cookie while compiler default to fs without
     mcmodel=kernel
   - Change patch 7 to correctly jump out of the identity mapping on kexec load
     preserve.

These patches make some of the changes necessary to build the kernel as
Position Independent Executable (PIE) on x86_64. Another patchset will
add the PIE option and larger architecture changes.

The patches:
 - 1, 3-11: Change in assembly code to be PIE compliant.
 - 2: Add a new _ASM_MOVABS macro to fetch a symbol address generically.

diffstat:
 crypto/aegis128-aesni-asm.S         |    6 +-
 crypto/aesni-intel_asm.S            |    8 +--
 crypto/aesni-intel_avx-x86_64.S     |    3 -
 crypto/camellia-aesni-avx-asm_64.S  |   42 +++++++--------
 crypto/camellia-aesni-avx2-asm_64.S |   44 ++++++++--------
 crypto/camellia-x86_64-asm_64.S     |    8 +--
 crypto/cast5-avx-x86_64-asm_64.S    |   50 ++++++++++--------
 crypto/cast6-avx-x86_64-asm_64.S    |   44 +++++++++-------
 crypto/des3_ede-asm_64.S            |   96 ++++++++++++++++++++++++------------
 crypto/ghash-clmulni-intel_asm.S    |    4 -
 crypto/glue_helper-asm-avx.S        |    4 -
 crypto/glue_helper-asm-avx2.S       |    6 +-
 crypto/sha256-avx2-asm.S            |   18 ++++--
 entry/entry_64.S                    |   16 ++++--
 include/asm/alternative.h           |    6 +-
 include/asm/asm.h                   |    1 
 include/asm/paravirt_types.h        |   25 +++++++--
 include/asm/pm-trace.h              |    2 
 include/asm/processor.h             |    6 +-
 kernel/acpi/wakeup_64.S             |   31 ++++++-----
 kernel/head_64.S                    |   16 +++---
 kernel/relocate_kernel_64.S         |    2 
 power/hibernate_asm_64.S            |    4 -
 23 files changed, 261 insertions(+), 181 deletions(-)

Patchset is based on next-20190729.



             reply	other threads:[~2019-07-30 19:13 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-30 19:12 Thomas Garnier [this message]
2019-07-30 19:12 ` [PATCH v9 01/11] x86/crypto: Adapt assembly for PIE support Thomas Garnier
2019-08-05 16:32   ` Borislav Petkov
2019-08-05 16:54     ` Kees Cook
2019-08-05 17:27       ` Borislav Petkov
2019-08-05 17:53         ` Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 02/11] x86: Add macro to get symbol address " Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 03/11] x86: relocate_kernel - Adapt assembly " Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 04/11] x86/entry/64: " Thomas Garnier
2019-08-05 17:28   ` Borislav Petkov
2019-08-05 17:50     ` Thomas Garnier
2019-08-06  5:08       ` Borislav Petkov
2019-08-06  8:30         ` Peter Zijlstra
2019-08-06 12:35           ` Borislav Petkov
2019-08-06 13:59     ` Steven Rostedt
2019-08-06 15:35       ` Borislav Petkov
2019-07-30 19:12 ` [PATCH v9 05/11] x86: pm-trace - " Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 06/11] x86/CPU: " Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 07/11] x86/acpi: " Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 08/11] x86/boot/64: " Thomas Garnier
2019-08-09 17:30   ` Borislav Petkov
2019-10-29 21:29     ` Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 09/11] x86/power/64: " Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 10/11] x86/paravirt: " Thomas Garnier
2019-07-31 12:53   ` Peter Zijlstra
2019-08-12 12:55     ` Borislav Petkov
2019-10-29 21:30       ` Thomas Garnier
2019-07-30 19:12 ` [PATCH v9 11/11] x86/alternatives: " Thomas Garnier
2019-08-12 13:57   ` Borislav Petkov
2019-10-29 21:31     ` Thomas Garnier
2019-08-06 15:43 ` [PATCH v9 00/11] x86: PIE support to extend KASLR randomization Borislav Petkov
2019-08-06 15:50   ` Peter Zijlstra
2019-08-29 19:55     ` Thomas Garnier
2019-09-06 23:22       ` Thomas Garnier

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190730191303.206365-1-thgarnie@chromium.org \
    --to=thgarnie@chromium.org \
    --cc=alexios.zavras@intel.com \
    --cc=allison@lohutok.net \
    --cc=bp@alien8.de \
    --cc=davem@davemloft.net \
    --cc=feng.tang@intel.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=hpa@zytor.com \
    --cc=info@metux.net \
    --cc=jannh@google.com \
    --cc=jgross@suse.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=kristen@linux.intel.com \
    --cc=len.brown@intel.com \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pm@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=maran.wilson@oracle.com \
    --cc=mingo@redhat.com \
    --cc=namit@vmware.com \
    --cc=pavel@ucw.cz \
    --cc=peterz@infradead.org \
    --cc=pv-drivers@vmware.com \
    --cc=rjw@rjwysocki.net \
    --cc=tglx@linutronix.de \
    --cc=thellstrom@vmware.com \
    --cc=virtualization@lists.linux-foundation.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).