From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.1 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D1DBC3F2D7 for ; Tue, 3 Mar 2020 09:56:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 53ADE22522 for ; Tue, 3 Mar 2020 09:56:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="zrXbi+1X" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727412AbgCCJ4T (ORCPT ); Tue, 3 Mar 2020 04:56:19 -0500 Received: from merlin.infradead.org ([205.233.59.134]:47656 "EHLO merlin.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726694AbgCCJ4T (ORCPT ); Tue, 3 Mar 2020 04:56:19 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=xjAYzYZJidsTEHXSs//Oe4SJs+qAxcjB8dKxwUENenQ=; b=zrXbi+1XYsYg1hOUfgotstGR1s A/yiklisppTF0E9uRLa0vly9Whs1m5MF6QXAFqbz0RIOZTQ3IBkvmXEsEzAH7H4G/eUNCE9COhaKf Jt1sB06ShmrP6pL5etFIXieKzux9rI1PRF59uv6SLpF0G2BI2GBcdWRCspKTvO/2p1jLRtrNUi6Sh HA8kSw8UO5dmWtltons0CLJ0nXm+Y659s9TY0lr4a4KSUKIjb7SJaBWwJIkbCrpzdLCOQb8EEI+W+ eVFHzpAPkRg2pOXnstpM7fhlRyhkazF7U53uvuy8CCxYkEUPSwaZ6iuVSdlA2OHKAJpd7ZHKu3O6I dRuWKx+w==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=noisy.programming.kicks-ass.net) by merlin.infradead.org with esmtpsa (Exim 4.92.3 #3 (Red Hat Linux)) id 1j94Gm-0001E5-NN; Tue, 03 Mar 2020 09:55:20 +0000 Received: from hirez.programming.kicks-ass.net (hirez.programming.kicks-ass.net [192.168.1.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by noisy.programming.kicks-ass.net (Postfix) with ESMTPS id 8918A30110E; Tue, 3 Mar 2020 10:53:16 +0100 (CET) Received: by hirez.programming.kicks-ass.net (Postfix, from userid 1000) id 780FD2119B2EB; Tue, 3 Mar 2020 10:55:14 +0100 (CET) Date: Tue, 3 Mar 2020 10:55:14 +0100 From: Peter Zijlstra To: Kees Cook Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Thomas Garnier , kernel-hardening@lists.openwall.com, kristen@linux.intel.com, Herbert Xu , "David S. Miller" , "H. Peter Anvin" , x86@kernel.org, Andy Lutomirski , Juergen Gross , Thomas Hellstrom , "VMware, Inc." , "Rafael J. Wysocki" , Len Brown , Pavel Machek , Rasmus Villemoes , Miguel Ojeda , Will Deacon , Ard Biesheuvel , Masami Hiramatsu , Jiri Slaby , Boris Ostrovsky , Josh Poimboeuf , Cao jin , Allison Randal , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-pm@vger.kernel.org Subject: Re: [PATCH v11 00/11] x86: PIE support to extend KASLR randomization Message-ID: <20200303095514.GA2596@hirez.programming.kicks-ass.net> References: <20200228000105.165012-1-thgarnie@chromium.org> <202003022100.54CEEE60F@keescook> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <202003022100.54CEEE60F@keescook> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org On Mon, Mar 02, 2020 at 09:02:15PM -0800, Kees Cook wrote: > On Thu, Feb 27, 2020 at 04:00:45PM -0800, Thomas Garnier wrote: > > Minor changes based on feedback and rebase from v10. > > > > Splitting the previous serie in two. This part contains assembly code > > changes required for PIE but without any direct dependencies with the > > rest of the patchset. > > > > Note: Using objtool to detect non-compliant PIE relocations is not yet > > possible as this patchset only includes the simplest PIE changes. > > Additional changes are needed in kvm, xen and percpu code. > > > > Changes: > > - patch v11 (assembly); > > - Fix comments on x86/entry/64. > > - Remove KASLR PIE explanation on all commits. > > - Add note on objtool not being possible at this stage of the patchset. > > This moves us closer to PIE in a clean first step. I think these patches > look good to go, and unblock the work in kvm, xen, and percpu code. Can > one of the x86 maintainers pick this series up? But,... do we still need this in the light of that fine-grained kaslr stuff? What is the actual value of this PIE crud in the face of that?