* [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support
2019-12-05 0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
@ 2019-12-05 0:09 ` Thomas Garnier
2019-12-05 0:09 ` [PATCH v10 09/11] x86/power/64: " Thomas Garnier
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-05 0:09 UTC (permalink / raw)
To: kernel-hardening
Cc: kristen, keescook, Thomas Garnier, Pavel Machek,
Rafael J . Wysocki, Rafael J. Wysocki, Len Brown,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, H. Peter Anvin,
x86, linux-pm, linux-kernel
Change the assembly code to use only relative references of symbols for the
kernel to be PIE compatible.
Position Independent Executable (PIE) support will allow to extend the
KASLR randomization range below 0xffffffff80000000.
Signed-off-by: Thomas Garnier <thgarnie@chromium.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
---
arch/x86/kernel/acpi/wakeup_64.S | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/arch/x86/kernel/acpi/wakeup_64.S b/arch/x86/kernel/acpi/wakeup_64.S
index c8daa92f38dc..8e221285d9f1 100644
--- a/arch/x86/kernel/acpi/wakeup_64.S
+++ b/arch/x86/kernel/acpi/wakeup_64.S
@@ -15,7 +15,7 @@
* Hooray, we are in Long 64-bit mode (but still running in low memory)
*/
SYM_FUNC_START(wakeup_long64)
- movq saved_magic, %rax
+ movq saved_magic(%rip), %rax
movq $0x123456789abcdef0, %rdx
cmpq %rdx, %rax
je 2f
@@ -31,14 +31,14 @@ SYM_FUNC_START(wakeup_long64)
movw %ax, %es
movw %ax, %fs
movw %ax, %gs
- movq saved_rsp, %rsp
+ movq saved_rsp(%rip), %rsp
- movq saved_rbx, %rbx
- movq saved_rdi, %rdi
- movq saved_rsi, %rsi
- movq saved_rbp, %rbp
+ movq saved_rbx(%rip), %rbx
+ movq saved_rdi(%rip), %rdi
+ movq saved_rsi(%rip), %rsi
+ movq saved_rbp(%rip), %rbp
- movq saved_rip, %rax
+ movq saved_rip(%rip), %rax
jmp *%rax
SYM_FUNC_END(wakeup_long64)
@@ -48,7 +48,7 @@ SYM_FUNC_START(do_suspend_lowlevel)
xorl %eax, %eax
call save_processor_state
- movq $saved_context, %rax
+ leaq saved_context(%rip), %rax
movq %rsp, pt_regs_sp(%rax)
movq %rbp, pt_regs_bp(%rax)
movq %rsi, pt_regs_si(%rax)
@@ -67,13 +67,14 @@ SYM_FUNC_START(do_suspend_lowlevel)
pushfq
popq pt_regs_flags(%rax)
- movq $.Lresume_point, saved_rip(%rip)
+ leaq .Lresume_point(%rip), %rax
+ movq %rax, saved_rip(%rip)
- movq %rsp, saved_rsp
- movq %rbp, saved_rbp
- movq %rbx, saved_rbx
- movq %rdi, saved_rdi
- movq %rsi, saved_rsi
+ movq %rsp, saved_rsp(%rip)
+ movq %rbp, saved_rbp(%rip)
+ movq %rbx, saved_rbx(%rip)
+ movq %rdi, saved_rdi(%rip)
+ movq %rsi, saved_rsi(%rip)
addq $8, %rsp
movl $3, %edi
@@ -85,7 +86,7 @@ SYM_FUNC_START(do_suspend_lowlevel)
.align 4
.Lresume_point:
/* We don't restore %rax, it must be 0 anyway */
- movq $saved_context, %rax
+ leaq saved_context(%rip), %rax
movq saved_context_cr4(%rax), %rbx
movq %rbx, %cr4
movq saved_context_cr3(%rax), %rbx
--
2.24.0.393.g34dc348eaf-goog
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v10 09/11] x86/power/64: Adapt assembly for PIE support
2019-12-05 0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
2019-12-05 0:09 ` [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support Thomas Garnier
@ 2019-12-05 0:09 ` Thomas Garnier
2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
2019-12-24 13:03 ` Borislav Petkov
3 siblings, 0 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-05 0:09 UTC (permalink / raw)
To: kernel-hardening
Cc: kristen, keescook, Thomas Garnier, Pavel Machek,
Rafael J . Wysocki, Rafael J. Wysocki, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, H. Peter Anvin, x86, linux-pm,
linux-kernel
Change the assembly code to use only relative references of symbols for the
kernel to be PIE compatible.
Position Independent Executable (PIE) support will allow to extend the
KASLR randomization range below 0xffffffff80000000.
Signed-off-by: Thomas Garnier <thgarnie@chromium.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
---
arch/x86/power/hibernate_asm_64.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
index 7918b8415f13..977b8ae85045 100644
--- a/arch/x86/power/hibernate_asm_64.S
+++ b/arch/x86/power/hibernate_asm_64.S
@@ -23,7 +23,7 @@
#include <asm/frame.h>
SYM_FUNC_START(swsusp_arch_suspend)
- movq $saved_context, %rax
+ leaq saved_context(%rip), %rax
movq %rsp, pt_regs_sp(%rax)
movq %rbp, pt_regs_bp(%rax)
movq %rsi, pt_regs_si(%rax)
@@ -116,7 +116,7 @@ SYM_FUNC_START(restore_registers)
movq %rax, %cr4; # turn PGE back on
/* We don't restore %rax, it must be 0 anyway */
- movq $saved_context, %rax
+ leaq saved_context(%rip), %rax
movq pt_regs_sp(%rax), %rsp
movq pt_regs_bp(%rax), %rbp
movq pt_regs_si(%rax), %rsi
--
2.24.0.393.g34dc348eaf-goog
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
2019-12-05 0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
2019-12-05 0:09 ` [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support Thomas Garnier
2019-12-05 0:09 ` [PATCH v10 09/11] x86/power/64: " Thomas Garnier
@ 2019-12-19 13:34 ` Peter Zijlstra
2019-12-19 16:35 ` Thomas Garnier
2019-12-24 13:03 ` Borislav Petkov
3 siblings, 1 reply; 7+ messages in thread
From: Peter Zijlstra @ 2019-12-19 13:34 UTC (permalink / raw)
To: Thomas Garnier
Cc: kernel-hardening, kristen, keescook, Herbert Xu, David S. Miller,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, H. Peter Anvin,
x86, Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware,
Inc.,
Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
Will Deacon, Masami Hiramatsu, Jiri Slaby, Boris Ostrovsky,
Greg Kroah-Hartman, Alexios Zavras, Allison Randal, linux-crypto,
linux-kernel, virtualization, linux-pm
On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> Minor changes based on feedback and rebase from v9.
>
> Splitting the previous serie in two. This part contains assembly code
> changes required for PIE but without any direct dependencies with the
> rest of the patchset.
ISTR suggestion you add an objtool pass that verifies there are no
absolute text references left. Otherwise we'll forever be chasing that
last one..
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
@ 2019-12-19 16:35 ` Thomas Garnier
0 siblings, 0 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-19 16:35 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Kernel Hardening, Kristen Carlson Accardi, Kees Cook, Herbert Xu,
David S. Miller, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
H. Peter Anvin, the arch/x86 maintainers, Andy Lutomirski,
Juergen Gross, Thomas Hellstrom, VMware, Inc.,
Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
Will Deacon, Masami Hiramatsu, Jiri Slaby, Boris Ostrovsky,
Greg Kroah-Hartman, Alexios Zavras, Allison Randal,
Linux Crypto Mailing List, LKML, virtualization, Linux PM list
On Thu, Dec 19, 2019 at 5:35 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> > Minor changes based on feedback and rebase from v9.
> >
> > Splitting the previous serie in two. This part contains assembly code
> > changes required for PIE but without any direct dependencies with the
> > rest of the patchset.
>
> ISTR suggestion you add an objtool pass that verifies there are no
> absolute text references left. Otherwise we'll forever be chasing that
> last one..
Correct, I have a reference in the changelog saying I will tackle in
the next patchset because we still have non-pie references in other
places but the fix is a bit more complex (for exemple per-cpu) and not
included in this phase. I will add a better explanation in the next
message for patch v11.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
2019-12-05 0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
` (2 preceding siblings ...)
2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
@ 2019-12-24 13:03 ` Borislav Petkov
2019-12-30 18:52 ` Kees Cook
3 siblings, 1 reply; 7+ messages in thread
From: Borislav Petkov @ 2019-12-24 13:03 UTC (permalink / raw)
To: Thomas Garnier
Cc: kernel-hardening, kristen, keescook, Herbert Xu, David S. Miller,
Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86,
Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware, Inc.,
Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
Peter Zijlstra, Will Deacon, Masami Hiramatsu, Jiri Slaby,
Boris Ostrovsky, Greg Kroah-Hartman, Alexios Zavras,
Allison Randal, linux-crypto, linux-kernel, virtualization,
linux-pm
On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> Minor changes based on feedback and rebase from v9.
>
> Splitting the previous serie in two. This part contains assembly code
> changes required for PIE but without any direct dependencies with the
> rest of the patchset.
Ok, modulo the minor commit message and comments fixup, this looks ok
and passes testing here.
I'm going to queue patches 2-11 of the next version unless someone
complains.
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
2019-12-24 13:03 ` Borislav Petkov
@ 2019-12-30 18:52 ` Kees Cook
0 siblings, 0 replies; 7+ messages in thread
From: Kees Cook @ 2019-12-30 18:52 UTC (permalink / raw)
To: Borislav Petkov
Cc: Thomas Garnier, kernel-hardening, kristen, Herbert Xu,
David S. Miller, Thomas Gleixner, Ingo Molnar, H. Peter Anvin,
x86, Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware,
Inc.,
Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
Peter Zijlstra, Will Deacon, Masami Hiramatsu, Jiri Slaby,
Boris Ostrovsky, Greg Kroah-Hartman, Alexios Zavras,
Allison Randal, linux-crypto, linux-kernel, virtualization,
linux-pm
On Tue, Dec 24, 2019 at 02:03:10PM +0100, Borislav Petkov wrote:
> On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> > Minor changes based on feedback and rebase from v9.
> >
> > Splitting the previous serie in two. This part contains assembly code
> > changes required for PIE but without any direct dependencies with the
> > rest of the patchset.
>
> Ok, modulo the minor commit message and comments fixup, this looks ok
> and passes testing here.
>
> I'm going to queue patches 2-11 of the next version unless someone
> complains.
Great! Thanks very much for the reviews. :)
--
Kees Cook
^ permalink raw reply [flat|nested] 7+ messages in thread