Linux-PM Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
@ 2019-12-05  0:09 Thomas Garnier
  2019-12-05  0:09 ` [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support Thomas Garnier
                   ` (3 more replies)
  0 siblings, 4 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-05  0:09 UTC (permalink / raw)
  To: kernel-hardening
  Cc: kristen, keescook, Herbert Xu, David S. Miller, Thomas Gleixner,
	Ingo Molnar, Borislav Petkov, H. Peter Anvin, x86,
	Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware, Inc.,
	Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
	Thomas Garnier, Peter Zijlstra, Will Deacon, Masami Hiramatsu,
	Jiri Slaby, Boris Ostrovsky, Greg Kroah-Hartman, Alexios Zavras,
	Allison Randal, linux-crypto, linux-kernel, virtualization,
	linux-pm

Minor changes based on feedback and rebase from v9.

Splitting the previous serie in two. This part contains assembly code
changes required for PIE but without any direct dependencies with the
rest of the patchset.

Changes:
 - patch v10 (assembly):
   - Swap rax for rdx on entry/64 changes based on feedback.
   - Addressed feedback from Borislav Petkov on boot, paravirt, alternatives
     and globally.
   - Rebased the patchset and ensure it works with large kaslr (not included).
 - patch v9 (assembly):
   - Moved to relative reference for sync_core based on feedback.
   - x86/crypto had multiple algorithms deleted, removed PIE changes to them.
   - fix typo on comment end line.
 - patch v8 (assembly):
   - Fix issues in crypto changes (thanks to Eric Biggers).
   - Remove unnecessary jump table change.
   - Change author and signoff to chromium email address.
 - patch v7 (assembly):
   - Split patchset and reorder changes.
 - patch v6:
   - Rebase on latest changes in jump tables and crypto.
   - Fix wording on couple commits.
   - Revisit checkpatch warnings.
   - Moving to @chromium.org.
 - patch v5:
   - Adapt new crypto modules for PIE.
   - Improve per-cpu commit message.
   - Fix xen 32-bit build error with .quad.
   - Remove extra code for ftrace.
 - patch v4:
   - Simplify early boot by removing global variables.
   - Modify the mcount location script for __mcount_loc intead of the address
     read in the ftrace implementation.
   - Edit commit description to explain better where the kernel can be located.
   - Streamlined the testing done on each patch proposal. Always testing
     hibernation, suspend, ftrace and kprobe to ensure no regressions.
 - patch v3:
   - Update on message to describe longer term PIE goal.
   - Minor change on ftrace if condition.
   - Changed code using xchgq.
 - patch v2:
   - Adapt patch to work post KPTI and compiler changes
   - Redo all performance testing with latest configs and compilers
   - Simplify mov macro on PIE (MOVABS now)
   - Reduce GOT footprint
 - patch v1:
   - Simplify ftrace implementation.
   - Use gcc mstack-protector-guard-reg=%gs with PIE when possible.
 - rfc v3:
   - Use --emit-relocs instead of -pie to reduce dynamic relocation space on
     mapped memory. It also simplifies the relocation process.
   - Move the start the module section next to the kernel. Remove the need for
     -mcmodel=large on modules. Extends module space from 1 to 2G maximum.
   - Support for XEN PVH as 32-bit relocations can be ignored with
     --emit-relocs.
   - Support for GOT relocations previously done automatically with -pie.
   - Remove need for dynamic PLT in modules.
   - Support dymamic GOT for modules.
 - rfc v2:
   - Add support for global stack cookie while compiler default to fs without
     mcmodel=kernel
   - Change patch 7 to correctly jump out of the identity mapping on kexec load
     preserve.

These patches make some of the changes necessary to build the kernel as
Position Independent Executable (PIE) on x86_64. Another patchset will
add the PIE option and larger architecture changes. PIE allows the kernel to be
placed below the 0xffffffff80000000 increasing the range of KASLR.

The patches:
 - 1, 3-11: Change in assembly code to be PIE compliant.
 - 2: Add a new _ASM_MOVABS macro to fetch a symbol address generically.

diffstat:
 crypto/aegis128-aesni-asm.S         |    6 +-
 crypto/aesni-intel_asm.S            |    8 +--
 crypto/aesni-intel_avx-x86_64.S     |    3 -
 crypto/camellia-aesni-avx-asm_64.S  |   42 +++++++--------
 crypto/camellia-aesni-avx2-asm_64.S |   44 ++++++++--------
 crypto/camellia-x86_64-asm_64.S     |    8 +--
 crypto/cast5-avx-x86_64-asm_64.S    |   50 ++++++++++--------
 crypto/cast6-avx-x86_64-asm_64.S    |   44 +++++++++-------
 crypto/des3_ede-asm_64.S            |   96 ++++++++++++++++++++++++------------
 crypto/ghash-clmulni-intel_asm.S    |    4 -
 crypto/glue_helper-asm-avx.S        |    4 -
 crypto/glue_helper-asm-avx2.S       |    6 +-
 crypto/sha256-avx2-asm.S            |   18 ++++--
 entry/entry_64.S                    |   16 ++++--
 include/asm/alternative.h           |    6 +-
 include/asm/asm.h                   |    1 
 include/asm/paravirt_types.h        |   32 ++++++++++--
 include/asm/pm-trace.h              |    2 
 include/asm/processor.h             |    6 +-
 kernel/acpi/wakeup_64.S             |   31 ++++++-----
 kernel/head_64.S                    |   15 +++--
 kernel/relocate_kernel_64.S         |    2 
 power/hibernate_asm_64.S            |    4 -
 23 files changed, 267 insertions(+), 181 deletions(-)

Patchset is based on next-20191203.



^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support
  2019-12-05  0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
@ 2019-12-05  0:09 ` Thomas Garnier
  2019-12-05  0:09 ` [PATCH v10 09/11] x86/power/64: " Thomas Garnier
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-05  0:09 UTC (permalink / raw)
  To: kernel-hardening
  Cc: kristen, keescook, Thomas Garnier, Pavel Machek,
	Rafael J . Wysocki, Rafael J. Wysocki, Len Brown,
	Thomas Gleixner, Ingo Molnar, Borislav Petkov, H. Peter Anvin,
	x86, linux-pm, linux-kernel

Change the assembly code to use only relative references of symbols for the
kernel to be PIE compatible.

Position Independent Executable (PIE) support will allow to extend the
KASLR randomization range below 0xffffffff80000000.

Signed-off-by: Thomas Garnier <thgarnie@chromium.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
---
 arch/x86/kernel/acpi/wakeup_64.S | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/arch/x86/kernel/acpi/wakeup_64.S b/arch/x86/kernel/acpi/wakeup_64.S
index c8daa92f38dc..8e221285d9f1 100644
--- a/arch/x86/kernel/acpi/wakeup_64.S
+++ b/arch/x86/kernel/acpi/wakeup_64.S
@@ -15,7 +15,7 @@
 	 * Hooray, we are in Long 64-bit mode (but still running in low memory)
 	 */
 SYM_FUNC_START(wakeup_long64)
-	movq	saved_magic, %rax
+	movq	saved_magic(%rip), %rax
 	movq	$0x123456789abcdef0, %rdx
 	cmpq	%rdx, %rax
 	je	2f
@@ -31,14 +31,14 @@ SYM_FUNC_START(wakeup_long64)
 	movw	%ax, %es
 	movw	%ax, %fs
 	movw	%ax, %gs
-	movq	saved_rsp, %rsp
+	movq	saved_rsp(%rip), %rsp
 
-	movq	saved_rbx, %rbx
-	movq	saved_rdi, %rdi
-	movq	saved_rsi, %rsi
-	movq	saved_rbp, %rbp
+	movq	saved_rbx(%rip), %rbx
+	movq	saved_rdi(%rip), %rdi
+	movq	saved_rsi(%rip), %rsi
+	movq	saved_rbp(%rip), %rbp
 
-	movq	saved_rip, %rax
+	movq	saved_rip(%rip), %rax
 	jmp	*%rax
 SYM_FUNC_END(wakeup_long64)
 
@@ -48,7 +48,7 @@ SYM_FUNC_START(do_suspend_lowlevel)
 	xorl	%eax, %eax
 	call	save_processor_state
 
-	movq	$saved_context, %rax
+	leaq	saved_context(%rip), %rax
 	movq	%rsp, pt_regs_sp(%rax)
 	movq	%rbp, pt_regs_bp(%rax)
 	movq	%rsi, pt_regs_si(%rax)
@@ -67,13 +67,14 @@ SYM_FUNC_START(do_suspend_lowlevel)
 	pushfq
 	popq	pt_regs_flags(%rax)
 
-	movq	$.Lresume_point, saved_rip(%rip)
+	leaq	.Lresume_point(%rip), %rax
+	movq	%rax, saved_rip(%rip)
 
-	movq	%rsp, saved_rsp
-	movq	%rbp, saved_rbp
-	movq	%rbx, saved_rbx
-	movq	%rdi, saved_rdi
-	movq	%rsi, saved_rsi
+	movq	%rsp, saved_rsp(%rip)
+	movq	%rbp, saved_rbp(%rip)
+	movq	%rbx, saved_rbx(%rip)
+	movq	%rdi, saved_rdi(%rip)
+	movq	%rsi, saved_rsi(%rip)
 
 	addq	$8, %rsp
 	movl	$3, %edi
@@ -85,7 +86,7 @@ SYM_FUNC_START(do_suspend_lowlevel)
 	.align 4
 .Lresume_point:
 	/* We don't restore %rax, it must be 0 anyway */
-	movq	$saved_context, %rax
+	leaq	saved_context(%rip), %rax
 	movq	saved_context_cr4(%rax), %rbx
 	movq	%rbx, %cr4
 	movq	saved_context_cr3(%rax), %rbx
-- 
2.24.0.393.g34dc348eaf-goog


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH v10 09/11] x86/power/64: Adapt assembly for PIE support
  2019-12-05  0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
  2019-12-05  0:09 ` [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support Thomas Garnier
@ 2019-12-05  0:09 ` " Thomas Garnier
  2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
  2019-12-24 13:03 ` Borislav Petkov
  3 siblings, 0 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-05  0:09 UTC (permalink / raw)
  To: kernel-hardening
  Cc: kristen, keescook, Thomas Garnier, Pavel Machek,
	Rafael J . Wysocki, Rafael J. Wysocki, Thomas Gleixner,
	Ingo Molnar, Borislav Petkov, H. Peter Anvin, x86, linux-pm,
	linux-kernel

Change the assembly code to use only relative references of symbols for the
kernel to be PIE compatible.

Position Independent Executable (PIE) support will allow to extend the
KASLR randomization range below 0xffffffff80000000.

Signed-off-by: Thomas Garnier <thgarnie@chromium.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
---
 arch/x86/power/hibernate_asm_64.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
index 7918b8415f13..977b8ae85045 100644
--- a/arch/x86/power/hibernate_asm_64.S
+++ b/arch/x86/power/hibernate_asm_64.S
@@ -23,7 +23,7 @@
 #include <asm/frame.h>
 
 SYM_FUNC_START(swsusp_arch_suspend)
-	movq	$saved_context, %rax
+	leaq	saved_context(%rip), %rax
 	movq	%rsp, pt_regs_sp(%rax)
 	movq	%rbp, pt_regs_bp(%rax)
 	movq	%rsi, pt_regs_si(%rax)
@@ -116,7 +116,7 @@ SYM_FUNC_START(restore_registers)
 	movq	%rax, %cr4;  # turn PGE back on
 
 	/* We don't restore %rax, it must be 0 anyway */
-	movq	$saved_context, %rax
+	leaq	saved_context(%rip), %rax
 	movq	pt_regs_sp(%rax), %rsp
 	movq	pt_regs_bp(%rax), %rbp
 	movq	pt_regs_si(%rax), %rsi
-- 
2.24.0.393.g34dc348eaf-goog


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
  2019-12-05  0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
  2019-12-05  0:09 ` [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support Thomas Garnier
  2019-12-05  0:09 ` [PATCH v10 09/11] x86/power/64: " Thomas Garnier
@ 2019-12-19 13:34 ` Peter Zijlstra
  2019-12-19 16:35   ` Thomas Garnier
  2019-12-24 13:03 ` Borislav Petkov
  3 siblings, 1 reply; 7+ messages in thread
From: Peter Zijlstra @ 2019-12-19 13:34 UTC (permalink / raw)
  To: Thomas Garnier
  Cc: kernel-hardening, kristen, keescook, Herbert Xu, David S. Miller,
	Thomas Gleixner, Ingo Molnar, Borislav Petkov, H. Peter Anvin,
	x86, Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware,
	Inc.,
	Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
	Will Deacon, Masami Hiramatsu, Jiri Slaby, Boris Ostrovsky,
	Greg Kroah-Hartman, Alexios Zavras, Allison Randal, linux-crypto,
	linux-kernel, virtualization, linux-pm

On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> Minor changes based on feedback and rebase from v9.
> 
> Splitting the previous serie in two. This part contains assembly code
> changes required for PIE but without any direct dependencies with the
> rest of the patchset.

ISTR suggestion you add an objtool pass that verifies there are no
absolute text references left. Otherwise we'll forever be chasing that
last one..

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
  2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
@ 2019-12-19 16:35   ` Thomas Garnier
  0 siblings, 0 replies; 7+ messages in thread
From: Thomas Garnier @ 2019-12-19 16:35 UTC (permalink / raw)
  To: Peter Zijlstra
  Cc: Kernel Hardening, Kristen Carlson Accardi, Kees Cook, Herbert Xu,
	David S. Miller, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
	H. Peter Anvin, the arch/x86 maintainers, Andy Lutomirski,
	Juergen Gross, Thomas Hellstrom, VMware, Inc.,
	Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
	Will Deacon, Masami Hiramatsu, Jiri Slaby, Boris Ostrovsky,
	Greg Kroah-Hartman, Alexios Zavras, Allison Randal,
	Linux Crypto Mailing List, LKML, virtualization, Linux PM list

On Thu, Dec 19, 2019 at 5:35 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> > Minor changes based on feedback and rebase from v9.
> >
> > Splitting the previous serie in two. This part contains assembly code
> > changes required for PIE but without any direct dependencies with the
> > rest of the patchset.
>
> ISTR suggestion you add an objtool pass that verifies there are no
> absolute text references left. Otherwise we'll forever be chasing that
> last one..

Correct, I have a reference in the changelog saying I will tackle in
the next patchset because we still have non-pie references in other
places but the fix is a bit more complex (for exemple per-cpu) and not
included in this phase. I will add a better explanation in the next
message for patch v11.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
  2019-12-05  0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
                   ` (2 preceding siblings ...)
  2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
@ 2019-12-24 13:03 ` Borislav Petkov
  2019-12-30 18:52   ` Kees Cook
  3 siblings, 1 reply; 7+ messages in thread
From: Borislav Petkov @ 2019-12-24 13:03 UTC (permalink / raw)
  To: Thomas Garnier
  Cc: kernel-hardening, kristen, keescook, Herbert Xu, David S. Miller,
	Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86,
	Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware, Inc.,
	Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
	Peter Zijlstra, Will Deacon, Masami Hiramatsu, Jiri Slaby,
	Boris Ostrovsky, Greg Kroah-Hartman, Alexios Zavras,
	Allison Randal, linux-crypto, linux-kernel, virtualization,
	linux-pm

On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> Minor changes based on feedback and rebase from v9.
> 
> Splitting the previous serie in two. This part contains assembly code
> changes required for PIE but without any direct dependencies with the
> rest of the patchset.

Ok, modulo the minor commit message and comments fixup, this looks ok
and passes testing here.

I'm going to queue patches 2-11 of the next version unless someone
complains.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v10 00/11] x86: PIE support to extend KASLR randomization
  2019-12-24 13:03 ` Borislav Petkov
@ 2019-12-30 18:52   ` Kees Cook
  0 siblings, 0 replies; 7+ messages in thread
From: Kees Cook @ 2019-12-30 18:52 UTC (permalink / raw)
  To: Borislav Petkov
  Cc: Thomas Garnier, kernel-hardening, kristen, Herbert Xu,
	David S. Miller, Thomas Gleixner, Ingo Molnar, H. Peter Anvin,
	x86, Andy Lutomirski, Juergen Gross, Thomas Hellstrom, VMware,
	Inc.,
	Rafael J. Wysocki, Len Brown, Pavel Machek, Rasmus Villemoes,
	Peter Zijlstra, Will Deacon, Masami Hiramatsu, Jiri Slaby,
	Boris Ostrovsky, Greg Kroah-Hartman, Alexios Zavras,
	Allison Randal, linux-crypto, linux-kernel, virtualization,
	linux-pm

On Tue, Dec 24, 2019 at 02:03:10PM +0100, Borislav Petkov wrote:
> On Wed, Dec 04, 2019 at 04:09:37PM -0800, Thomas Garnier wrote:
> > Minor changes based on feedback and rebase from v9.
> > 
> > Splitting the previous serie in two. This part contains assembly code
> > changes required for PIE but without any direct dependencies with the
> > rest of the patchset.
> 
> Ok, modulo the minor commit message and comments fixup, this looks ok
> and passes testing here.
> 
> I'm going to queue patches 2-11 of the next version unless someone
> complains.

Great! Thanks very much for the reviews. :)

-- 
Kees Cook

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, back to index

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-05  0:09 [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Thomas Garnier
2019-12-05  0:09 ` [PATCH v10 07/11] x86/acpi: Adapt assembly for PIE support Thomas Garnier
2019-12-05  0:09 ` [PATCH v10 09/11] x86/power/64: " Thomas Garnier
2019-12-19 13:34 ` [PATCH v10 00/11] x86: PIE support to extend KASLR randomization Peter Zijlstra
2019-12-19 16:35   ` Thomas Garnier
2019-12-24 13:03 ` Borislav Petkov
2019-12-30 18:52   ` Kees Cook

Linux-PM Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-pm/0 linux-pm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-pm linux-pm/ https://lore.kernel.org/linux-pm \
		linux-pm@vger.kernel.org
	public-inbox-index linux-pm

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-pm


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git