Re: [PATCH 3/3] x86_64: Use relative per-cpu offsets

From: "Andy Lutomirski" <luto@kernel.org>
To: "Brian Gerst" <brgerst@gmail.com>,
	"Peter Zijlstra (Intel)" <peterz@infradead.org>
Cc: "Linux Kernel Mailing List" <linux-kernel@vger.kernel.org>,
	"the arch/x86 maintainers" <x86@kernel.org>,
	"Borislav Petkov" <bp@alien8.de>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"H. Peter Anvin" <hpa@zytor.com>,
	"Ingo Molnar" <mingo@kernel.org>
Subject: Re: [PATCH 3/3] x86_64: Use relative per-cpu offsets
Date: Mon, 15 Nov 2021 10:12:28 -0800	[thread overview]
Message-ID: <712750e7-a00a-4573-8864-0c07286289e3@www.fastmail.com> (raw)
In-Reply-To: <CAMzpN2jWs8heND7PydKw9CCZ0cjvJgxLMwXXQj45rwR6twpJLw@mail.gmail.com>

On Sun, Nov 14, 2021, at 10:29 AM, Brian Gerst wrote:
> On Sun, Nov 14, 2021 at 6:03 AM Peter Zijlstra <peterz@infradead.org> wrote:
>>
>> On Sat, Nov 13, 2021 at 11:54:19PM -0500, Brian Gerst wrote:
>> > On Sat, Nov 13, 2021 at 8:18 PM Andy Lutomirski <luto@kernel.org> wrote:
>> > >
>> > >
>> > >
>> > > On Sat, Nov 13, 2021, at 4:40 AM, Brian Gerst wrote:
>> > > > The per-cpu section is currently linked at virtual address 0, because
>> > > > older compilers hardcoded the stack protector canary value at a fixed
>> > > > offset from the start of the GS segment.  Use a standard relative offset
>> > > > as the GS base when the stack protector is disabled, or a newer compiler
>> > > > is used that supports a configurable location for the stack canary.
>> > >
>> > > Can you explain the benefit?  Also, I think we should consider dropping support for the fixed model like we did on x86_32.
>> >
>> > This patch probably makes more sense if we drop the fixed model, as
>> > that gets rid of alot of code that works around having to link the
>> > percpu section differently.
>>
>> Can someone spell out these benefits please? To me having per-cpu start
>> at 0 makes perfect sense, how does not having that make things better?
>
> The best reason is that the percpu section is currently not subject to
> KASLR.  It actually needs extra support to counter the effects of
> relocation.  There have also been a number of linker bugs over the
> years that have had to be worked around.
>
> If we were to decide to drop the fixed stack protector the diffstat
> would look something like:
>
>  arch/x86/Makefile                         |  19 ++--
>  arch/x86/boot/compressed/misc.c           |  12 ---
>  arch/x86/entry/entry_64.S                 |   2 +-
>  arch/x86/include/asm/percpu.h             |  22 -----
>  arch/x86/include/asm/processor.h          |  24 ++---
>  arch/x86/include/asm/stackprotector.h     |  13 +--
>  arch/x86/kernel/asm-offsets_64.c          |   6 --
>  arch/x86/kernel/cpu/common.c              |   8 +-
>  arch/x86/kernel/head_64.S                 |  11 ++-
>  arch/x86/kernel/irq_64.c                  |   1 -
>  arch/x86/kernel/vmlinux.lds.S             |  33 -------
>  arch/x86/tools/relocs.c                   | 143 +-----------------------------
>  arch/x86/xen/xen-head.S                   |  10 +--
>  scripts/gcc-x86_64-has-stack-protector.sh |   2 +-
>  14 files changed, 35 insertions(+), 271 deletions(-)
>

Ack.  We did this for 32-bit and got few complaints. Let’s finish the job.

> --
> Brian Gerst