From patchwork Mon Jan 22 09:08:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 189986 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:2bc4:b0:101:a8e8:374 with SMTP id hx4csp2453351dyb; Mon, 22 Jan 2024 01:14:17 -0800 (PST) X-Google-Smtp-Source: AGHT+IEGtL1yO3LHKvwnD0HFmY9wYkphuDgW9e9h5pE+l5xmB8vnE8i3PCSy36TOyWtftwo2rpy3 X-Received: by 2002:a05:6214:c2a:b0:685:3e78:8723 with SMTP id a10-20020a0562140c2a00b006853e788723mr1463435qvd.28.1705914856975; Mon, 22 Jan 2024 01:14:16 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1705914856; cv=pass; d=google.com; s=arc-20160816; b=a0PRfd7fyT3xluRHlDkAJ4YY19suA2Va+bSooEipwuFCaIYUAG6pVQcHi/j0LJgKLg ES/HvxH21sKU7QLErvcw3RkPRISxLg2R0AFT7mQLSRuuTcANATtpfuBGbZdre3fNU+Nd fwx+yukkbsUTcgQDS6w5SL9+AV+xAlnfKWjLiiAT3ko75zbR09U1NRWp5gtG23NmxA70 /sc0NURWC/fh2U4pKtTN7chxsKXCZoG+HpxnNJVZ679vPBaDDQBdtkHe4pfq9MHFkG+b /s70PR0nRr1SdDDjqz+gIXkaE+ifa+7ZAQzx1Crq/oFSWVs4XEVdf8dr1c5rY4L9sEbb 1t5A== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:from:subject:message-id:references:mime-version :list-unsubscribe:list-subscribe:list-id:precedence:in-reply-to:date :dkim-signature; bh=V3ieii7F07e2BhjymXZdDcuN6ywdVvzt+lwy6/7RWUY=; fh=48HUvOMbKpeHraf1klkRburnyvYvg0IkDo40jTOEaFs=; b=iJQiSpIroUYlGL3pg74bo3c8eUEn0cWc+8WxT9UjEdYRfbDrxa8i3YsGozGS7J6xH1 ppn21oFR0f+T781iUsATw6jIrvZYXCiWMhEtjL3+k5fV8aq13lRdF7HVOEyf4qlQuoh1 a7ddl1IDGgzyD8jKtrRo4pw6JmtIe8OPns1CZeFUpQaBcNWKL8JlusMl2Un/B/jAPt4S 2GKMin4JQDbZPGrDV2J5m4GFb7E11AonNDR0HS1TOe2YfiOPR9UPUx2uRa7xBIkTSEWI afSTAntcGQTEEDfgqolwLTiPgqwcL6cwIcfdhVffGik2vBZpcKp+muYOgtMys9TDmR99 s+Mg== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=GYrGHRpr; arc=pass (i=1 spf=pass spfdomain=flex--ardb.bounces.google.com dkim=pass dkdomain=google.com dmarc=pass fromdomain=google.com); spf=pass (google.com: domain of linux-kernel+bounces-32603-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-32603-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id x26-20020a0cb21a000000b0067a90d3023esi5383987qvd.279.2024.01.22.01.14.16 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jan 2024 01:14:16 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-32603-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=GYrGHRpr; arc=pass (i=1 spf=pass spfdomain=flex--ardb.bounces.google.com dkim=pass dkdomain=google.com dmarc=pass fromdomain=google.com); spf=pass (google.com: domain of linux-kernel+bounces-32603-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-32603-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id B36E41C241D7 for ; Mon, 22 Jan 2024 09:14:16 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 7CD7C3A264; Mon, 22 Jan 2024 09:13:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="GYrGHRpr" Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB1763A1AF for ; Mon, 22 Jan 2024 09:12:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705914777; cv=none; b=HjPne+aV0GbHSrWv8cyFJKMBBZiCg7kZKb+aGcvh6LC+xZ4Wv4Df3qN46TD7EG3IUvjpbkRDpLmWPZMYE4BppSA4bPRzF29wOAM7EcH9nX0NytzSTd4wfzdOtxuo+FkayA9pCK8Yu7crE5fftnXpAuu8oux9W6j8QnZOqlnQ9VA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705914777; c=relaxed/simple; bh=WtGP1AHer5Q1wc5J6xuAlLFLTWrN4iBoK96MPonlw1U=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=WMHI7VHDS92cLdTf4VJaX4rAPRPduN3ZpbXjbGXK33fKdudM1bTdL2zt3P7EWlU8zxwPjouQVcHXj3PTlK4tVjDzwmesNBCpb3VvxDL97WAXKYykH5TdMnqmZOMKrlFetHn/1wY3fDxtFwvfapIU/wnlFatZUlwlIZcn/5nein8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ardb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=GYrGHRpr; arc=none smtp.client-ip=209.85.219.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ardb.bounces.google.com Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-dc24de01bd9so4937125276.1 for ; Mon, 22 Jan 2024 01:12:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1705914774; x=1706519574; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=V3ieii7F07e2BhjymXZdDcuN6ywdVvzt+lwy6/7RWUY=; b=GYrGHRpru70Fhxxy4VqdIM5MQbC1HdF20WX5HCHqnCI/tUIqzbAd4Khyy2U9uhhu1b WVJHpV8fIoPsEA1nEZVl2tkeNFkCtyxWEeRDryV74jEBnITYAr1eH9YnNuRSS59S43zk sZ5ePivZYEhvRtzrElRqCIoVT17mMZOLEHB84l8+Y/xtUNIZMKrW1OIbB53rEvxe3nhw CiP2iVenVt042QIZYIU0Q4IjVde+a5ceoDhslP+AxIbZJZssR3tf9Saat/z3hv9fX0Mc I9JVIeAl9lhm5X0jLJsrVtoxhSWRZQuJ86e8ba1LVlFrcauhTtPOcQI6LlETLea1kHjC 0idw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705914774; x=1706519574; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=V3ieii7F07e2BhjymXZdDcuN6ywdVvzt+lwy6/7RWUY=; b=vDQaNrhldq3DTX/4BziVYiL3c/d+/wloRZluj0cCuXEtXtiP+RmRrNew2OGx60Mt0q lyLtq2g2DGENo60hOOtVe9mb2eN0NdQ73sc1SArHflm3bDIqx1j/L/o6XMEDyGnNxfRF lfb5OVBgrLWVzouSBmdLVsRFitjLUy9TvN7SAk7l00vG5UpGvQw52/NUXdsZpcEdZz8P nMT3YR60epqy4Wl8LozsG83wTEgCKsR+WQOELiLwK1GLanHPkzUPui3Xu+encqF4dU2A Nl/xwyopcE9/CQTy5xzzZ7L3hxwOuS3FfQJKfmBGWNgfIa6FmFO06kgsaX10r+w0kavm 70nQ== X-Gm-Message-State: AOJu0YwqfwqOxDDJPbRMfpxiNIzrjMKGp3JoCk1ZXq5SMCZEMLRUYQhp Xbl9kbz6ALvgsOp0D79f7ZF/tS+XiNEObkYfNODphIzwx2BCuxcH7C0itYL7rHJ/4MMkcCDYPRJ BpeCF5QEjjFxtJRWfjY+JXJC9o1vksynUXu55VXLwmXTL3kiPqa26YVOJUg3tQVqUiH0I9xji6Q eFAQ4Y7583cz7BkeNrYXqEC//GRrCZTw== X-Received: from palermo.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:118a]) (user=ardb job=sendgmr) by 2002:a05:6902:1005:b0:dc2:5525:f6b with SMTP id w5-20020a056902100500b00dc255250f6bmr1879931ybt.7.1705914774527; Mon, 22 Jan 2024 01:12:54 -0800 (PST) Date: Mon, 22 Jan 2024 10:08:57 +0100 In-Reply-To: <20240122090851.851120-7-ardb+git@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240122090851.851120-7-ardb+git@google.com> X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-Developer-Signature: v=1; a=openpgp-sha256; l=4335; i=ardb@kernel.org; h=from:subject; bh=NM5aMdSXYlJ+boACvwGHARd4V6ELPnCOafub2dfrC3k=; b=owGbwMvMwCFmkMcZplerG8N4Wi2JIXWdwcq/f7QuR0w79JI76/onzQcqrKlfdTWq06uW7lKdI 7BeiHlnRykLgxgHg6yYIovA7L/vdp6eKFXrPEsWZg4rE8gQBi5OAZjIViZGhmuyC5eIZNR1xF4U +3hyvreGQ1XbpJCYhxeT1FJqs3/c+c3I8P/dL1X2K5ffWd5sXvTUkT/RfkWV3oyZaw7yf/GWsxF 4zwgA X-Mailer: git-send-email 2.43.0.429.g432eaa2c6b-goog Message-ID: <20240122090851.851120-12-ardb+git@google.com> Subject: [RFC PATCH 5/5] x86: Build the core kernel with position independent codegen From: Ard Biesheuvel To: linux-kernel@vger.kernel.org Cc: Ard Biesheuvel , Kevin Loughlin , Tom Lendacky , Dionna Glaze , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , Andy Lutomirski , Arnd Bergmann , Martin KaFai Lau , Nathan Chancellor , Nick Desaulniers , Justin Stitt , linux-arch@vger.kernel.org, bpf@vger.kernel.org, llvm@lists.linux.dev X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1788781376563681307 X-GMAIL-MSGID: 1788781376563681307 From: Ard Biesheuvel Pass the -fpie flag to the compiler when building objects that are intended for the core kernel. This ensures that all implicit symbol references are emitted using RIP-relative relocations, allowing the code to be executed correctly even if it runs from a different virtual address than the address it was linked/loaded/relocated to run at. This is necessary to ensure that all C code that gets pulled in by the early startup code runs correctly without the need for unpalatable hacks in the code to force RIP-relative references. Signed-off-by: Ard Biesheuvel --- arch/x86/Makefile | 7 +++++-- arch/x86/entry/vdso/Makefile | 2 +- arch/x86/kernel/Makefile | 4 ---- arch/x86/realmode/rm/Makefile | 1 + include/asm-generic/vmlinux.lds.h | 2 ++ 5 files changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/Makefile b/arch/x86/Makefile index bed0850d91b0..0382a9534099 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -165,11 +165,13 @@ else KBUILD_RUSTFLAGS += $(rustflags-y) KBUILD_CFLAGS += -mno-red-zone - KBUILD_CFLAGS += -mcmodel=kernel + KBUILD_CFLAGS_MODULE += -mcmodel=kernel KBUILD_RUSTFLAGS += -Cno-redzone=y - KBUILD_RUSTFLAGS += -Ccode-model=kernel + KBUILD_RUSTFLAGS_KERNEL += -Ccode-model=small + KBUILD_RUSTFLAGS_MODULE += -Ccode-model=kernel PIE_CFLAGS := -fpie -mcmodel=small \ + $(call cc-option,-Wa$(comma)-mrelax-relocations=no) \ -include $(srctree)/include/linux/hidden.h ifeq ($(CONFIG_STACKPROTECTOR),y) @@ -178,6 +180,7 @@ else endif endif + KBUILD_CFLAGS_KERNEL += $(PIE_CFLAGS) export PIE_CFLAGS endif diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile index b1b8dd1608f7..e2c79d4c1417 100644 --- a/arch/x86/entry/vdso/Makefile +++ b/arch/x86/entry/vdso/Makefile @@ -149,7 +149,7 @@ $(obj)/vdso32.so.dbg: KBUILD_AFLAGS = $(KBUILD_AFLAGS_32) $(obj)/vdso32.so.dbg: asflags-$(CONFIG_X86_64) += -m32 KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS)) -KBUILD_CFLAGS_32 := $(filter-out -mcmodel=kernel,$(KBUILD_CFLAGS_32)) +KBUILD_CFLAGS_32 := $(filter-out -mcmodel=small,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out -fno-pic,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out -mfentry,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out $(RANDSTRUCT_CFLAGS),$(KBUILD_CFLAGS_32)) diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index 65194ca79b5c..0000325ab98f 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -21,10 +21,6 @@ CFLAGS_REMOVE_sev.o = -pg CFLAGS_REMOVE_rethook.o = -pg endif -# head64.c contains C code that may execute from a different virtual address -# than it was linked at, so we always build it using PIE codegen -CFLAGS_head64.o += $(PIE_CFLAGS) - KASAN_SANITIZE_head$(BITS).o := n KASAN_SANITIZE_dumpstack.o := n KASAN_SANITIZE_dumpstack_$(BITS).o := n diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile index f614009d3e4e..fdb8e780f903 100644 --- a/arch/x86/realmode/rm/Makefile +++ b/arch/x86/realmode/rm/Makefile @@ -76,5 +76,6 @@ KBUILD_CFLAGS := $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \ -I$(srctree)/arch/x86/boot KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables +KBUILD_CFLAGS_KERNEL := $(filter-out $(PIE_CFLAGS),$(KBUILD_CFLAGS_KERNEL)) GCOV_PROFILE := n UBSAN_SANITIZE := n diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h index ef45331fb043..9518b87207e8 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -355,6 +355,7 @@ *(.data..decrypted) \ *(.ref.data) \ *(.data..shared_aligned) /* percpu related */ \ + *(.data.rel .data.rel.*) \ MEM_KEEP(init.data*) \ *(.data.unlikely) \ __start_once = .; \ @@ -477,6 +478,7 @@ .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \ __start_rodata = .; \ *(.rodata) *(.rodata.*) \ + *(.data.rel.ro*) \ SCHED_DATA \ RO_AFTER_INIT_DATA /* Read only after init */ \ . = ALIGN(8); \