From patchwork Fri Apr 28 09:51:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hou Wenlong X-Patchwork-Id: 88581 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp831486vqo; Fri, 28 Apr 2023 03:33:47 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4MP6/9apxnqDGc8tDaXEd3hZrD6v4YGzZiSE2VFzLMctEpxB/YmXGz19wPC4DhhHAUGi/T X-Received: by 2002:a17:90a:c784:b0:247:ad6d:7250 with SMTP id gn4-20020a17090ac78400b00247ad6d7250mr5454331pjb.12.1682678027574; Fri, 28 Apr 2023 03:33:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1682678027; cv=none; d=google.com; s=arc-20160816; b=z+5Lp1T13W/pPfMfJ/e/RNiRrfjqTiqf5lMf6hYKSo1HgBSnYknEGIvgHUZwtPinJe FAQieQW3egkSgI2Xj8VMn8kwTz1opMhkM0sb/sBRnwTtKqngdV9UhafG6Mt1ezcGG5Me yibaAtvq6wugboE+gfhe8OoYz4Meb5XjDOFTW4uUow/5rUUAEXq3pIF/GvuiSKQyQ7gi l1NObBLKtgkbPgwylKvID8ZrpHha108A7y8o8sw8flxwAtvIHqVr4p6gNuBwmxUeKpyX CUN20WDlH8A/7u3wvOV0WF8sv1033sToL/V5EPaljS4m+/33qqLo5fWDIaiPF8oinuk9 QTeQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=8uL7qWf2/CofPtO601NpRkHQpK+TfnNLzMU6Q3ngR4k=; b=a5y3AG+MtWQsbQeCOYrTIRciO3z3VNNJ0UCe0uTfS9uRaiEJBU6fjriYlMAwObEzr1 hS0vRq3tnQx3KsTT6mH94YJWza7pcEn8D79Bk8VEEikhBmlFCzFs5fgPGK5cyJDQG/JZ 7ygCXTqsunr7KD3P13CwF4UBi/EPHlb6UVeKUoBYP5z3BJQnq4QwMTgbmXw0B40LB19H qmxHlWf48CCqRKo4a0uITVf6yg8Mz4Nd0MJDyL+0nbIc+2aQ89oLlFyAltHc5EmS9aRx qLAbDuZpNHs4pHaYi2/GcHBiu16C3+eQtSwaV3HQTtsURHO0ffOPb+WiMahJp3hTQHfp BX4A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=antgroup.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id nn17-20020a17090b38d100b002478bba4da2si1956618pjb.127.2023.04.28.03.33.34; Fri, 28 Apr 2023 03:33:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=antgroup.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230341AbjD1KCg (ORCPT + 99 others); Fri, 28 Apr 2023 06:02:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44264 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346049AbjD1KCP (ORCPT ); Fri, 28 Apr 2023 06:02:15 -0400 Received: from out0-212.mail.aliyun.com (out0-212.mail.aliyun.com [140.205.0.212]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60E9B5FEA for ; Fri, 28 Apr 2023 03:02:04 -0700 (PDT) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R981e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018047213;MF=houwenlong.hwl@antgroup.com;NM=1;PH=DS;RN=11;SR=0;TI=SMTPD_---.STCEPrW_1682675622; Received: from localhost(mailfrom:houwenlong.hwl@antgroup.com fp:SMTPD_---.STCEPrW_1682675622) by smtp.aliyun-inc.com; Fri, 28 Apr 2023 17:53:43 +0800 From: "Hou Wenlong" To: linux-kernel@vger.kernel.org Cc: "Thomas Garnier" , "Lai Jiangshan" , "Kees Cook" , "Hou Wenlong" , "Thomas Gleixner" , "Ingo Molnar" , "Borislav Petkov" , "Dave Hansen" , , "H. Peter Anvin" Subject: [PATCH RFC 35/43] x86/pie: Build the kernel as PIE Date: Fri, 28 Apr 2023 17:51:15 +0800 Message-Id: X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1764415795182538599?= X-GMAIL-MSGID: =?utf-8?q?1764415795182538599?= The kernel is currently build with mcmode=kernel option which forces it to stay on the top 2G of the virtual address space. For PIE, use -fPIE option to build the kernel as a Position Independent Executable (PIE), which uses RIP-relative addressing and could be able to move below the top 2G. The --emit-relocs linker option was kept instead of using -pie to limit the impact on mapped sections. Any incompatible relocation will be catch by the objtool at compile time. Suggested-by: Lai Jiangshan Signed-off-by: Hou Wenlong Cc: Thomas Garnier Cc: Kees Cook --- arch/x86/Kconfig | 8 ++++++-- arch/x86/Makefile | 9 +++++++-- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 5ac5f335855e..9f8020991184 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2222,10 +2222,14 @@ config RELOCATABLE (CONFIG_PHYSICAL_START) is used as the minimum location. config X86_PIE - def_bool n - depends on X86_64 + bool "Build a PIE kernel" + default n + depends on X86_64 && !XEN select OBJTOOL if HAVE_OBJTOOL select DYNAMIC_FTRACE if FUNCTION_TRACER && RETPOLINE + help + This builds a PIE kernel image that could be put at any + virtual address. config RANDOMIZE_BASE bool "Randomize the address of the kernel image (KASLR)" diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 81500011396d..6631974e2003 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -160,10 +160,15 @@ else KBUILD_CFLAGS += -mno-red-zone ifdef CONFIG_X86_PIE - PIE_CFLAGS := -include $(srctree)/include/linux/hidden.h + PIE_CFLAGS := -fPIE -include $(srctree)/include/linux/hidden.h KBUILD_CFLAGS += $(PIE_CFLAGS) -endif + # Relax relocation in both CFLAGS and LDFLAGS to support older compilers + KBUILD_CFLAGS += $(call cc-option,-Wa$(comma)-mrelax-relocations=no) + LDFLAGS_vmlinux += $(call ld-option,--no-relax) + KBUILD_LDFLAGS_MODULE += $(call ld-option,--no-relax) +else KBUILD_CFLAGS += -mcmodel=kernel +endif KBUILD_RUSTFLAGS += -Cno-redzone=y KBUILD_RUSTFLAGS += -Ccode-model=kernel