From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78A69394E91 for ; Mon, 20 Jul 2026 19:13:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784574797; cv=none; b=r51fFuYckW8FnfpNlyUL9F4rbGFAT77ra8S370mIBZ0nhTCewV0uYuMV7zLi/phNWlMY6v27UuIFMvdO+cCiWyxQV0dHQt5hRUFlxGDRxk4i2vRUWI0EsxBAD2cRHMpFBVYf12lzF1cEHGLbUCe/zcx013wcojU4qfA5afsy7co= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784574797; c=relaxed/simple; bh=N3MHexzpZGb34a2VrVrJbevD3q35nOnf2KzdfaFS0mc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZfqXZ/wo1ruyJHURlJDmCCTzwjXbhld+2t1HshDoK1z5OK0SaGyomDwbiFthYVWDvtbpWspWqQyUa1QosZhkfb2kGvJ/20y6/ckGewka+g7UwpqgFD2AWSZeVm2CQxJ82AoCRmjOXpGZ6VH7vUJmjaxU578cGxknOXA7X5Yvfss= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=yjn-systems.com; spf=none smtp.mailfrom=yjn-systems.com; dkim=pass (2048-bit key) header.d=yjn-systems.com header.i=@yjn-systems.com header.b=gbSiG6V8; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=yjn-systems.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=yjn-systems.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yjn-systems.com header.i=@yjn-systems.com header.b="gbSiG6V8" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4921eed3fa2so80053855e9.0 for ; Mon, 20 Jul 2026 12:13:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yjn-systems.com; s=google; t=1784574792; x=1785179592; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ke8s+Qt7PFdWHYg6VNVwDsTCuUnKvOxYTBtLz7+F8fI=; b=gbSiG6V8wd8tAb+DijDe6ZurzcOOLbLOcG68VjApf7xOO0GLc173XaPJjkXdlgpgvP tcAk6RFQNG5KKOev4xS1ZFY9wb0VuT0qbh79Z2VcicOhDeRJTvuVqtYxYzhLWiFUUmuy 4Rigx5MIYmIgtieTeXN/5smaR25lPv5As2aU2ZoGS7IAswacFgK90CuoXq7m6hdC5/nO ni8fx3PNto/JwUC1Kg2pWS/e2oKySoVaF5W2Mt8SCSdJYnDHGpkBIpt3na34LDrYNW/y kIdiEMalbuDOO5cBWMzyOupZTWCgErWqvAqtHtsNzoN4hnm8pnd6AngzQvM+JCCb6JI0 3Fsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784574792; x=1785179592; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ke8s+Qt7PFdWHYg6VNVwDsTCuUnKvOxYTBtLz7+F8fI=; b=Fxs5oX5qspTJultceI+FI9KcinWfwRf9vvgtE5t02S+lVXSsC25S1dZSYn0lVMIZlE 3UM2RnSfRnS6rBG5d+AFz/1Rn9tMVuei/Pv8RIro2eo7qbiaszPWVh+jE6LcrlVQEOTC B/DWcEQfJygMttwIiJWUxD7IhknD9Uo0kz4Efu9pmiU4U4GwUukty3Xjob3SsPHREixp GPGaH4FOmXtpE4cYOQl5G19XnwLunu1F7Atwe32kdeV5B+k4hZ1M8QKWVdvCXt9EkQgE lSaxVbqoJbaeungsGRI5meR7tAI/JWE+oo2dbt0xka8XNi2zTQZWV6ygm0J9T3AyVPHU x4Hg== X-Gm-Message-State: AOJu0Yx1+oUBWXzDuBwroLfmk+os/FRcEnD1saYGvM/rf69251xAD0Ah 5hdqYNl2lvZofmKFxRkHLd5bLEXEBNKOy56CRZ7Q9yoRPx+ODLzllOmk/BCNFUoWuL/8 X-Gm-Gg: AfdE7cnmbpUI6SmmIj6lHZ0RpTQT2rEzy/FR1Zu1SCzUnavCWelOBSFDsEQYQJFIIYA gq8+X24FMN6DuQunn3lKnVGNHAeM+yr3PvnHoR/M7VklJmvMKL39eJk2lLH99UMZthB1dXnHdjE nfSAO/5AGMin278kGk7tiNm8z8Q2W1zHP44POXlYxc1OXv87ykYpc0Kg1tXXJTQURuyV8VDsnAp v8I1zUoFd7JpznzzEcMsQBxhjOkGsWdzxchoJAQ1eewhI/Hk8t3pFH2d987EYC7ts8eJI7OqGpG QHYwMMDph3yKCWWqcpq7NeAHKflP40s2YpY8nMmJ63bE+VF/xRGN9krfLDE659nE6GVi39+9NMa DjnuQWsCYIFjrJ1c4jsZrVbPmMXAbIJQoZWm5AIAGL4iltYuCjkVM28EBlrzfa2+VHAOE8mGwCH XcYjh0Fp0IvHrYqGdtcW6BgxHzBK9og7oTnzbK15gTLeaStaapLBJYgoen/uEFgdGGpF8x2jH15 d96YduI7jtdyCJnEdo= X-Received: by 2002:a05:600c:c10c:b0:495:56d4:3077 with SMTP id 5b1f17b1804b1-49556d432b4mr120347025e9.17.1784574792592; Mon, 20 Jul 2026 12:13:12 -0700 (PDT) Received: from yjn-Zenbook-UX3404VA-UX3404VA.. (p200300dcbf448c00c9c364f8ed993120.dip0.t-ipconnect.de. [2003:dc:bf44:8c00:c9c3:64f8:ed99:3120]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4956547323bsm8754025e9.4.2026.07.20.12.13.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 12:13:12 -0700 (PDT) From: York Jasper Niebuhr To: linux-hardening@vger.kernel.org Cc: linux-kernel@vger.kernel.org, kees@kernel.org, franzen@sec.in.tum.de, ardb@kernel.org Subject: [RFC v3 3/5] SPSLR build integration Date: Mon, 20 Jul 2026 21:13:11 +0200 Message-ID: <20260720191311.21619-1-yjn@yjn-systems.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260720191146.21473-1-yjn@yjn-systems.com> References: <20260720191146.21473-1-yjn@yjn-systems.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Signed-off-by: York Jasper Niebuhr --- arch/x86/boot/startup/Makefile | 4 ++++ arch/x86/entry/vdso/common/Makefile.include | 2 +- arch/x86/kernel/vmlinux.lds.S | 23 +++++++++++++++++++ init/Kconfig | 13 +++++++++++ scripts/module.lds.S | 25 +++++++++++++++++++++ 5 files changed, 66 insertions(+), 1 deletion(-) diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile index 5e499cfb29b5..1fa601781546 100644 --- a/arch/x86/boot/startup/Makefile +++ b/arch/x86/boot/startup/Makefile @@ -12,6 +12,10 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS -mcmodel=small -fPIC \ # disable ftrace hooks and LTO KBUILD_CFLAGS := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_LTO),$(KBUILD_CFLAGS)) + +# Startup code executes before Bootpatch-SLR applies its runtime patches. +KBUILD_CFLAGS := $(filter-out $(PINPOINT_PLUGIN_CFLAGS),$(KBUILD_CFLAGS)) + KASAN_SANITIZE := n KCSAN_SANITIZE := n KMSAN_SANITIZE := n diff --git a/arch/x86/entry/vdso/common/Makefile.include b/arch/x86/entry/vdso/common/Makefile.include index 687b3d89b40d..d8cc53cd9560 100644 --- a/arch/x86/entry/vdso/common/Makefile.include +++ b/arch/x86/entry/vdso/common/Makefile.include @@ -27,7 +27,7 @@ flags-remove-y += \ -mfentry -pg \ $(RANDSTRUCT_CFLAGS) $(GCC_PLUGINS_CFLAGS) $(KSTACK_ERASE_CFLAGS) \ $(RETPOLINE_CFLAGS) $(CC_FLAGS_LTO) $(CC_FLAGS_CFI) \ - $(PADDING_CFLAGS) + $(PADDING_CFLAGS) $(PINPOINT_PLUGIN_CFLAGS) # # Don't omit frame pointers for ease of userspace debugging, but do diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 74e336d7f9dd..aa71c2c2a756 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -200,6 +200,29 @@ SECTIONS /* rarely changed data like cpu maps */ READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES) +#ifdef CONFIG_SPSLR + __spslr_start = .; + + . = ALIGN(8); + __start_spslr_units = .; + KEEP(*(spslr_units)) + __stop_spslr_units = .; + + . = ALIGN(8); + __start_spslr_targets = .; + KEEP(*(spslr_targets)) + __stop_spslr_targets = .; + + . = ALIGN(8); + KEEP(*(spslr_target_layouts)) + KEEP(*(spslr_cu_target_refs)) + KEEP(*(spslr_ipins)) + KEEP(*(spslr_dpins)) + KEEP(*(spslr_strtab)) + + __spslr_end = .; +#endif + /* End of data section */ _edata = .; } :data diff --git a/init/Kconfig b/init/Kconfig index 5230d4879b1c..2110aff8a5c8 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -2316,3 +2316,16 @@ config ARCH_HAS_SYNC_CORE_BEFORE_USERMODE # . config ARCH_HAS_SYSCALL_WRAPPER def_bool n + +config SPSLR + bool "Selfpatch SLR prototype" + depends on X86_64 + depends on CC_IS_GCC + help + Experimental structure layout randomization prototype. + +config SANEMAKER + bool "Selfpatch SLR validation tooling" + depends on SPSLR + help + Experimental validation tooling for Selfpatch-SLR. diff --git a/scripts/module.lds.S b/scripts/module.lds.S index b62683061d79..e366be317115 100644 --- a/scripts/module.lds.S +++ b/scripts/module.lds.S @@ -62,6 +62,31 @@ SECTIONS { } MOD_SEPARATE_CODETAG_SECTIONS() + +#ifdef CONFIG_SPSLR + .spslr : ALIGN(8) { + __spslr_start = .; + + . = ALIGN(8); + __start_spslr_units = .; + KEEP(*(spslr_units)) + __stop_spslr_units = .; + + . = ALIGN(8); + __start_spslr_targets = .; + KEEP(*(spslr_targets)) + __stop_spslr_targets = .; + + . = ALIGN(8); + KEEP(*(spslr_target_layouts)) + KEEP(*(spslr_cu_target_refs)) + KEEP(*(spslr_ipins)) + KEEP(*(spslr_dpins)) + KEEP(*(spslr_strtab)) + + __spslr_end = .; + } +#endif } /* bring in arch-specific sections */ -- 2.43.0