WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sys/arch/amd64/conf/ld.script?h=jd%2Fqueueboosts 2020-02-19T16:55:04Z 2020-02-19T16:55:04Z kettenis kettenis@openbsd.org 2020-02-19T16:55:04Z urn:sha1:4cffaa08f4cca192545e7da30b8d78fc6cb884a8 direct map by using a properly aligned address. To prevent further confusion, remove __kernel_base_phys from the linker script and rename __kernel_end_phys into __kernel_phys_end. Hinted at by Maxime Villard. ok millert@, deraadt@, mpi@ 2019-11-09T20:07:00Z guenther guenther@openbsd.org 2019-11-09T20:07:00Z urn:sha1:f1bfbdc7b537769f7069d5c2a17f0d2a9a2ba41b and not just ".openbsd.randomdata.retguard". Accept both in the kernel ldscripts so that they're placed together between the __retguard_{start,end} symbols. Similarly, match not just ".openbsd.randomdata" but also ".openbsd.randomdata.*" to pick up other random (pun intended) items. While here, stub in those retguard bits into all the ldscripts. ok deraadt@ 2018-07-13T08:30:34Z sf sf@openbsd.org 2018-07-13T08:30:34Z urn:sha1:5f6ecb1939a610ea2cc43585708e659fc0834e52 This way, it is not available for use in ROP attacks. This diff puts the codepatching code into a separate section and unmaps that section after boot. In the future, the memory could potentially be reused but that would require larger changes. ok pguenther@ 2018-07-12T14:11:11Z guenther guenther@openbsd.org 2018-07-12T14:11:11Z urn:sha1:1fc8fad1ef00427ff55d700df3f3dfdb82455f63 traps so that the "mov %rax,%cr3" is followed by an infinite loop which is avoided because the mapping of the code being executed is changed. This means the sysretq/iretq isn't even present in that flow of instructions in the kernel mapping, so userspace code can't be speculatively reached on the kernel mapping and totally eliminates the conditional jump over the the %cr3 change that supported CPUs without the Meltdown vulnerability. The return paths were probably vulnerable to Spectre v1 (and v1.1/1.2) style attacks, speculatively executing user code post-system-call with the kernel mappings, thus creating cache/TLB/etc side-effects. Would like to apply this technique to the interrupt stubs too, but I'm hitting a bug in clang's assembler which misaligns the code and symbols. While here, when on a CPU not vulnerable to Meltdown, codepatch out the unnecessary bits in cpu_switchto(). Inspiration from sf@, refined over dinner with theo ok mlarkin@ deraadt@ 2018-06-18T05:43:20Z guenther guenther@openbsd.org 2018-06-18T05:43:20Z urn:sha1:29fcb0c62dd29201a8809a719ace3251cab51d36 for the physical start and end of that area too. Simplify the virtual->physical calculation across the entire ld.script ok mlarkin@ 2018-06-14T20:00:59Z guenther guenther@openbsd.org 2018-06-14T20:00:59Z urn:sha1:c2bc03ca4e79afec748c80915101c680fdc62834 .openbsd.randomdata output section with symbols around it so that hibernate+resume code can fix them up. tested by mlarkin@ WIP 2018-03-01T06:47:29Z deraadt deraadt@openbsd.org 2018-03-01T06:47:29Z urn:sha1:472f45139614c5f37088af30e00a179489ffc568 ok guenther 2018-02-21T19:24:15Z guenther guenther@openbsd.org 2018-02-21T19:24:15Z urn:sha1:b767b017801a7911c8695888fb3667cbbba30f7b On Intel CPUs which speculate past user/supervisor page permission checks, use a separate page table for userspace with only the minimum of kernel code and data required for the transitions to/from the kernel (still marked as supervisor-only, of course): - the IDT (RO) - three pages of kernel text in the .kutext section for interrupt, trap, and syscall trampoline code (RX) - one page of kernel data in the .kudata section for TLB flush IPIs (RW) - the lapic page (RW, uncachable) - per CPU: one page for the TSS+GDT (RO) and one page for trampoline stacks (RW) When a syscall, trap, or interrupt takes a CPU from userspace to kernel the trampoline code switches page tables, switches stacks to the thread's real kernel stack, then copies over the necessary bits from the trampoline stack. On return to userspace the opposite occurs: recreate the iretq frame on the trampoline stack, switch stack, switch page tables, and return to userspace. mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing issues on MP in particular, and drove the final push to completion. Many rounds of testing by naddy@, sthen@, and others Thanks to Alex Wilson from Joyent for early discussions about trampolines and their data requirements. Per-CPU page layout mostly inspired by DragonFlyBSD. ok mlarkin@ deraadt@ 2017-10-24T20:06:54Z guenther guenther@openbsd.org 2017-10-24T20:06:54Z urn:sha1:9718ab18d7b6ce6d0c5b63926c7e6e95c2168d16 writable, so the stub gap.o has .rodata flagged as RW. Instead of letting that propagate to the final :rodata PT_LOAD section, force the flags on the section to 4 (==PF_R) in the PHDRS block. problem noted by mortimer@ ok deraadt@ kettenis@ 2017-07-06T06:21:56Z deraadt deraadt@openbsd.org 2017-07-06T06:21:56Z urn:sha1:355114686f845ccc78aff0a7f2d84a561f84815d a mask of VA, but can be an offset (once other code is ready...). Also, simplify and remove useless symbols. ok mlarkin