[RFC v3 2/5] Selfpatch runtime

Signed-off-by: York Jasper Niebuhr <[email protected]>
---
 include/linux/spslr.h           |  82 ++++
 include/sanemaker/traps.h       | 135 +++++++
 kernel/Makefile                 |   2 +
 kernel/spslr/Makefile           |   7 +
 kernel/spslr/pinpoint.h         |  76 ++++
 kernel/spslr/sanemaker_traps.c  | 117 ++++++
 kernel/spslr/spslr.c            | 555 +++++++++++++++++++++++++++
 kernel/spslr/spslr_env.c        |  74 ++++
 kernel/spslr/spslr_env.h        |  45 +++
 kernel/spslr/spslr_randomizer.c | 646 ++++++++++++++++++++++++++++++++
 kernel/spslr/spslr_randomizer.h |  29 ++
 11 files changed, 1768 insertions(+)
 create mode 100644 include/linux/spslr.h
 create mode 100644 include/sanemaker/traps.h
 create mode 100644 kernel/spslr/Makefile
 create mode 100644 kernel/spslr/pinpoint.h
 create mode 100644 kernel/spslr/sanemaker_traps.c
 create mode 100644 kernel/spslr/spslr.c
 create mode 100644 kernel/spslr/spslr_env.c
 create mode 100644 kernel/spslr/spslr_env.h
 create mode 100644 kernel/spslr/spslr_randomizer.c
 create mode 100644 kernel/spslr/spslr_randomizer.h

diff --git a/include/linux/spslr.h b/include/linux/spslr.h
new file mode 100644
index 000000000000..2606d66c39f0
--- /dev/null
+++ b/include/linux/spslr.h
@@ -0,0 +1,82 @@
+#ifndef SPSLR_SELFPATCH_H
+#define SPSLR_SELFPATCH_H
+
+#ifdef CONFIG_SPSLR
+
+#include <linux/types.h>
+
+#define SPSLR_START_UNITS_SYM __start_spslr_units
+#define SPSLR_STOP_UNITS_SYM __stop_spslr_units
+#define SPSLR_START_TARGETS_SYM __start_spslr_targets
+#define SPSLR_STOP_TARGETS_SYM __stop_spslr_targets
+
+extern bool spslr_enabled;
+
+enum spslr_viability { SPSLR_VIABLE, SPSLR_NONVIABLE };
+
+enum spslr_error {
+	SPSLR_OK,
+	SPSLR_ERROR_INCOMPLETE_CTX,
+	SPSLR_ERROR_INCOMPATIBLE_CTX,
+	SPSLR_ERROR_RANDOMIZER_INIT,
+	SPSLR_ERROR_INITIAL_TARGET_LAYOUT,
+	SPSLR_ERROR_RANDOMIZED_TARGET_LAYOUT,
+	SPSLR_ERROR_RANDOMIZE,
+	SPSLR_ERROR_MEMORY,
+	SPSLR_ERROR_UNINITIALIZED,
+	SPSLR_ERROR_ALREADY_PATCHED,
+	SPSLR_ERROR_PATCH_DPINS,
+	SPSLR_ERROR_PATCH_IPINS,
+	SPSLR_ERROR_MAP_TARGETS
+};
+
+struct spslr_status {
+	enum spslr_viability viability;
+	enum spslr_error error;
+};
+
+struct spslr_entry {
+	const void *start_units; // Address of SPSLR_START_UNITS_SYM
+	const void *stop_units; // Address of SPSLR_STOP_UNITS_SYM
+	const void *start_targets; // Address of SPSLR_START_TARGETS_SYM
+	const void *stop_targets; // Address of SPSLR_STOP_TARGETS_SYM
+};
+
+struct spslr_ctx {
+	struct spslr_entry entry;
+	void *workspace; // Temporary buffer of spslr_workspace_size(&entry) bytes
+};
+
+/*
+ * Runtime entry points are intentionally split:
+ *
+ * spslr_init() creates randomized layouts.
+ * spslr_selfpatch() patches the main executable.
+ * spslr_patch_module() patches with module-local metadata using host layouts.
+ */
+
+struct spslr_status spslr_init(void);
+struct spslr_status spslr_selfpatch(void);
+unsigned long spslr_workspace_size(const struct spslr_entry *entry);
+struct spslr_status spslr_patch_module(const struct spslr_ctx *m);
+
+/* Use spslr_target_hash(type) to get a pointer to the 16 byte md5 hash
+   of the target type. If type is not an SPSLR target, NULL is returned. */
+
+extern const unsigned char *__spslr_target_hash(const void *);
+
+#define __SPSLR_CAT2(a, b) a##b
+#define __SPSLR_CAT(a, b) __SPSLR_CAT2(a, b)
+
+#define __spslr_target_hash_impl(T, n)                                      \
+	({                                                                  \
+		extern T __SPSLR_CAT(__spslr_target_hash_type_anchor_, n);  \
+		__spslr_target_hash(                                        \
+			&__SPSLR_CAT(__spslr_target_hash_type_anchor_, n)); \
+	})
+
+#define spslr_target_hash(T) __spslr_target_hash_impl(T, __COUNTER__)
+
+#endif /* CONFIG_SPSLR */
+
+#endif
diff --git a/include/sanemaker/traps.h b/include/sanemaker/traps.h
new file mode 100644
index 000000000000..bcb75198b18b
--- /dev/null
+++ b/include/sanemaker/traps.h
@@ -0,0 +1,135 @@
+#ifndef SANEMAKER_TRAPS_H
+#define SANEMAKER_TRAPS_H
+
+/* Define trap API attributes */
+
+#define SANEMAKER_TRAP_API extern __attribute__((__visibility__("default")))
+
+/* Use sanemaker_target_tag(&obj) to make sanemaker watch memops to that object */
+
+#ifdef CONFIG_SANEMAKER
+
+SANEMAKER_TRAP_API
+void __sanemaker_target_tag_trap(const void *ptr, const unsigned char *target);
+
+#define sanemaker_target_tag(ptr, type) \
+	__sanemaker_target_tag_trap(ptr, spslr_target_hash(type))
+
+#else
+
+#define sanemaker_target_tag(ptr, type)
+
+#endif
+
+/* Use sanemaker_target_untag(&obj) to make sanemaker stop watching memops to that object */
+
+#ifdef CONFIG_SANEMAKER
+
+SANEMAKER_TRAP_API
+void __sanemaker_target_untag_trap(const void *ptr);
+
+#define sanemaker_target_untag(ptr) __sanemaker_target_untag_trap(ptr)
+
+#else
+
+#define sanemaker_target_untag(ptr)
+
+#endif
+
+/* The sanemaker_finish_layout(&fieldarr, &target_hash) should be called
+   by spslr selfpatch when a target layout has been randomized */
+
+#ifdef CONFIG_SANEMAKER
+
+SANEMAKER_TRAP_API
+void __sanemaker_finish_layout_trap(const void *fields,
+				    const unsigned char *target);
+
+#define sanemaker_finish_layout(fields, target) \
+	__sanemaker_finish_layout_trap(fields, target)
+
+#else
+
+#define sanemaker_finish_layout(fields, target)
+
+#endif
+
+/* Use sanemaker_fetch(what, default) to let sanemaker make decisions at runtime */
+
+typedef enum {
+	SANEMAKER_FETCH_SPSLR_ENABLED = 1,
+} sanemaker_fetch_t;
+
+#ifdef CONFIG_SANEMAKER
+
+SANEMAKER_TRAP_API
+int __sanemaker_fetch_trap(sanemaker_fetch_t what, int def);
+
+#define sanemaker_fetch(what, def) __sanemaker_fetch_trap(what, def)
+
+#else
+
+#define sanemaker_fetch(what, def) (def)
+
+#endif
+
+/* Use sanemaker_signal(signal) to control sanemaker behavior */
+
+typedef enum {
+	SANEMAKER_SIGNAL_PATCH_BOUNDARY = 1, /* the image has been patched */
+	SANEMAKER_SIGNAL_PAUSE = 2,
+	SANEMAKER_SIGNAL_RESUME = 3,
+} sanemaker_signal_t;
+
+#ifdef CONFIG_SANEMAKER
+
+SANEMAKER_TRAP_API
+void __sanemaker_signal_trap(sanemaker_signal_t signal);
+
+#define sanemaker_signal(signal) __sanemaker_signal_trap(signal)
+
+#else
+
+#define sanemaker_signal(signal)
+
+#endif
+
+/* Use sanemaker_new_image(name, ptr) and sanemaker_new_image_text(image, begin, end)
+   to allow normalization of program counters inside dynamically loaded text segments */
+
+#ifdef CONFIG_SANEMAKER
+
+SANEMAKER_TRAP_API
+void __sanemaker_new_image_trap(const char *name, const void *base);
+
+SANEMAKER_TRAP_API
+void __sanemaker_new_image_text_trap(const char *image, const void *begin,
+				     const void *end);
+
+SANEMAKER_TRAP_API
+void __sanemaker_drop_image_trap(const char *image);
+
+SANEMAKER_TRAP_API
+void __sanemaker_drop_image_text_trap(const char *image, const void *begin,
+				      const void *end);
+
+#define sanemaker_new_image(name, base) __sanemaker_new_image_trap(name, base)
+
+#define sanemaker_new_image_text(image, begin, end) \
+	__sanemaker_new_image_text_trap(image, begin, end)
+
+#define sanemaker_drop_image(image) __sanemaker_drop_image_trap(image)
+
+#define sanemaker_drop_image_text(image, begin, end) \
+	__sanemaker_drop_image_text_trap(image, begin, end)
+
+#else
+
+#define sanemaker_new_image(name, base)
+#define sanemaker_new_image_text(image, begin, end)
+#define sanemaker_drop_image(image)
+#define sanemaker_drop_image_text(image, begin, end)
+
+#endif
+
+#endif
diff --git a/kernel/Makefile b/kernel/Makefile
index 1e1a31673577..cddfbff9f9f0 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -142,6 +142,8 @@ obj-$(CONFIG_WATCH_QUEUE) += watch_queue.o
 obj-$(CONFIG_RESOURCE_KUNIT_TEST) += resource_kunit.o
 obj-$(CONFIG_SYSCTL_KUNIT_TEST) += sysctl-test.o
 
+obj-$(CONFIG_SPSLR) += spslr/
+
 CFLAGS_kstack_erase.o += $(DISABLE_KSTACK_ERASE)
 CFLAGS_kstack_erase.o += $(call cc-option,-mgeneral-regs-only)
 obj-$(CONFIG_KSTACK_ERASE) += kstack_erase.o
diff --git a/kernel/spslr/Makefile b/kernel/spslr/Makefile
new file mode 100644
index 000000000000..a736d0aab05c
--- /dev/null
+++ b/kernel/spslr/Makefile
@@ -0,0 +1,7 @@
+obj-$(CONFIG_SPSLR) += spslr.o spslr_env.o spslr_randomizer.o
+obj-$(CONFIG_SANEMAKER) += sanemaker_traps.o
+
+CFLAGS_REMOVE_spslr.o += $(PINPOINT_PLUGIN_CFLAGS)
+CFLAGS_REMOVE_spslr_env.o += $(PINPOINT_PLUGIN_CFLAGS)
+CFLAGS_REMOVE_spslr_randomizer.o += $(PINPOINT_PLUGIN_CFLAGS)
+CFLAGS_REMOVE_sanemaker_traps.o += $(PINPOINT_PLUGIN_CFLAGS)
diff --git a/kernel/spslr/pinpoint.h b/kernel/spslr/pinpoint.h
new file mode 100644
index 000000000000..39ca81e6491d
--- /dev/null
+++ b/kernel/spslr/pinpoint.h
@@ -0,0 +1,76 @@
+#ifndef SPSLR_PINPOINT_H
+#define SPSLR_PINPOINT_H
+
+#include "spslr_env.h"
+
+/* Field must remain at its original offset during layout randomization. */
+#define SPSLR_FLAG_FIELD_FIXED 1
+
+struct spslr_unit;
+struct spslr_ipin;
+struct spslr_ipin_expr;
+struct spslr_dpin;
+struct spslr_target;
+struct spslr_target_layout;
+struct spslr_target_field;
+
+/* CU-local target reference; points into the global deduplicated target table. */
+typedef const struct spslr_target *spslr_target_ref;
+
+/*
+ * Metadata for one compilation unit. The target array is CU-local and maps
+ * unit_target_idx values used by pins to deduplicated global target headers.
+ */
+struct spslr_unit {
+	const char *source; // Source file name
+	spslr_u64 target_cnt;
+	const spslr_target_ref *target_refs; // CU-local target ref array
+	spslr_u64 ipin_cnt;
+	const struct spslr_ipin *ipins;
+	spslr_u64 dpin_cnt;
+	const struct spslr_dpin *dpins;
+} __packed;
+
+/* Instruction patch site: address of patchable immediate/displacement bytes. */
+struct spslr_ipin {
+	void *addr;
+	spslr_u64 size;
+	const struct spslr_ipin_expr *expr;
+} __packed;
+
+/* Data patch site: address of an object/subobject whose layout must be adjusted. */
+struct spslr_dpin {
+	void *addr;
+	spslr_u64 unit_target_idx;
+} __packed;
+
+/* Current simple expression: randomized offset of one field in one CU-local target. */
+struct spslr_ipin_expr {
+	spslr_u64 unit_target_idx;
+	spslr_u64 field_idx;
+} __packed;
+
+/* Deduplicated target type descriptor, keyed by deterministic layout hash. */
+struct spslr_target {
+	unsigned char hash[16];
+	const char *name;
+	const struct spslr_target_layout *layout;
+} __packed;
+
+/* Physical layout of a target type before runtime randomization. */
+struct spslr_target_layout {
+	spslr_u64 size;
+	spslr_u64 field_cnt;
+	const struct spslr_target_field *fields;
+} __packed;
+
+/* One randomizable or fixed field/range within a target layout. */
+struct spslr_target_field {
+	const char *name;
+	spslr_u64 size;
+	spslr_u64 offset;
+	spslr_u64 alignment;
+	spslr_u64 flags;
+} __packed;
+
+#endif
diff --git a/kernel/spslr/sanemaker_traps.c b/kernel/spslr/sanemaker_traps.c
new file mode 100644
index 000000000000..63aa1a4b9182
--- /dev/null
+++ b/kernel/spslr/sanemaker_traps.c
@@ -0,0 +1,117 @@
+#include <sanemaker/traps.h>
+
+#define SANEMAKER_TRAP_FN					\
+	__attribute__((__noinline__, __noclone__, __used__,	\
+		__externally_visible__,				\
+		__visibility__("default"), __naked__))
+
+/* Sanemaker reads object pointer from rdi and target hash pointer from rsi */
+SANEMAKER_TRAP_FN
+void __sanemaker_target_tag_trap(const void *ptr, const unsigned char *target)
+{
+	__asm__ volatile(
+		".globl __sanemaker_target_tag_trap_incision\n"
+		".type __sanemaker_target_tag_trap_incision, @notype\n"
+		"__sanemaker_target_tag_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads object pointer from rdi */
+SANEMAKER_TRAP_FN
+void __sanemaker_target_untag_trap(const void *ptr)
+{
+	__asm__ volatile(
+		".globl __sanemaker_target_untag_trap_incision\n"
+		".type __sanemaker_target_untag_trap_incision, @notype\n"
+		"__sanemaker_target_untag_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads field pointer from rdi and target hash pointer from rsi */
+SANEMAKER_TRAP_FN
+void __sanemaker_finish_layout_trap(const void *fields, const unsigned char *target)
+{
+	__asm__ volatile(
+		".globl __sanemaker_finish_layout_trap_incision\n"
+		".type __sanemaker_finish_layout_trap_incision, @notype\n"
+		"__sanemaker_finish_layout_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads name from rdi and overwrites rsi to set a value */
+SANEMAKER_TRAP_FN
+int __sanemaker_fetch_trap(sanemaker_fetch_t what, int def)
+{
+	__asm__ volatile(
+		".globl __sanemaker_fetch_trap_incision\n"
+		".type __sanemaker_fetch_trap_incision, @notype\n"
+		"__sanemaker_fetch_trap_incision:\n"
+		"nop\n"
+		"movl %esi, %eax\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads the signal event from rdi */
+SANEMAKER_TRAP_FN
+void __sanemaker_signal_trap(sanemaker_signal_t signal)
+{
+	__asm__ volatile(
+		".globl __sanemaker_signal_trap_incision\n"
+		".type __sanemaker_signal_trap_incision, @notype\n"
+		"__sanemaker_signal_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads name from rdi and base from rsi */
+SANEMAKER_TRAP_FN
+void __sanemaker_new_image_trap(const char *name, const void *base)
+{
+	__asm__ volatile(
+		".globl __sanemaker_new_image_trap_incision\n"
+		".type __sanemaker_new_image_trap_incision, @notype\n"
+		"__sanemaker_new_image_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads image name from rdi, begin from rsi and end from rdx */
+SANEMAKER_TRAP_FN
+void __sanemaker_new_image_text_trap(const char *image, const void *begin, const void *end)
+{
+	__asm__ volatile(
+		".globl __sanemaker_new_image_text_trap_incision\n"
+		".type __sanemaker_new_image_text_trap_incision, @notype\n"
+		"__sanemaker_new_image_text_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads image name from rdi */
+SANEMAKER_TRAP_FN
+void __sanemaker_drop_image_trap(const char *image)
+{
+	__asm__ volatile(
+		".globl __sanemaker_drop_image_trap_incision\n"
+		".type __sanemaker_drop_image_trap_incision, @notype\n"
+		"__sanemaker_drop_image_trap_incision:\n"
+		"ret\n"
+	);
+}
+
+/* Sanemaker reads image name from rdi, begin from rsi and end from rdx */
+SANEMAKER_TRAP_FN
+void __sanemaker_drop_image_text_trap(const char *image, const void *begin, const void *end)
+{
+	__asm__ volatile(
+		".globl __sanemaker_drop_image_text_trap_incision\n"
+		".type __sanemaker_drop_image_text_trap_incision, @notype\n"
+		"__sanemaker_drop_image_text_trap_incision:\n"
+		"ret\n"
+	);
+}
+
diff --git a/kernel/spslr/spslr.c b/kernel/spslr/spslr.c
new file mode 100644
index 000000000000..5ef36731f75e
--- /dev/null
+++ b/kernel/spslr/spslr.c
@@ -0,0 +1,555 @@
+#include <linux/spslr.h>
+#include <sanemaker/traps.h>
+
+#include "spslr_randomizer.h"
+#include "spslr_env.h"
+#include "pinpoint.h"
+
+/*
+ * Runtime portion of SPSLR.
+ *
+ * This code consumes the metadata emitted by pinpoint, randomizes target
+ * layouts, rewrites static data objects, and patches instruction immediates
+ * that encode structure field offsets.
+ */
+
+#define SPSLR_SANITY_CHECK
+
+struct target_map {
+	spslr_u64 *map;
+	spslr_u64 size;
+};
+
+static void init_spslr_meta(void);
+static int spslr_targets_compatible(const struct spslr_target *begin,
+				    const struct spslr_target *end);
+static enum spslr_error spslr_patch_unit(const struct spslr_unit *unit,
+					 spslr_u64 *tmap_buffer,
+					 void *reorder_buffer);
+static struct spslr_status spslr_patch(const struct spslr_ctx *ctx);
+static spslr_u64 spslr_target_mapping_size(void);
+static spslr_u64 *workspace_target_mapping(void *workspace);
+static void *workspace_reorder_buffer(void *workspace);
+
+static int spslr_patch_dpins(const struct spslr_dpin *dpins, spslr_u64 cnt,
+			     const struct target_map *tmap,
+			     void *reorder_buffer);
+static int spslr_patch_dpin(void *addr, spslr_u64 target, void *reorder_buffer);
+static int spslr_patch_ipins(const struct spslr_ipin *ipins, spslr_u64 cnt,
+			     const struct target_map *tmap);
+
+static int reorder_object(void *dst, const void *src, spslr_u64 target);
+static int spslr_calculate_ipin_value(const struct spslr_ipin_expr *expr,
+				      spslr_s64 *res,
+				      const struct target_map *tmap);
+
+static int spslr_map_target(const struct spslr_target *target, spslr_u64 *idx);
+static int spslr_map_targets(const struct spslr_unit *unit,
+			     struct target_map *tmap);
+
+static int initialized = 0, patched = 0;
+static enum spslr_viability viable = SPSLR_VIABLE;
+
+spslr_u64 spslr_target_cnt = 0;
+const struct spslr_target *spslr_targets = NULL;
+
+/* Host image spslr metadata entry point */
+extern const struct spslr_unit SPSLR_START_UNITS_SYM[];
+extern const struct spslr_unit SPSLR_STOP_UNITS_SYM[];
+extern const struct spslr_target SPSLR_START_TARGETS_SYM[];
+extern const struct spslr_target SPSLR_STOP_TARGETS_SYM[];
+
+/*
+ * Initialize runtime randomization state.
+ *
+ * After this point target layouts are randomized, but code/data does still
+ * contain original-layout offsets until the patching entry points run.
+ */
+
+static void __init init_spslr_meta(void)
+{
+	spslr_target_cnt =
+		(spslr_u64)(SPSLR_STOP_TARGETS_SYM - SPSLR_START_TARGETS_SYM);
+	spslr_targets = SPSLR_START_TARGETS_SYM;
+}
+
+struct spslr_status __init spslr_init(void)
+{
+	if (initialized)
+		return (struct spslr_status){ .viability = viable,
+					      .error = SPSLR_OK };
+
+	init_spslr_meta();
+
+	if (spslr_randomizer_init() < 0)
+		return (struct spslr_status){
+			.viability = viable,
+			.error = SPSLR_ERROR_RANDOMIZER_INIT
+		};
+
+#ifdef SPSLR_SANITY_CHECK
+	for (spslr_u64 tidx = 0; tidx < spslr_target_cnt; tidx++) {
+		if (spslr_randomizer_validate_target(tidx) < 0)
+			return (struct spslr_status){
+				.viability = viable,
+				.error = SPSLR_ERROR_INITIAL_TARGET_LAYOUT
+			};
+	}
+#endif
+
+	if (sanemaker_fetch(SANEMAKER_FETCH_SPSLR_ENABLED, 1)) {
+		if (spslr_randomize() < 0)
+			return (struct spslr_status){
+				.viability = viable,
+				.error = SPSLR_ERROR_RANDOMIZE
+			};
+	}
+
+#ifdef SPSLR_SANITY_CHECK
+	for (spslr_u64 tidx = 0; tidx < spslr_target_cnt; tidx++) {
+		if (spslr_randomizer_validate_target(tidx) < 0)
+			return (struct spslr_status){
+				.viability = viable,
+				.error = SPSLR_ERROR_RANDOMIZED_TARGET_LAYOUT
+			};
+	}
+#endif
+
+	initialized = 1;
+	return (struct spslr_status){ .viability = viable, .error = SPSLR_OK };
+}
+
+/*
+ * Calculate required workspace buffer size. This includes the reorder
+ * buffer for data pins and the storage for the mapping of local to
+ * global target indices.
+ */
+
+static spslr_u64 spslr_target_mapping_size(void)
+{
+	return spslr_target_cnt * sizeof(spslr_u64);
+}
+
+unsigned long spslr_workspace_size(const struct spslr_entry *entry)
+{
+	if (!entry || !entry->start_units || !entry->stop_units)
+		return 0;
+
+	const struct spslr_unit *start_units =
+		(const struct spslr_unit *)entry->start_units;
+	const struct spslr_unit *stop_units =
+		(const struct spslr_unit *)entry->stop_units;
+
+	spslr_u64 max_dpin_size = 0;
+	for (const struct spslr_unit *unit = start_units; unit != stop_units;
+	     unit++) {
+		for (spslr_u64 dpin = 0; dpin < unit->dpin_cnt; dpin++) {
+			const struct spslr_target *target =
+				unit->target_refs[unit->dpins[dpin]
+							  .unit_target_idx];
+
+			if (target->layout->size > max_dpin_size)
+				max_dpin_size = target->layout->size;
+		}
+	}
+
+	return spslr_target_mapping_size() + max_dpin_size;
+}
+
+/*
+ * Check if the given target space is compatible with that of the
+ * host.
+ */
+
+static int spslr_meta_known_target(const struct spslr_target *t)
+{
+	for (spslr_u64 i = 0; i < spslr_target_cnt; i++) {
+		if (spslr_env_memcmp(t->hash, spslr_targets[i].hash,
+				     sizeof(t->hash)) == 0)
+			return 1;
+	}
+
+	return 0;
+}
+
+static int spslr_targets_compatible(const struct spslr_target *begin,
+				    const struct spslr_target *end)
+{
+	spslr_u64 cnt = (spslr_u64)(end - begin);
+	if (cnt > spslr_target_cnt)
+		return 0;
+
+	for (spslr_u64 i = 0; i < cnt; i++) {
+		if (!spslr_meta_known_target(begin + i))
+			return 0;
+	}
+
+	return 1;
+}
+
+/*
+ * For each CU, map local target indices to global target indices and then
+ * to host indices. Afterwards, patch ipins and dpins.
+ */
+
+static spslr_u64 *workspace_target_mapping(void *workspace)
+{
+	return (spslr_u64 *)workspace;
+}
+
+static void *workspace_reorder_buffer(void *workspace)
+{
+	return (spslr_u8 *)workspace + spslr_target_mapping_size();
+}
+
+static int spslr_map_target(const struct spslr_target *target, spslr_u64 *idx)
+{
+	for (spslr_u64 i = 0; i < spslr_target_cnt; i++) {
+		if (spslr_env_memcmp(target->hash, spslr_targets[i].hash,
+				     sizeof(target->hash)) == 0) {
+			*idx = i;
+			return 0;
+		}
+	}
+
+	return -1;
+}
+
+static int spslr_map_targets(const struct spslr_unit *unit,
+			     struct target_map *tmap)
+{
+	tmap->size = 0;
+
+	for (spslr_u64 i = 0; i < unit->target_cnt; i++) {
+		if (spslr_map_target(unit->target_refs[i], tmap->map + i) < 0)
+			return -1;
+	}
+
+	tmap->size = unit->target_cnt;
+	return 0;
+}
+
+static enum spslr_error spslr_patch_unit(const struct spslr_unit *unit,
+					 spslr_u64 *tmap_buffer,
+					 void *reorder_buffer)
+{
+	struct target_map tmap = { .map = tmap_buffer, .size = 0 };
+
+	if (spslr_map_targets(unit, &tmap) < 0)
+		return SPSLR_ERROR_MAP_TARGETS;
+
+	if (spslr_patch_dpins(unit->dpins, unit->dpin_cnt, &tmap,
+			      reorder_buffer) < 0)
+		return SPSLR_ERROR_PATCH_DPINS;
+
+	if (spslr_patch_ipins(unit->ipins, unit->ipin_cnt, &tmap) < 0)
+		return SPSLR_ERROR_PATCH_IPINS;
+
+	return SPSLR_OK;
+}
+
+static struct spslr_status spslr_patch(const struct spslr_ctx *ctx)
+{
+	enum spslr_error err = SPSLR_OK;
+	enum spslr_viability via = SPSLR_VIABLE;
+
+	spslr_u64 *target_map_buffer = NULL;
+	void *reorder_buffer = NULL;
+
+	const struct spslr_unit *start_units = NULL;
+	const struct spslr_unit *stop_units = NULL;
+	const struct spslr_target *start_targets = NULL;
+	const struct spslr_target *stop_targets = NULL;
+
+	if (!ctx || !ctx->entry.start_units || !ctx->entry.stop_units ||
+	    !ctx->entry.start_targets || !ctx->entry.stop_targets ||
+	    !ctx->workspace) {
+		err = SPSLR_ERROR_INCOMPLETE_CTX;
+		goto finish;
+	}
+
+	start_units = (const struct spslr_unit *)ctx->entry.start_units;
+	stop_units = (const struct spslr_unit *)ctx->entry.stop_units;
+	start_targets = (const struct spslr_target *)ctx->entry.start_targets;
+	stop_targets = (const struct spslr_target *)ctx->entry.stop_targets;
+
+	target_map_buffer = workspace_target_mapping(ctx->workspace);
+	reorder_buffer = workspace_reorder_buffer(ctx->workspace);
+
+	if (!spslr_targets_compatible(start_targets, stop_targets)) {
+		err = SPSLR_ERROR_INCOMPATIBLE_CTX;
+		goto finish;
+	}
+
+	via = SPSLR_NONVIABLE;
+
+	if (sanemaker_fetch(SANEMAKER_FETCH_SPSLR_ENABLED, 1)) {
+		for (const struct spslr_unit *unit = start_units;
+		     unit != stop_units; unit++) {
+			err = spslr_patch_unit(unit, target_map_buffer,
+					       reorder_buffer);
+			if (err != SPSLR_OK)
+				goto finish;
+		}
+	}
+
+	via = SPSLR_VIABLE;
+
+finish:
+	return (struct spslr_status){ .viability = via, .error = err };
+}
+
+/*
+ * Patch the main executable.
+ *
+ * Instruction pins rewrite immediate operands in text, while data pins rewrite
+ * existing static objects from original layout into randomized layout.
+ */
+
+struct spslr_status __init spslr_selfpatch(void)
+{
+	enum spslr_error err = SPSLR_OK;
+
+	spslr_u64 host_workspace_size;
+
+	struct spslr_ctx host_ctx;
+	host_ctx.entry.start_units = SPSLR_START_UNITS_SYM;
+	host_ctx.entry.stop_units = SPSLR_STOP_UNITS_SYM;
+	host_ctx.entry.start_targets = SPSLR_START_TARGETS_SYM;
+	host_ctx.entry.stop_targets = SPSLR_STOP_TARGETS_SYM;
+	host_ctx.workspace = NULL;
+
+	struct spslr_status internal_patch_status;
+
+	if (patched) {
+		err = SPSLR_ERROR_ALREADY_PATCHED;
+		goto finish;
+	}
+
+	if (!initialized) {
+		err = SPSLR_ERROR_UNINITIALIZED;
+		goto finish;
+	}
+
+	host_workspace_size = spslr_workspace_size(&host_ctx.entry);
+	host_ctx.workspace = spslr_env_malloc(host_workspace_size);
+
+	if (!host_ctx.workspace) {
+		err = SPSLR_ERROR_MEMORY;
+		goto finish;
+	}
+
+	internal_patch_status = spslr_patch(&host_ctx);
+	if (internal_patch_status.error == SPSLR_OK)
+		patched = 1;
+
+	viable = internal_patch_status.viability;
+	err = internal_patch_status.error;
+
+finish:
+	if (host_ctx.workspace)
+		spslr_env_free(host_ctx.workspace, host_workspace_size);
+
+	sanemaker_signal(SANEMAKER_SIGNAL_PATCH_BOUNDARY);
+	return (struct spslr_status){ .viability = viable, .error = err };
+}
+
+/*
+ * Patch metadata belonging to a separately loaded module.
+ *
+ * Modules reuse the target randomization state created by the main executable;
+ * they contribute only their own instruction and data patch sites.
+ */
+
+struct spslr_status spslr_patch_module(const struct spslr_ctx *m)
+{
+	if (!initialized)
+		return (struct spslr_status){
+			.viability = SPSLR_VIABLE,
+			.error = SPSLR_ERROR_UNINITIALIZED
+		};
+
+	if (!m || !m->entry.start_units || !m->entry.stop_units ||
+	    !m->entry.start_targets || !m->entry.stop_targets || !m->workspace)
+		return (struct spslr_status){
+			.viability = SPSLR_VIABLE,
+			.error = SPSLR_ERROR_INCOMPLETE_CTX
+		};
+
+	struct spslr_status s = spslr_patch(m);
+	return (struct spslr_status){ .viability = (s.error == SPSLR_OK ?
+							    SPSLR_VIABLE :
+							    SPSLR_NONVIABLE),
+				      .error = s.error };
+}
+
+/*
+ * Rewrite one object instance from original layout into randomized layout.
+ *
+ * A temporary buffer is used so overlapping source/destination field ranges do
+ * not corrupt data while fields are moved.
+ */
+
+static int reorder_object(void *dst, const void *src, spslr_u64 target)
+{
+	spslr_u64 field_count;
+	if (spslr_randomizer_get_target(target, NULL, &field_count))
+		return -1;
+
+	const spslr_u8 *src_countable = (const spslr_u8 *)src;
+	spslr_u8 *dst_countable = (spslr_u8 *)dst;
+
+	for (spslr_u64 i = 0; i < field_count; i++) {
+		struct spslr_randomizer_field_info finfo;
+		if (spslr_randomizer_get_field(
+			    target, i, SPSLR_RANDOMIZER_FIELD_IDX_MODE_FINAL,
+			    &finfo))
+			return -1;
+
+		spslr_env_memcpy(dst_countable + finfo.offset,
+				 src_countable + finfo.initial_offset,
+				 finfo.size);
+	}
+
+	return 0;
+}
+
+/*
+ * Apply data pin patches.
+ *
+ * Each pin's address already points at an existing object in original layout. Patching
+ * converts that storage in-place to the target's randomized layout.
+ */
+
+static int spslr_patch_dpins(const struct spslr_dpin *dpins, spslr_u64 cnt,
+			     const struct target_map *tmap,
+			     void *reorder_buffer)
+{
+	for (spslr_u64 dpidx = 0; dpidx < cnt; dpidx++) {
+		const struct spslr_dpin *dp = &dpins[dpidx];
+
+		if (dp->unit_target_idx >= tmap->size)
+			return -1;
+
+		if (spslr_patch_dpin((void *)dp->addr,
+				     tmap->map[dp->unit_target_idx],
+				     reorder_buffer) < 0)
+			return -1;
+	}
+
+	return 0;
+}
+
+static int spslr_patch_dpin(void *addr, spslr_u64 target, void *reorder_buffer)
+{
+	if (target >= spslr_target_cnt)
+		return -1;
+
+	int res = -1;
+	const struct spslr_target *t = &spslr_targets[target];
+
+	sanemaker_signal(SANEMAKER_SIGNAL_PAUSE);
+
+	spslr_env_memset(reorder_buffer, 0, t->layout->size);
+
+	if (reorder_object(reorder_buffer, addr, target) < 0)
+		goto finish;
+
+	if (spslr_env_poke_data(addr, reorder_buffer, t->layout->size) < 0)
+		goto finish;
+
+	res = 0;
+finish:
+	sanemaker_signal(SANEMAKER_SIGNAL_RESUME);
+	return res;
+}
+
+static int spslr_ipin_value_fits(spslr_u64 value, spslr_u64 size)
+{
+	if (size == 0)
+		return 0;
+
+	spslr_u64 bound = (spslr_u64)1 << (8 * size);
+	return value < bound;
+}
+
+static int spslr_patch_ipins(const struct spslr_ipin *ipins, spslr_u64 cnt,
+			     const struct target_map *tmap)
+{
+	for (spslr_u64 ipidx = 0; ipidx < cnt; ipidx++) {
+		const struct spslr_ipin *ip = &ipins[ipidx];
+
+		spslr_s64 value;
+		if (spslr_calculate_ipin_value(ip->expr, &value, tmap) < 0)
+			return -1;
+
+		if (value < 0 ||
+		    !spslr_ipin_value_fits((spslr_u64)value, ip->size))
+			return -1;
+
+		/*
+		 * Text patching is deliberately scoped to the immediate field only.
+		 * The surrounding instruction bytes were fixed by pinpoint/patchcompile and
+		 * must not change at runtime.
+		 */
+
+		switch (ip->size) {
+		case 1:
+			if (spslr_env_poke_text_8((void *)ip->addr,
+						  (spslr_u8)value) < 0)
+				return -1;
+			break;
+		case 2:
+			if (spslr_env_poke_text_16((void *)ip->addr,
+						   (spslr_u16)value) < 0)
+				return -1;
+			break;
+		case 4:
+			if (spslr_env_poke_text_32((void *)ip->addr,
+						   (spslr_u32)value) < 0)
+				return -1;
+			break;
+		case 8:
+			if (spslr_env_poke_text_64((void *)ip->addr,
+						   (spslr_u64)value) < 0)
+				return -1;
+			break;
+		default:
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * Interpret one ipin program and compute the replacement immediate value.
+ *
+ * The program describes original target/field references; this function maps
+ * them through the randomized runtime layout and returns the value written into
+ * the instruction stream.
+ */
+
+static int spslr_calculate_ipin_value(const struct spslr_ipin_expr *expr,
+				      spslr_s64 *res,
+				      const struct target_map *tmap)
+{
+	if (!res)
+		return -1;
+
+	*res = 0;
+
+	if (expr->unit_target_idx >= tmap->size)
+		return -1;
+
+	spslr_u64 global_target_idx = tmap->map[expr->unit_target_idx];
+
+	struct spslr_randomizer_field_info finfo;
+	if (spslr_randomizer_get_field(global_target_idx, expr->field_idx,
+				       SPSLR_RANDOMIZER_FIELD_IDX_MODE_ORIGINAL,
+				       &finfo) != 0)
+		return -1;
+
+	*res = finfo.offset;
+	return 0;
+}
diff --git a/kernel/spslr/spslr_env.c b/kernel/spslr/spslr_env.c
new file mode 100644
index 000000000000..a4a2d2389dcd
--- /dev/null
+++ b/kernel/spslr/spslr_env.c
@@ -0,0 +1,74 @@
+#include "spslr_env.h"
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/random.h>
+#include <linux/memblock.h>
+
+#ifdef CONFIG_X86
+
+#include <asm/text-patching.h>
+
+static __always_inline int spslr_env_poke_text(void *dst, const void *src, size_t n)
+{
+	text_poke_early(dst, src, n);
+	return 0;
+}
+
+#endif
+
+int spslr_env_poke_text_8(void *dst, u8 value)
+{
+	return spslr_env_poke_text(dst, &value, sizeof(value));
+}
+
+int spslr_env_poke_text_16(void *dst, u16 value)
+{
+	return spslr_env_poke_text(dst, &value, sizeof(value));
+}
+
+int spslr_env_poke_text_32(void *dst, u32 value)
+{
+	return spslr_env_poke_text(dst, &value, sizeof(value));
+}
+
+int spslr_env_poke_text_64(void *dst, u64 value)
+{
+	return spslr_env_poke_text(dst, &value, sizeof(value));
+}
+
+/*
+ * Hook runs before slab allocators are available.
+ * memblock_alloc() is the correct early-boot allocator.
+ */
+void* __init spslr_env_malloc(spslr_u64 n) {
+	size_t size = PAGE_ALIGN(n ? n : 1);
+	return memblock_alloc(size, SMP_CACHE_BYTES);
+}
+
+void __init spslr_env_free(void *ptr, spslr_u64 n) {
+	if (ptr)
+		memblock_free(ptr, PAGE_ALIGN(n ? n : 1));
+}
+
+int spslr_env_poke_data(void* dst, const void* src, spslr_u64 n) {
+	memcpy(dst, src, n);
+	return 0;
+}
+
+void spslr_env_memset(void* dst, int v, spslr_u64 n) {
+	memset(dst, v, n);
+}
+
+void spslr_env_memcpy(void* dst, const void* src, spslr_u64 n) {
+	memcpy(dst, src, n);
+}
+
+int spslr_env_memcmp(const void *x, const void *y, spslr_u64 n) {
+	return memcmp(x, y, n);
+}
+
+spslr_u64 __init spslr_env_random_u64(void) {
+	return get_random_u64(); // Hook runs after random_init_early()
+}
+
diff --git a/kernel/spslr/spslr_env.h b/kernel/spslr/spslr_env.h
new file mode 100644
index 000000000000..f48d7e02c57e
--- /dev/null
+++ b/kernel/spslr/spslr_env.h
@@ -0,0 +1,45 @@
+#ifndef SPSLR_ENV_H
+#define SPSLR_ENV_H
+
+#include <linux/types.h>
+#include <linux/stddef.h>
+#include <linux/init.h>
+
+#ifndef __packed
+#define __packed __attribute__((packed))
+#endif
+
+#ifndef __init
+#define __init /* only required in kernel */
+#endif
+
+#ifndef __printf
+#define __printf(fmt_pos, arg_pos) \
+	__attribute__((format(printf, fmt_pos, arg_pos)))
+#endif
+
+#ifndef NULL
+#define NULL ((void *)0)
+#endif
+
+typedef uint8_t spslr_u8;
+typedef uint16_t spslr_u16;
+typedef uint32_t spslr_u32;
+typedef uint64_t spslr_u64;
+typedef int32_t spslr_s32;
+typedef int64_t spslr_s64;
+typedef uintptr_t spslr_uintptr;
+
+int spslr_env_poke_text_8(void *dst, spslr_u8 value);
+int spslr_env_poke_text_16(void *dst, spslr_u16 value);
+int spslr_env_poke_text_32(void *dst, spslr_u32 value);
+int spslr_env_poke_text_64(void *dst, spslr_u64 value);
+int spslr_env_poke_data(void *dst, const void *src, spslr_u64 n);
+void *spslr_env_malloc(spslr_u64 n);
+void spslr_env_free(void *ptr, spslr_u64 n);
+void spslr_env_memset(void *dst, int v, spslr_u64 n);
+void spslr_env_memcpy(void *dst, const void *src, spslr_u64 n);
+int spslr_env_memcmp(const void *x, const void *y, spslr_u64 n);
+spslr_u64 spslr_env_random_u64(void);
+
+#endif
diff --git a/kernel/spslr/spslr_randomizer.c b/kernel/spslr/spslr_randomizer.c
new file mode 100644
index 000000000000..879ead0a2384
--- /dev/null
+++ b/kernel/spslr/spslr_randomizer.c
@@ -0,0 +1,646 @@
+#include "spslr_randomizer.h"
+
+#include "spslr_env.h"
+#include "pinpoint.h"
+
+#include <sanemaker/traps.h>
+
+/*
+ * Target layout randomizer.
+ *
+ * The randomizer builds a permutation from original field order to randomized
+ * field order while preserving field size, alignment, and fixed-field
+ * constraints.
+ */
+
+/*
+ * Field tracks both directions of the permutation:
+ *
+ *   original index -> randomized position
+ *   randomized position -> original index
+ *
+ * The runtime needs both: data patching copies from original offsets to new
+ * offsets, while ipin patching maps an original field offset to its randomized
+ * offset.
+ */
+struct Field {
+	spslr_u64 offset; /* Final field offset -> fields[i].offset = offset of field i in final layout */
+	spslr_u64 oidx; /* Original field idx -> fields[i].oidx = original position of field i in final layout */
+	spslr_u64 fidx; /* Final field idx -> fields[i].fidx = randomized/final position of original field i */
+};
+
+extern spslr_u64 spslr_target_cnt;
+extern const struct spslr_target *spslr_targets;
+
+static spslr_u64 *field_base_indices = NULL;
+static struct Field *fields = NULL;
+
+static int init_field_base_indices(void);
+static int init_fields_buffer(void);
+
+static const struct spslr_target_field *meta_original_field(spslr_u64 target,
+							    spslr_u64 field);
+static struct Field *state_current_field_base(spslr_u64 target);
+static struct Field *state_current_field(spslr_u64 target, spslr_u64 field);
+
+static int __init init_field_base_indices(void)
+{
+	field_base_indices = (spslr_u64 *)spslr_env_malloc(sizeof(spslr_u64) *
+							   spslr_target_cnt);
+	if (!field_base_indices)
+		return -1;
+
+	spslr_u64 current_field_base_idx = 0;
+	for (spslr_u64 i = 0; i < spslr_target_cnt; i++) {
+		field_base_indices[i] = current_field_base_idx;
+		current_field_base_idx += spslr_targets[i].layout->field_cnt;
+	}
+
+	return 0;
+}
+
+static const struct spslr_target_field *meta_original_field(spslr_u64 target,
+							    spslr_u64 field)
+{
+	if (target >= spslr_target_cnt)
+		return NULL;
+
+	const struct spslr_target_layout *layout = spslr_targets[target].layout;
+
+	if (field >= layout->field_cnt)
+		return NULL;
+
+	return layout->fields + field;
+}
+
+static struct Field *state_current_field_base(spslr_u64 target)
+{
+	if (target >= spslr_target_cnt)
+		return NULL;
+
+	spslr_u64 field_base_idx = field_base_indices[target];
+	return fields + field_base_idx;
+}
+
+static struct Field *state_current_field(spslr_u64 target, spslr_u64 field)
+{
+	if (target >= spslr_target_cnt)
+		return NULL;
+
+	struct Field *field_base = state_current_field_base(target);
+	const struct spslr_target_layout *layout = spslr_targets[target].layout;
+
+	if (!field_base || field >= layout->field_cnt)
+		return NULL;
+
+	return field_base + field;
+}
+
+static int __init init_fields_buffer(void)
+{
+	spslr_u64 total_field_count = 0;
+	for (spslr_u64 i = 0; i < spslr_target_cnt; i++)
+		total_field_count += spslr_targets[i].layout->field_cnt;
+
+	fields = (struct Field *)spslr_env_malloc(sizeof(struct Field) *
+						  total_field_count);
+	if (!fields)
+		return -1;
+
+	for (spslr_u64 i = 0; i < spslr_target_cnt; i++) {
+		spslr_u64 field_base_idx = field_base_indices[i];
+
+		for (spslr_u64 field_idx = 0;
+		     field_idx < spslr_targets[i].layout->field_cnt;
+		     field_idx++) {
+			const struct spslr_target_field *src_field =
+				spslr_targets[i].layout->fields + field_idx;
+			struct Field *dst_field =
+				&fields[field_base_idx + field_idx];
+
+			dst_field->offset = src_field->offset;
+			dst_field->oidx = field_idx;
+			dst_field->fidx = field_idx;
+		}
+	}
+
+	return 0;
+}
+
+int __init spslr_randomizer_init(void)
+{
+	if (init_field_base_indices() != 0)
+		return -1;
+
+	if (init_fields_buffer() != 0)
+		return -1;
+
+	return 0;
+}
+
+int spslr_randomizer_get_target(spslr_u64 target, spslr_u64 *size,
+				spslr_u64 *fieldcnt)
+{
+	if (target >= spslr_target_cnt)
+		return -1;
+
+	const struct spslr_target *t = &spslr_targets[target];
+
+	if (size)
+		*size = t->layout->size;
+
+	if (fieldcnt)
+		*fieldcnt = t->layout->field_cnt;
+
+	return 0;
+}
+
+int spslr_randomizer_get_field(spslr_u64 target, spslr_u64 field,
+			       int field_idx_mode,
+			       struct spslr_randomizer_field_info *info)
+{
+	if (target >= spslr_target_cnt)
+		return -1;
+
+	if (!info)
+		return 0;
+
+	const struct spslr_target *t = &spslr_targets[target];
+
+	if (field >= t->layout->field_cnt)
+		return -1;
+
+	const struct spslr_target_field *of = NULL;
+	const struct Field *rf = NULL;
+
+	switch (field_idx_mode) {
+	case SPSLR_RANDOMIZER_FIELD_IDX_MODE_ORIGINAL:
+		of = meta_original_field(target, field);
+		rf = state_current_field(
+			target, state_current_field(target, field)->fidx);
+		break;
+	case SPSLR_RANDOMIZER_FIELD_IDX_MODE_FINAL:
+		of = meta_original_field(
+			target, state_current_field(target, field)->oidx);
+		rf = state_current_field(target, field);
+		break;
+	default:
+		return -1;
+	}
+
+	info->size = of->size;
+	info->offset = rf->offset;
+	info->initial_offset = of->offset;
+	info->alignment = of->alignment;
+	info->flags = of->flags;
+
+	return 0;
+}
+
+int __init spslr_randomizer_validate_target(spslr_u64 target)
+{
+	spslr_u64 tsize, fieldcnt;
+
+	if (spslr_randomizer_get_target(target, &tsize, &fieldcnt) < 0)
+		return -1;
+
+	spslr_u64 cur_end = 0;
+
+	for (spslr_u64 i = 0; i < fieldcnt; i++) {
+		struct spslr_randomizer_field_info finfo;
+		if (spslr_randomizer_get_field(
+			    target, i, SPSLR_RANDOMIZER_FIELD_IDX_MODE_FINAL,
+			    &finfo) < 0)
+			return -1;
+
+		if (finfo.alignment == 0)
+			return -1;
+
+		if (finfo.offset % finfo.alignment != 0)
+			return -1;
+
+		if ((finfo.flags & SPSLR_FLAG_FIELD_FIXED) &&
+		    finfo.offset != finfo.initial_offset)
+			return -1;
+
+		if (finfo.offset > tsize)
+			return -1;
+
+		/* Zero-sized metadata entries occupy no storage. */
+		if (finfo.size == 0)
+			continue;
+
+		if (finfo.offset < cur_end)
+			return -1;
+
+		/* Avoid overflow in offset + size. */
+		if (finfo.size > tsize - finfo.offset)
+			return -1;
+
+		cur_end = finfo.offset + finfo.size;
+	}
+
+	return 0;
+}
+
+// RANDOMIZATION CODE
+
+struct ShuffleRegion {
+	spslr_u64 begin;
+	spslr_u64 end;
+	spslr_u64 fill_begin;
+	spslr_u64 fill_end;
+};
+
+static spslr_u64 rand_u64(void);
+static void get_origin_region(spslr_u64 target, spslr_u64 final_idx,
+			      struct ShuffleRegion *region);
+static int option_is_valid(spslr_u64 target, spslr_u64 origin_final_idx,
+			   const struct ShuffleRegion *origin,
+			   spslr_u64 offset);
+static int pick_shuffle_option(spslr_u64 target, spslr_u64 origin_final_idx,
+			       const struct ShuffleRegion *origin,
+			       spslr_u64 alignment, spslr_u64 *selected);
+static void do_swap(spslr_u64 target, spslr_u64 origin_final_idx,
+		    const struct ShuffleRegion *origin_region,
+		    spslr_u64 new_offset);
+static void shuffle_one_target(spslr_u64 target);
+static void shuffle_target(spslr_u64 target);
+
+static spslr_u64 __init rand_u64(void)
+{
+	return spslr_env_random_u64();
+}
+
+static void __init get_origin_region(spslr_u64 target, spslr_u64 final_idx,
+				     struct ShuffleRegion *region)
+{
+	const struct spslr_target *t = &spslr_targets[target];
+	const struct Field *rf = state_current_field(target, final_idx);
+	const struct spslr_target_field *of =
+		meta_original_field(target, rf->oidx);
+
+	region->fill_begin = rf->offset;
+	region->fill_end = region->fill_begin + of->size;
+
+	if (final_idx == 0) {
+		region->begin = 0;
+	} else {
+		const struct Field *pred_rf =
+			state_current_field(target, final_idx - 1);
+		const struct spslr_target_field *pred_of =
+			meta_original_field(target, pred_rf->oidx);
+		region->begin = pred_rf->offset + pred_of->size;
+	}
+
+	if (final_idx + 1 >= t->layout->field_cnt) {
+		region->end = t->layout->size;
+	} else {
+		const struct Field *succ_rf =
+			state_current_field(target, final_idx + 1);
+		region->end = succ_rf->offset;
+	}
+}
+
+/*
+ * Check whether a proposed field move preserves layout constraints.
+ *
+ * A move is valid only if displaced fields can be packed into the freed region
+ * without violating alignment or moving fields marked fixed.
+ */
+
+static int __init option_is_valid(spslr_u64 target, spslr_u64 origin_final_idx,
+				  const struct ShuffleRegion *origin,
+				  spslr_u64 offset)
+{
+	const struct spslr_target *t = &spslr_targets[target];
+	const struct spslr_target_field *origin_of = meta_original_field(
+		target, state_current_field(target, origin_final_idx)->oidx);
+
+	// When placed at offset, field will occupy [offset, option_would_end)
+	spslr_u64 option_would_end = offset + origin_of->size;
+	if (option_would_end > t->layout->size)
+		return 0;
+
+	// Field may overlap with origin region. Moving field to offset truly frees:
+	// [true_origin_region_begin, true_origin_region_end)
+	spslr_u64 true_origin_region_begin = origin->begin;
+	spslr_u64 true_origin_region_end = origin->end;
+
+	if (offset <= origin->fill_begin &&
+	    option_would_end > true_origin_region_begin)
+		true_origin_region_begin = option_would_end;
+
+	if (offset >= origin->fill_begin && offset < true_origin_region_end)
+		true_origin_region_end = offset;
+
+	// Iterate over fields in target region [offset, option_would_end] and see if they fit into true origin region
+	spslr_u64 origin_region_ptr = true_origin_region_begin;
+	for (spslr_u64 it = 0; it < t->layout->field_cnt; it++) {
+		const struct Field *rf = state_current_field(target, it);
+		const struct spslr_target_field *of =
+			meta_original_field(target, rf->oidx);
+
+		// The field being moved does not need to go into origin region
+		if (it == origin_final_idx)
+			continue;
+
+		/*
+		 * Zero-sized metadata entries occupy no storage, but they still
+		 * mark an ordering boundary. A moved field must neither straddle
+		 * one nor start at one: equal-offset entries have an ordering
+		 * relationship that do_swap() does not preserve while displacing
+		 * fields.
+         */
+		if (of->size == 0) {
+			if (rf->offset >= offset &&
+			    rf->offset < option_would_end)
+				return 0;
+
+			continue;
+		}
+
+		// Field ends before target region -> must not be moved to origin region
+		if (rf->offset + of->size <= offset)
+			continue;
+
+		// Field starts after target region -> must not be moved to origin region
+		if (rf->offset >= option_would_end)
+			break;
+
+		// Fixed fields in target region unconditionally deny option
+		if (of->flags & SPSLR_FLAG_FIELD_FIXED)
+			return 0;
+
+		// Field from target region must be moved to aligned position in origin region
+		if (origin_region_ptr % of->alignment != 0)
+			origin_region_ptr +=
+				of->alignment -
+				(origin_region_ptr % of->alignment);
+
+		origin_region_ptr += of->size;
+
+		// Field does not fit into origin region -> option not possible
+		if (origin_region_ptr > true_origin_region_end)
+			return 0;
+	}
+
+	return 1;
+}
+
+static int __init pick_shuffle_option(spslr_u64 target,
+				      spslr_u64 origin_final_idx,
+				      const struct ShuffleRegion *origin,
+				      spslr_u64 alignment, spslr_u64 *selected)
+{
+	const struct spslr_target *t = &spslr_targets[target];
+	spslr_u64 seen = 0;
+
+	/*
+	Note: Instead of looping over entire field array for each option, loops can be merged into one.
+	*/
+
+	for (spslr_u64 offset = 0; offset < t->layout->size;
+	     offset += alignment) {
+		if (!option_is_valid(target, origin_final_idx, origin, offset))
+			continue;
+
+		// Reservoir sampling -> uniform distribution with O(1) memory consumption
+		seen++;
+		if ((rand_u64() % seen) == 0)
+			*selected = offset;
+	}
+
+	return seen ? 0 : -1;
+}
+
+/*
+ * Move one field into a new slot and repack the fields it displaced.
+ *
+ * This is not a simple pairwise swap: structure layout has byte ranges and
+ * alignment holes, so the displaced region may contain several fields.
+ */
+
+static void __init do_swap(spslr_u64 target, spslr_u64 origin_idx,
+			   const struct ShuffleRegion *origin_region,
+			   spslr_u64 new_offset)
+{
+	const struct spslr_target *t = &spslr_targets[target];
+	int pulled = 0;
+
+	spslr_u64 option_fill_end = new_offset + (origin_region->fill_end -
+						  origin_region->fill_begin);
+
+	spslr_u64 true_origin_region_begin = origin_region->begin;
+	if (new_offset <= origin_region->fill_begin &&
+	    option_fill_end > true_origin_region_begin)
+		true_origin_region_begin = option_fill_end;
+
+	spslr_u64 origin_oidx = state_current_field(target, origin_idx)->oidx;
+
+	spslr_u64 origin_region_ptr = true_origin_region_begin;
+	for (spslr_u64 it = 0; it < t->layout->field_cnt; it++) {
+		struct Field *itf = state_current_field(target, it);
+
+		if (itf->oidx == origin_oidx)
+			continue;
+
+		const struct spslr_target_field *itof =
+			meta_original_field(target, itf->oidx);
+
+		// Zero-sized metadata entries occupy no storage.
+		if (itof->size == 0)
+			continue;
+
+		if (itf->offset + itof->size <= new_offset)
+			continue;
+
+		if (itf->offset >= option_fill_end)
+			break;
+
+		spslr_u64 falign = itof->alignment;
+		if (origin_region_ptr % falign != 0)
+			origin_region_ptr +=
+				falign - (origin_region_ptr % falign);
+
+		if (!pulled) {
+			pulled = 1;
+
+			struct Field tmp = *state_current_field(target, it);
+			*state_current_field(target, it) =
+				*state_current_field(target, origin_idx);
+			*state_current_field(target, origin_idx) = tmp;
+
+			state_current_field(target, it)->offset = new_offset;
+
+			state_current_field(target, origin_idx)->offset =
+				origin_region_ptr;
+			origin_region_ptr +=
+				meta_original_field(
+					target,
+					state_current_field(target, origin_idx)
+						->oidx)
+					->size;
+			continue;
+		}
+
+		{
+			struct Field tmp = *state_current_field(target, it);
+
+			if (origin_idx >= it) {
+				for (spslr_u64 pull_it = it + 1;
+				     pull_it <= origin_idx; pull_it++)
+					*state_current_field(target,
+							     pull_it - 1) =
+						*state_current_field(target,
+								     pull_it);
+
+				*state_current_field(target, origin_idx) = tmp;
+				state_current_field(target, origin_idx)->offset =
+					origin_region_ptr;
+				origin_region_ptr +=
+					meta_original_field(
+						target,
+						state_current_field(target,
+								    origin_idx)
+							->oidx)
+						->size;
+
+				it--; // Must still look at the element now at it
+			} else {
+				for (spslr_u64 pull_it = it;
+				     pull_it > origin_idx + (spslr_u64)pulled;
+				     pull_it--)
+					*state_current_field(target, pull_it) =
+						*state_current_field(
+							target, pull_it - 1);
+
+				*state_current_field(
+					target,
+					origin_idx + (spslr_u64)pulled) = tmp;
+				state_current_field(
+					target, origin_idx + (spslr_u64)pulled)
+					->offset = origin_region_ptr;
+				origin_region_ptr +=
+					meta_original_field(
+						target,
+						state_current_field(
+							target,
+							origin_idx +
+								(spslr_u64)
+									pulled)
+							->oidx)
+						->size;
+			}
+		}
+
+		pulled++;
+	}
+
+	/*
+	 * The selected destination may not overlap any other field. It may be an
+	 * empty padding gap, or it may partially overlap the origin field itself
+	 * when the field slides into adjacent padding.
+	 *
+	 * In either case the loop above never displaces another field and
+	 * `pulled` remains zero. We still need to update the origin field's
+	 * offset and reinsert it at the correct position in final-offset order so
+	 * that the field array remains sorted.
+	 */
+	if (!pulled) {
+		struct Field origin = *state_current_field(target, origin_idx);
+		spslr_u64 insert_idx = t->layout->field_cnt;
+
+		for (spslr_u64 it = 0; it < t->layout->field_cnt; it++) {
+			if (it == origin_idx)
+				continue;
+
+			if (state_current_field(target, it)->offset >=
+			    new_offset) {
+				insert_idx = it;
+				break;
+			}
+		}
+
+		if (insert_idx > origin_idx)
+			insert_idx--;
+
+		if (origin_idx < insert_idx) {
+			for (spslr_u64 it = origin_idx + 1; it <= insert_idx;
+			     it++)
+				*state_current_field(target, it - 1) =
+					*state_current_field(target, it);
+		} else if (origin_idx > insert_idx) {
+			for (spslr_u64 it = origin_idx; it > insert_idx; it--)
+				*state_current_field(target, it) =
+					*state_current_field(target, it - 1);
+		}
+
+		*state_current_field(target, insert_idx) = origin;
+		state_current_field(target, insert_idx)->offset = new_offset;
+	}
+
+	/*
+	 * Rebuild original->final mapping for this target.
+	 */
+	for (spslr_u64 final_idx = 0; final_idx < t->layout->field_cnt;
+	     final_idx++) {
+		struct Field *rf = state_current_field(target, final_idx);
+		state_current_field(target, rf->oidx)->fidx = final_idx;
+	}
+}
+
+/*
+Note: final version should not shuffle random fields but try to shuffle each original field idx once
+*/
+static void __init shuffle_one_target(spslr_u64 target)
+{
+	const struct spslr_target *t = &spslr_targets[target];
+	if (t->layout->field_cnt == 0)
+		return;
+
+	spslr_u64 origin_final_idx = rand_u64() % t->layout->field_cnt;
+	struct Field *origin_rf = state_current_field(target, origin_final_idx);
+	const struct spslr_target_field *origin_of =
+		meta_original_field(target, origin_rf->oidx);
+
+	/* Zero-sized entries are metadata markers, not shuffleable storage. */
+	if (origin_of->size == 0)
+		return;
+
+	if (origin_of->flags & SPSLR_FLAG_FIELD_FIXED)
+		return;
+
+	struct ShuffleRegion origin_region;
+	spslr_u64 selected_option;
+
+	get_origin_region(target, origin_final_idx, &origin_region);
+
+	if (pick_shuffle_option(target, origin_final_idx, &origin_region,
+				origin_of->alignment, &selected_option) < 0)
+		return;
+
+	do_swap(target, origin_final_idx, &origin_region, selected_option);
+}
+
+static void __init shuffle_target(spslr_u64 target)
+{
+	const struct spslr_target *t = &spslr_targets[target];
+	spslr_u64 shuffle_count = t->layout->field_cnt * 2;
+
+	for (spslr_u64 i = 0; i < shuffle_count; i++)
+		shuffle_one_target(target);
+
+	sanemaker_finish_layout(state_current_field_base(target), t->hash);
+}
+
+int __init spslr_randomize(void)
+{
+	if (!fields)
+		return -1;
+
+	for (spslr_u64 tidx = 0; tidx < spslr_target_cnt; tidx++)
+		shuffle_target(tidx);
+
+	return 0;
+}
diff --git a/kernel/spslr/spslr_randomizer.h b/kernel/spslr/spslr_randomizer.h
new file mode 100644
index 000000000000..c360750894e7
--- /dev/null
+++ b/kernel/spslr/spslr_randomizer.h
@@ -0,0 +1,29 @@
+#ifndef SPSLR_RANDOMIZER_H
+#define SPSLR_RANDOMIZER_H
+
+#include "spslr_env.h"
+#include "pinpoint.h"
+
+#define SPSLR_RANDOMIZER_FIELD_IDX_MODE_ORIGINAL 1
+#define SPSLR_RANDOMIZER_FIELD_IDX_MODE_FINAL 2
+
+struct spslr_randomizer_field_info {
+	spslr_u64 size;
+	spslr_u64 offset;
+	spslr_u64 initial_offset;
+	spslr_u64 alignment;
+	spslr_u64 flags;
+};
+
+int spslr_randomizer_init(void);
+int spslr_randomize(void);
+
+int spslr_randomizer_get_target(spslr_u64 target, spslr_u64 *size,
+				spslr_u64 *fieldcnt);
+int spslr_randomizer_get_field(spslr_u64 target, spslr_u64 field,
+			       int field_idx_mode,
+			       struct spslr_randomizer_field_info *info);
+
+int spslr_randomizer_validate_target(spslr_u64 target);
+
+#endif
-- 
2.43.0