lkml.org 
[lkml]   [2016]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [RFC v1 3/4] x86, boot: Implement ASLR for kernel memory sections (x86_64)
    From
    Make sense, thanks for the details.

    On Thu, Apr 21, 2016 at 1:15 PM, H. Peter Anvin <hpa@zytor.com> wrote:
    > On April 21, 2016 8:52:01 AM PDT, Thomas Garnier <thgarnie@google.com> wrote:
    >>On Thu, Apr 21, 2016 at 8:46 AM, H. Peter Anvin <hpa@zytor.com> wrote:
    >>> On April 21, 2016 6:30:24 AM PDT, Boris Ostrovsky
    >><boris.ostrovsky@oracle.com> wrote:
    >>>>
    >>>>
    >>>>On 04/15/2016 06:03 PM, Thomas Garnier wrote:
    >>>>> +void __init kernel_randomize_memory(void)
    >>>>> +{
    >>>>> + size_t i;
    >>>>> + unsigned long addr = memory_rand_start;
    >>>>> + unsigned long padding, rand, mem_tb;
    >>>>> + struct rnd_state rnd_st;
    >>>>> + unsigned long remain_padding = memory_rand_end -
    >>memory_rand_start;
    >>>>> +
    >>>>> + if (!kaslr_enabled())
    >>>>> + return;
    >>>>> +
    >>>>> + /* Take the additional space when Xen is not active. */
    >>>>> + if (!xen_domain())
    >>>>> + page_offset_base -= __XEN_SPACE;
    >>>>
    >>>>This should be !xen_pv_domain(). Xen HVM guests are no different from
    >>>>bare metal as far as address ranges are concerned. (Technically it's
    >>>>probably !xen_pv_domain() && !xen_pvh_domain() but we can ignore PVH
    >>>>for
    >>>>now since it is being replaced by an HVM-type guest)
    >>>>
    >>>>Having said that, I am not sure I understand why page_offset_base is
    >>>>shifted. I thought 0xffff800000000000 - 0xffff87ffffffffff is not
    >>>>supposed to be used by anyone, whether we are running under a
    >>>>hypervisor
    >>>>or not.
    >>>>
    >>>>-boris
    >>>
    >>> That range is reserved for the hypervisor use.
    >>
    >>I know, I thought I could use it if no hypervisor was used but might
    >>introduce problems in the future so I will remove it for the next
    >>iteration.
    >>
    >>> --
    >>> Sent from my Android device with K-9 Mail. Please excuse brevity and
    >>formatting.
    >
    > At least in theory the hypervisor can use it even though no PV architecture is advertised to the kernel. One kind of would hope none would.
    >
    > I think this range is also used by the kernel pointer checking thing, as it *has* to live right next to the canonical boundary.
    > --
    > Sent from my Android device with K-9 Mail. Please excuse brevity and formatting.

    \
     
     \ /
      Last update: 2016-04-21 22:41    [W:2.220 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site