From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 References: <20190131192533.34130-1-thgarnie@chromium.org> In-Reply-To: <20190131192533.34130-1-thgarnie@chromium.org> From: Kees Cook Date: Fri, 1 Feb 2019 08:59:21 +1300 Message-ID: Subject: Re: [PATCH v6 00/27] x86: PIE support and option to extend KASLR randomization Content-Type: text/plain; charset="UTF-8" To: Thomas Garnier Cc: Kernel Hardening , Kristen Carlson Accardi , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , X86 ML , Jonathan Corbet , Masahiro Yamada , Michal Marek , Herbert Xu , "David S. Miller" , Andy Lutomirski , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Juergen Gross , Alok Kataria , Dennis Zhou , Tejun Heo , Christoph Lameter , "Rafael J. Wysocki" , Len Brown , Pavel Machek , Steven Rostedt , Joerg Roedel , Dave Hansen , Peter Zijlstra , Boris Ostrovsky , Stefano Stabellini , Luis Chamberlain , Greg Kroah-Hartman , Arnd Bergmann , Luc Van Oostenryck , Jason Baron , "Kirill A. Shutemov" , Andrey Ryabinin , Thomas Garnier , Baoquan He , Alexander Popov , Jordan Borgner , Nathan Chancellor , Cao jin , "H.J. Lu" , Alexey Dobriyan , Nadav Amit , Yonghong Song , Nick Desaulniers , Arnaldo Carvalho de Melo , Jann Horn , Ard Biesheuvel , Andrew Morton , Andi Kleen , Francis Deslauriers , Masami Hiramatsu , Mimi Zohar , Nayna Jain , Michael Ellerman , Jan Kiszka , Jia Zhang , Konrad Rzeszutek Wilk , Brijesh Singh , Jan Beulich , Tim Chen , Mike Rapoport , Michal Hocko , Stephen Rothwell , =?UTF-8?Q?Rafael_=C3=81vila_de_Esp=C3=ADndola?= , Mathieu Desnoyers , Nicholas Piggin , Adrian Hunter , Song Liu , Alexander Shishkin , Michael Forney , Palmer Dabbelt , James Hogan , Joe Lawrence , nixiaoming , LKML , "open list:DOCUMENTATION" , linux-kbuild , linux-crypto , KVM , virtualization@lists.linux-foundation.org, Linux PM list , xen-devel , linux-arch , Sparse Mailing-list List-ID: On Fri, Feb 1, 2019 at 8:28 AM Thomas Garnier wrote: > These patches make the changes necessary to build the kernel as Position > Independent Executable (PIE) on x86_64. A PIE kernel can be relocated below > the top 2G of the virtual address space. It allows to optionally extend the > KASLR randomization range from 1G to 3G. The chosen range is the one currently > available, future changes will allow the kernel module to have a wider > randomization range. This also lays the groundwork for doing compilation-unit-granularity KASLR, as Kristen has been working on. With PIE working, the relocations are more sane and boot-time reordering becomes possible (or at least, it becomes the same logically as doing the work on modules, etc). -- Kees Cook