From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH v6 00/27] x86: PIE support and option to extend KASLR randomization Date: Fri, 1 Feb 2019 08:59:21 +1300 Message-ID: References: <20190131192533.34130-1-thgarnie@chromium.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Kernel Hardening , Kristen Carlson Accardi , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , X86 ML , Jonathan Corbet , Masahiro Yamada , Michal Marek , Herbert Xu , "David S. Miller" , Andy Lutomirski , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Juergen Gross , Alok Kataria , Dennis Zhou , Tejun Heo , Christoph Lameter , "Rafael J. Wysocki" , Len Brown , Pavel Machek , Steven Ro To: Thomas Garnier Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: <20190131192533.34130-1-thgarnie@chromium.org> List-Id: kvm.vger.kernel.org On Fri, Feb 1, 2019 at 8:28 AM Thomas Garnier wrote: > These patches make the changes necessary to build the kernel as Position > Independent Executable (PIE) on x86_64. A PIE kernel can be relocated below > the top 2G of the virtual address space. It allows to optionally extend the > KASLR randomization range from 1G to 3G. The chosen range is the one currently > available, future changes will allow the kernel module to have a wider > randomization range. This also lays the groundwork for doing compilation-unit-granularity KASLR, as Kristen has been working on. With PIE working, the relocations are more sane and boot-time reordering becomes possible (or at least, it becomes the same logically as doing the work on modules, etc). -- Kees Cook