[PATCH v2] x86, kaslr: Kernel base can be randomized at 0-1G offset.
Vivek Goyal
vgoyal at redhat.com
Wed Mar 19 09:33:31 EDT 2014
On Wed, Mar 19, 2014 at 03:05:51PM +0800, WANG Chao wrote:
> On 03/17/14 at 08:56am, Vivek Goyal wrote:
> > On Fri, Mar 14, 2014 at 04:20:18PM +0800, WANG Chao wrote:
> > > With kASLR enabled (CONFIG_RANDOMIZED_BASE=y), kernel virtual address
> > > base is PAGE_OFFSET plus a randomized offset from 0 to 1G.
> > >
> > > Current kexec-tools gets kernel vaddr and size from /proc/kcore. It
> > > assumes kernel vaddr start/end is within the range [0,512M). If kaslr
> > > enabled, kernel vaddr start/end will stay at [0+offset, 512M+offset).
>
> NACK this patch myself.
>
> There are several mistakes I made. I misunderstood some concepts. Then I
> realize this kASLR issue is not trivial to fix.
>
> I think if kexec-tools needs to get kernel text mapping from kcore in
> kALSR case, the max base offset (CONFIG_RANDOMIZE_MAX_BASE_OFFSET) of
> the kernel text area must be exposed to userspace some where. We can use
> that value to determine which area is for kernel text mapping and which
> is for modules text mapping.
How about looking at /proc/kallsyms and look at address of one of the
symbols say _text. And search for the ELF header in kcore which contains
_text address and that's ELF header representing kernel text mapping.
That way you don't have to worry about the value of
CONFIG_RANDOMIZE_MAX_BASE_OFFSET.
>
> >
> > Hi Chao,
> >
> > Documentation/x86/x86_64/mm.txt still says that kernel text mapping area
> > is 512MB.
> >
> > ffffffff80000000 - ffffffffa0000000 (=512 MB) kernel text mapping, from
> > phys 0
> >
> > So has that changed now due to kASLR.
>
> Yes, with kASLR enabled, kernel text mapping is as following
>
> ffffffff80000000 - (ffffffff80000000+CONFIG_RANDOMIZE_BASE_MAX_OFFSET)
>
> That said, if using CONFIG_RANDOMIZE_BASE_MAX_OFFSET=0x40000000 by
> default, the kernel text mapping is as following:
>
> ffffffff80000000 - ffffffffc0000000
>
Agreed. help text for CONFIG_RANDOMIZE_BASE_MAX_OFFSET says following.
On 64-bit this is limited by how the kernel fixmap page table is
positioned, so this cannot be larger than 1GiB currently. Without
RANDOMIZE_BASE, there is a 512MiB to 1.5GiB split between kernel
and modules. When RANDOMIZE_BASE_MAX_OFFSET is above 512MiB, the
modules area will shrink to compensate, up to the current maximum
1GiB to 1GiB split. The default is 1GiB.
Thanks
Vivek
More information about the kexec
mailing list