Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935199Ab3DOVq3 (ORCPT ); Mon, 15 Apr 2013 17:46:29 -0400 Received: from terminus.zytor.com ([198.137.202.10]:32984 "EHLO mail.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935176Ab3DOVq0 (ORCPT ); Mon, 15 Apr 2013 17:46:26 -0400 Message-ID: <516C751B.4020505@zytor.com> Date: Mon, 15 Apr 2013 14:46:03 -0700 From: "H. Peter Anvin" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130311 Thunderbird/17.0.4 MIME-Version: 1.0 To: Kees Cook CC: Eric Northup , Yinghai Lu , Linux Kernel Mailing List , "kernel-hardening@lists.openwall.com" , Thomas Gleixner , Ingo Molnar , the arch/x86 maintainers , Jarkko Sakkinen , Matthew Garrett , Matt Fleming , Dan Rosenberg , Julien Tinnes , Will Drewry Subject: Re: [PATCH 6/6] x86: kaslr: relocate base offset at boot References: <1365797627-20874-1-git-send-email-keescook@chromium.org> <1365797627-20874-7-git-send-email-keescook@chromium.org> <516A1D49.1050100@zytor.com> <516C702C.2030209@zytor.com> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1445 Lines: 45 On 04/15/2013 02:41 PM, Kees Cook wrote: >> >> You seem to be missing something here... >> >> There are *two* mappings in 64-bit mode. Physically, if you're going to >> randomize you might as well randomize over the entire range... except >> not too far down (on either 32 or 64 bit mode)... in particular, you >> don't want to drop below 16 MiB if you can avoid it. >> >> On 64 bits, there is no reason the virtual address has to be randomized >> the same way. > > Aren't we bound by the negative 2GB addressing due to -mcmodel=kernel? > Guys, Please read what I wrote. The 2 GB limit is for the *virtual* mapping. The *physical* mapping, where it lands in RAM, is completely independent, and if you're going to randomize the latter, there is no reason it has to match the former. Instead, randomize it freely. That is different from the i386 kernel which runs at its physical-mapping address. Incidentally, for performance reasons please avoid locating the kernel below CONFIG_PHYSICAL_ADDRESS if possible. Also make sure your code works with more than 128 e820 entries. -hpa -- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/