Reputation: 352
I am attempting to implement KASLR in the xv6 kernel, so i need to recompile/link the kernel in a dynamic way(relocation table). Since the kernel is currently hardcoded, even if I change the kernel code and data mappings, the instructions will still reference hardcoded virtual addresses. I need a way for the instructions to reference other parts of the elf without hardcoded addresses. An example of this is below: This is a sample of how it looks after current compilation:
8010018e: 83 ec 0c sub $0xc,%esp
80100191: 68 a7 79 10 80 push $0x801079a7
80100196: e8 b5 01 00 00 call 80100350 <panic>
8010019b: 90 nop
8010019c: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi.
As you can see, the instructions such as the push instruction reference hardcoded v addresses($0x801079a7). This is because this elf is compiled in a static way with no relocations:(readelf printout)
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x001000 0x80100000 0x00100000 0x0b516 0x15668 RWE 0x1000
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
Section to Segment mapping:
Segment Sections...
00 .text .rodata .stab .stabstr .data .bss
01
There is no dynamic section in this file.
There are no relocations in this file.
I need advice on how to recompile a statically linked elf binary to one with relocation and then be able to map the kernel anywhere in virtual memory. Additionally, what would I have to modify in the bootloader for parsing the elf to load it correctly with relocation? Will I have to custom parse a GOT included in the kernel elf?
The following is a linker script to compile the kernel and essentially set its base hardcoded virtual address: 0x80100000
OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
OUTPUT_ARCH(i386)
ENTRY(_start)
SECTIONS
{
/* Link the kernel at this address: "." means the current address */
/* Must be equal to KERNLINK */
. = 0x80100000;
.text : AT(0x100000) {
*(.text .stub .text.* .gnu.linkonce.t.*)
}
PROVIDE(etext = .); /* Define the 'etext' symbol to this value */
.rodata : {
*(.rodata .rodata.* .gnu.linkonce.r.*)
}
/* Include debugging information in kernel memory */
.stab : {
PROVIDE(__STAB_BEGIN__ = .);
*(.stab);
PROVIDE(__STAB_END__ = .);
BYTE(0) /* Force the linker to allocate space
for this section */
}
.stabstr : {
PROVIDE(__STABSTR_BEGIN__ = .);
*(.stabstr);
PROVIDE(__STABSTR_END__ = .);
BYTE(0) /* Force the linker to allocate space
for this section */
}
/* Adjust the address for the data segment to the next page */
. = ALIGN(0x1000);
/* Conventionally, Unix linkers provide pseudo-symbols
* etext, edata, and end, at the end of the text, data, and bss.
* For the kernel mapping, we need the address at the beginning
* of the data section, but that's not one of the conventional
* symbols, because the convention started before there was a
* read-only rodata section between text and data. */
PROVIDE(data = .);
/* The data segment */
.data : {
*(.data)
}
PROVIDE(edata = .);
.bss : {
*(.bss)
}
PROVIDE(end = .);
/DISCARD/ : {
*(.eh_frame .note.GNU-stack)
}
}
Upvotes: 1
Views: 158
Reputation: 352
It looks like I would have to modify the xv6 bootloader and rewrite much of the os to accomplish a dynamic kernel.
Upvotes: 1