feat(v2): improve aslr, adjust max memory size

Author: n0toose

src/arch/aarch64/mod.rs

@@ -2,11 +2,10 @@ use std::mem::size_of;
 
 use align_address::Align;
 use bitflags::bitflags;
-use rand::RngExt;
 use uhyve_interface::{GuestPhysAddr, GuestVirtAddr};
 
 use crate::{
-	consts::{KERNEL_OFFSET, PAGETABLES_END, PAGETABLES_OFFSET, PGT_OFFSET},
+	consts::{PAGETABLES_END, PAGETABLES_OFFSET, PGT_OFFSET},
 	mem::MmapMemory,
 	paging::{BumpAllocator, PagetableError},
 };
@@ -71,19 +70,6 @@ pub const TCR_FLAGS: u64 = TCR_IRGN_WBWA | TCR_ORGN_WBWA | TCR_SHARED;
 /// Number of virtual address bits for 4KB page
 pub const VA_BITS: u64 = 48;
 
-/// Generates a random guest address for Uhyve's virtualized memory.
-/// This function gets invoked when a new UhyveVM gets created, provided that the object file is relocatable.
-pub(crate) fn generate_address(object_mem_size: usize) -> GuestPhysAddr {
-	let mut rng = rand::rng();
-	let start_address_upper_bound: u64 =
-		0x0000_0010_0000_0000 - object_mem_size as u64 - KERNEL_OFFSET;
-
-	GuestPhysAddr::new(
-		rng.random_range(RAM_START.as_u64()..start_address_upper_bound)
-			.align_down(0x20_0000),
-	)
-}
-
 #[inline(always)]
 pub const fn tcr_size(x: u64) -> u64 {
 	((64 - x) << 16) | (64 - x)

src/arch/mod.rs

@@ -1,4 +1,10 @@
+use align_address::Align;
+use hermit_entry::UhyveIfVersion;
+use rand::RngExt;
 use thiserror::Error;
+use uhyve_interface::GuestPhysAddr;
+
+use crate::consts::KERNEL_OFFSET;
 
 #[derive(Error, Debug)]
 #[error("Frequency detection failed")]
@@ -15,3 +21,51 @@ pub mod aarch64;
 
 #[cfg(target_arch = "aarch64")]
 pub use self::aarch64::*;
+
+/// Generates a random guest address for Uhyve's virtualized memory.
+/// This function gets invoked when a new UhyveVM gets created, provided that the object file is relocatable.
+pub(crate) fn generate_address(
+	interface_version: UhyveIfVersion,
+	aslr: bool,
+	object_mem_size: usize,
+	mem_size: usize,
+) -> GuestPhysAddr {
+	let (start_address_lb, start_address_ub): (u64, u64) = {
+		let tmp: (u64, Option<u64>) = match interface_version {
+			UhyveIfVersion(1) => {
+				// Workaround for x86_64-specific PCI holes.
+				#[cfg(target_arch = "aarch64")]
+				const V1_MAX_ADDR: u64 = 0x0000_0010_0000_0000u64;
+				#[cfg(target_arch = "x86_64")]
+				const V1_MAX_ADDR: u64 = 0x0000_0000_CFF0_0000u64;
+				(
+					RAM_START.as_u64(),
+					V1_MAX_ADDR.checked_sub((object_mem_size + mem_size) as u64 - KERNEL_OFFSET),
+				)
+			}
+			UhyveIfVersion(2) => (
+				0x0000_0001_0000_0000u64,
+				0x0000_0010_0000_0000u64
+					.checked_sub((object_mem_size + mem_size) as u64 - KERNEL_OFFSET),
+			),
+			_ => unimplemented!(),
+		};
+		(
+			tmp.0,
+			tmp.1.unwrap_or_else(|| {
+				panic!("Memory size {mem_size:#x} is higher than maximum upper boundary.")
+			}),
+		)
+	};
+
+	match aslr {
+		true => {
+			let mut rng = rand::rng();
+			GuestPhysAddr::new(
+				rng.random_range(start_address_lb..start_address_ub)
+					.align_down(0x20_0000),
+			)
+		}
+		false => GuestPhysAddr::new(start_address_lb),
+	}
+}

src/arch/x86_64/mod.rs

@@ -1,33 +1,17 @@
 mod paging;
 pub(crate) mod registers;
 
-use align_address::Align;
 use paging::initialize_pagetables;
-use rand::RngExt;
 use uhyve_interface::{GuestPhysAddr, GuestVirtAddr};
 use x86_64::structures::paging::{
 	PageTable, PageTableIndex,
 	page_table::{FrameError, PageTableEntry},
 };
 
-use crate::{consts::KERNEL_OFFSET, mem::MmapMemory, paging::PagetableError};
+use crate::{mem::MmapMemory, paging::PagetableError};
 
 pub const RAM_START: GuestPhysAddr = GuestPhysAddr::new(0x00);
 
-/// Generates a random guest address for Uhyve's virtualized memory.
-/// This function gets invoked when a new UhyveVM gets created, provided that the object file is relocatable.
-pub(crate) fn generate_address(object_mem_size: usize) -> GuestPhysAddr {
-	let mut rng = rand::rng();
-	// TODO: Also allow mappings beyond the 32 Bit gap
-	let start_address_upper_bound: u64 =
-		0x0000_0000_CFF0_0000 - object_mem_size as u64 - KERNEL_OFFSET;
-
-	GuestPhysAddr::new(
-		rng.random_range(0x0..start_address_upper_bound)
-			.align_down(0x20_0000),
-	)
-}
-
 /// Converts a virtual address in the guest to a physical address in the guest
 pub(crate) fn virt_to_phys(
 	addr: GuestVirtAddr,

src/linux/x86_64/kvm_cpu.rs

@@ -68,36 +68,46 @@ impl VirtualizationBackendInternal for KvmVm {
 		Ok(kvcpu)
 	}
 
-	fn new(
-		peripherals: Arc<VmPeripherals>,
-		params: &Params,
-		_guest_addr: GuestPhysAddr,
-	) -> HypervisorResult<Self> {
+	fn new(peripherals: Arc<VmPeripherals>, params: &Params) -> HypervisorResult<Self> {
 		let vm = KVM.create_vm().unwrap();
 
-		let sz = std::cmp::min(peripherals.mem.size(), KVM_32BIT_GAP_START);
-
-		let kvm_mem = kvm_userspace_memory_region {
-			slot: 0,
-			flags: 0, // Can be KVM_MEM_LOG_DIRTY_PAGES and KVM_MEM_READONLY
-			memory_size: sz as u64,
-			guest_phys_addr: peripherals.mem.guest_addr().as_u64(),
-			userspace_addr: peripherals.mem.host_start() as u64,
-		};
+		// Instead of distinguishing between different interface versions, we can just
+		// assume the desired layout based on the guest address generated during UhyveVm's
+		// initialization. Assumes that the sizes have already been checked.
+		if peripherals.mem.guest_addr().as_usize() < KVM_32BIT_MAX_MEM_SIZE {
+			let sz = std::cmp::min(peripherals.mem.size(), KVM_32BIT_GAP_START);
+			let kvm_mem = kvm_userspace_memory_region {
+				slot: 0,
+				flags: 0, // Can be KVM_MEM_LOG_DIRTY_PAGES and KVM_MEM_READONLY
+				memory_size: sz as u64,
+				guest_phys_addr: peripherals.mem.guest_addr().as_u64(),
+				userspace_addr: peripherals.mem.host_start() as u64,
+			};
 
-		unsafe { vm.set_user_memory_region(kvm_mem) }?;
+			unsafe { vm.set_user_memory_region(kvm_mem) }?;
 
-		if peripherals.mem.size() > KVM_32BIT_GAP_START + KVM_32BIT_GAP_SIZE {
+			if peripherals.mem.size() > KVM_32BIT_GAP_START + KVM_32BIT_GAP_SIZE {
+				let kvm_mem = kvm_userspace_memory_region {
+					slot: 1,
+					flags: 0, // Can be KVM_MEM_LOG_DIRTY_PAGES and KVM_MEM_READONLY
+					memory_size: (peripherals.mem.size() - KVM_32BIT_GAP_START - KVM_32BIT_GAP_SIZE)
+						as u64,
+					guest_phys_addr: peripherals.mem.guest_addr().as_u64()
+						+ (KVM_32BIT_GAP_START + KVM_32BIT_GAP_SIZE) as u64,
+					userspace_addr: (peripherals.mem.host_start() as usize
+						+ KVM_32BIT_GAP_START
+						+ KVM_32BIT_GAP_SIZE) as u64,
+				};
+
+				unsafe { vm.set_user_memory_region(kvm_mem) }?;
+			}
+		} else {
 			let kvm_mem = kvm_userspace_memory_region {
-				slot: 1,
+				slot: 0,
 				flags: 0, // Can be KVM_MEM_LOG_DIRTY_PAGES and KVM_MEM_READONLY
-				memory_size: (peripherals.mem.size() - KVM_32BIT_GAP_START - KVM_32BIT_GAP_SIZE)
-					as u64,
-				guest_phys_addr: peripherals.mem.guest_addr().as_u64()
-					+ (KVM_32BIT_GAP_START + KVM_32BIT_GAP_SIZE) as u64,
-				userspace_addr: (peripherals.mem.host_start() as usize
-					+ KVM_32BIT_GAP_START
-					+ KVM_32BIT_GAP_SIZE) as u64,
+				memory_size: peripherals.mem.size() as u64,
+				guest_phys_addr: peripherals.mem.guest_addr().as_u64(),
+				userspace_addr: peripherals.mem.host_start() as u64,
 			};
 
 			unsafe { vm.set_user_memory_region(kvm_mem) }?;

src/macos/aarch64/vcpu.rs

@@ -56,23 +56,19 @@ impl VirtualizationBackendInternal for XhyveVm {
 		})
 	}
 
-	fn new(
-		peripherals: Arc<VmPeripherals>,
-		_params: &Params,
-		guest_addr: GuestPhysAddr,
-	) -> HypervisorResult<Self> {
+	fn new(peripherals: Arc<VmPeripherals>, _params: &Params) -> HypervisorResult<Self> {
 		trace!("Create VM...");
 		create_vm()?;
 
 		trace!("Map guest memory...");
 		map_mem(
 			unsafe { peripherals.mem.as_slice_mut() },
-			guest_addr.as_u64(),
+			peripherals.mem.guest_addr().as_u64(),
 			MemPerm::ExecReadWrite,
 		)?;
 		// protect the first page for hypercall
 		// Apple uses on aarch64 default page size of 16K
-		protect_mem(guest_addr.as_u64(), 0x4000, MemPerm::None)?;
+		protect_mem(peripherals.mem.guest_addr().as_u64(), 0x4000, MemPerm::None)?;
 
 		trace!("Create GIC...");
 		let gic = Gic::new(GICD_BASE_ADDRESS, GICR_BASE_ADDRESS, MSI_BASE_ADDRESS)?;

src/vm.rs

@@ -62,8 +62,6 @@ pub type DefaultBackend = crate::macos::XhyveVm;
 pub(crate) mod internal {
 	use std::sync::Arc;
 
-	use uhyve_interface::GuestPhysAddr;
-
 	use crate::{
 		HypervisorResult,
 		vcpu::VirtualCPU,
@@ -83,11 +81,7 @@ pub(crate) mod internal {
 			enable_stats: bool,
 		) -> HypervisorResult<Self::VCPU>;
 
-		fn new(
-			peripherals: Arc<VmPeripherals>,
-			params: &Params,
-			guest_addr: GuestPhysAddr,
-		) -> HypervisorResult<Self>;
+		fn new(peripherals: Arc<VmPeripherals>, params: &Params) -> HypervisorResult<Self>;
 	}
 }
 
@@ -152,6 +146,18 @@ impl<VirtBackend: VirtualizationBackend> UhyveVm<VirtBackend> {
 			info!("Loading a pre Hermit v0.10.0 kernel");
 		}
 
+		// Kernels with different Uhyve interface versions may have differing addresses for the
+		// serial port. As we begun embedding the uhyve-interface version in unikernel images
+		// much later than v1, but before v2, we assume that all images that don't have a version
+		// embedded must be v1.
+		//
+		// Further, it is used for establishing an appropriate random start addrses for ASLR.
+		let uhyve_interface_version = object
+			.uhyve_interface_version()
+			.unwrap_or(UhyveIfVersion(1));
+
+		debug!("Detected Uhyve interface version: {uhyve_interface_version}");
+
 		// The memory layout of uhyve looks as follows:
 		//
 		//     0x0000_0000 ┌───────────────────┐
@@ -186,11 +192,12 @@ impl<VirtBackend: VirtualizationBackend> UhyveVm<VirtBackend> {
 			}
 			(arch::RAM_START, GuestPhysAddr::from(start_addr))
 		} else {
-			let guest_address = if params.aslr {
-				generate_address(object.mem_size())
-			} else {
-				arch::RAM_START
-			};
+			let guest_address = generate_address(
+				uhyve_interface_version,
+				params.aslr,
+				object.mem_size(),
+				memory_size,
+			);
 			(guest_address, (guest_address + KERNEL_OFFSET))
 		};
 
@@ -266,8 +273,7 @@ impl<VirtBackend: VirtualizationBackend> UhyveVm<VirtBackend> {
 			serial,
 		});
 
-		let virt_backend =
-			VirtBackend::BACKEND::new(peripherals.clone(), &kernel_info.params, guest_address)?;
+		let virt_backend = VirtBackend::BACKEND::new(peripherals.clone(), &kernel_info.params)?;
 
 		let cpu_count = kernel_info.params.cpu_count.get();
 
@@ -290,14 +296,6 @@ impl<VirtBackend: VirtualizationBackend> UhyveVm<VirtBackend> {
 
 		let freq = vcpus[0].get_cpu_frequency();
 
-		// Kernels with different Uhyve interface versions may have differing addresses for the
-		// serial port. As we begun embedding the uhyve-interface version in unikernel images
-		// much later than v1, but before v2, we assume that all images that don't have a version
-		// embedded must be v1.
-		let uhyve_interface_version = object
-			.uhyve_interface_version()
-			.unwrap_or(UhyveIfVersion(1));
-
 		let serial_port = SerialPortBase::new(match uhyve_interface_version.0 {
 			1 => uhyve_interface::v1::HypercallAddress::Uart as _,
 			2 => uhyve_interface::v2::HypercallAddress::SerialWriteBuffer as _,