[tedunangst]

The typical approach of sliding the kernel around only offers limited benefit. One leaked address and you're done.

The current approach, called KARL, relinks the kernel so that while it may load at the same address, symbols internally do not have the same offset. Learning the address of printf will not reveal the address of malloc and so forth. In the context of kernel defense, I would argue this is more effective.

Also, simply as a practical matter, the bootloader and kernel are tightly coupled in ways that make altering the load address a nontrivial endeavor.

[dcbadacd]

Why not both KARL and KASLR though?

[ben_bai]

KARL also includes a random offset in front of the kernel, and the bootstrap code is unlinked once the machine has booted.

    |---------------kernel-----------------|
    |-boot-|-rnd offset-|--running kernel--|

[tedunangst]

Nontrivial endeavor.