iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

powerpc/fsl_booke/32: Document KASLR implementation

Browse Source 
Add document to explain how we implement KASLR for fsl_booke32.

Signed-off-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Scott Wood <oss@buserror.net>
[mpe: Add it to the index as well]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
This commit is contained in:
Jason Yan 2019-09-20 17:45:46 +08:00 committed by Michael Ellerman
parent 74277f00b2
commit c2d1a13520
2 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Documentation/powerpc/index.rst
View File

@ -19,6 +19,7 @@ powerpc
firmware-assisted-dump
hvcs
isa-versions
kaslr-booke32
mpc52xx
pci_iov_resource_on_powernv
pmu-ebb

42
Documentation/powerpc/kaslr-booke32.rst Normal file
View File

@ -0,0 +1,42 @@
.. SPDX-License-Identifier: GPL-2.0
===========================
KASLR for Freescale BookE32
===========================
The word KASLR stands for Kernel Address Space Layout Randomization.
This document tries to explain the implementation of the KASLR for
Freescale BookE32. KASLR is a security feature that deters exploit
attempts relying on knowledge of the location of kernel internals.
Since CONFIG_RELOCATABLE has already supported, what we need to do is
map or copy kernel to a proper place and relocate. Freescale Book-E
parts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1
entries are not suitable to map the kernel directly in a randomized
region, so we chose to copy the kernel to a proper place and restart to
relocate.
Entropy is derived from the banner and timer base, which will change every
build and boot. This not so much safe so additionally the bootloader may
pass entropy via the /chosen/kaslr-seed node in device tree.
We will use the first 512M of the low memory to randomize the kernel
image. The memory will be split in 64M zones. We will use the lower 8
bit of the entropy to decide the index of the 64M zone. Then we chose a
16K aligned offset inside the 64M zone to put the kernel in::
KERNELBASE
|--> 64M <--|
| |
+---------------+ +----------------+---------------+
| |....| |kernel| | |
+---------------+ +----------------+---------------+
| |
|-----> offset <-----|
kernstart_virt_addr
To enable KASLR, set CONFIG_RANDOMIZE_BASE = y. If KASLR is enable and you
want to disable it at runtime, add "nokaslr" to the kernel cmdline.