| Message ID | 20200206025825.22934-7-yanaijie@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | implement KASLR for powerpc/fsl_booke/64 | expand |
Le 06/02/2020 à 03:58, Jason Yan a écrit : > Now we support both 32 and 64 bit KASLR for fsl booke. Add document for > 64 bit part and rename kaslr-booke32.rst to kaslr-booke.rst. > > Signed-off-by: Jason Yan <yanaijie@huawei.com> > Cc: Scott Wood <oss@buserror.net> > Cc: Diana Craciun <diana.craciun@nxp.com> > Cc: Michael Ellerman <mpe@ellerman.id.au> > Cc: Christophe Leroy <christophe.leroy@c-s.fr> > Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> > Cc: Paul Mackerras <paulus@samba.org> > Cc: Nicholas Piggin <npiggin@gmail.com> > Cc: Kees Cook <keescook@chromium.org> > --- > .../{kaslr-booke32.rst => kaslr-booke.rst} | 35 ++++++++++++++++--- > 1 file changed, 31 insertions(+), 4 deletions(-) > rename Documentation/powerpc/{kaslr-booke32.rst => kaslr-booke.rst} (59%) Also update Documentation/powerpc/index.rst ? Christophe
在 2020/2/20 21:50, Christophe Leroy 写道: > > > Le 06/02/2020 à 03:58, Jason Yan a écrit : >> Now we support both 32 and 64 bit KASLR for fsl booke. Add document for >> 64 bit part and rename kaslr-booke32.rst to kaslr-booke.rst. >> >> Signed-off-by: Jason Yan <yanaijie@huawei.com> >> Cc: Scott Wood <oss@buserror.net> >> Cc: Diana Craciun <diana.craciun@nxp.com> >> Cc: Michael Ellerman <mpe@ellerman.id.au> >> Cc: Christophe Leroy <christophe.leroy@c-s.fr> >> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> >> Cc: Paul Mackerras <paulus@samba.org> >> Cc: Nicholas Piggin <npiggin@gmail.com> >> Cc: Kees Cook <keescook@chromium.org> >> --- >> .../{kaslr-booke32.rst => kaslr-booke.rst} | 35 ++++++++++++++++--- >> 1 file changed, 31 insertions(+), 4 deletions(-) >> rename Documentation/powerpc/{kaslr-booke32.rst => kaslr-booke.rst} >> (59%) > > Also update Documentation/powerpc/index.rst ? > Oh yes, thanks for reminding me of this. Thanks, Jason > Christophe > > .
diff --git a/Documentation/powerpc/kaslr-booke32.rst b/Documentation/powerpc/kaslr-booke.rst similarity index 59% rename from Documentation/powerpc/kaslr-booke32.rst rename to Documentation/powerpc/kaslr-booke.rst index 8b259fdfdf03..42121fed8249 100644 --- a/Documentation/powerpc/kaslr-booke32.rst +++ b/Documentation/powerpc/kaslr-booke.rst @@ -1,15 +1,18 @@ .. SPDX-License-Identifier: GPL-2.0 -=========================== -KASLR for Freescale BookE32 -=========================== +========================= +KASLR for Freescale BookE +========================= The word KASLR stands for Kernel Address Space Layout Randomization. This document tries to explain the implementation of the KASLR for -Freescale BookE32. KASLR is a security feature that deters exploit +Freescale BookE. KASLR is a security feature that deters exploit attempts relying on knowledge of the location of kernel internals. +KASLR for Freescale BookE32 +------------------------- + Since CONFIG_RELOCATABLE has already supported, what we need to do is map or copy kernel to a proper place and relocate. Freescale Book-E parts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1 @@ -38,5 +41,29 @@ bit of the entropy to decide the index of the 64M zone. Then we chose a kernstart_virt_addr + +KASLR for Freescale BookE64 +--------------------------- + +The implementation for Freescale BookE64 is similar as BookE32. One +difference is that Freescale BookE64 set up a TLB mapping of 1G during +booting. Another difference is that ppc64 needs the kernel to be +64K-aligned. So we can randomize the kernel in this 1G mapping and make +it 64K-aligned. This can save some code to creat another TLB map at early +boot. The disadvantage is that we only have about 1G/64K = 16384 slots to +put the kernel in:: + + KERNELBASE + + 64K |--> kernel <--| + | | | + +--+--+--+ +--+--+--+--+--+--+--+--+--+ +--+--+ + | | | |....| | | | | | | | | |....| | | + +--+--+--+ +--+--+--+--+--+--+--+--+--+ +--+--+ + | | 1G + |-----> offset <-----| + + kernstart_virt_addr + To enable KASLR, set CONFIG_RANDOMIZE_BASE = y. If KASLR is enable and you want to disable it at runtime, add "nokaslr" to the kernel cmdline.
Now we support both 32 and 64 bit KASLR for fsl booke. Add document for 64 bit part and rename kaslr-booke32.rst to kaslr-booke.rst. Signed-off-by: Jason Yan <yanaijie@huawei.com> Cc: Scott Wood <oss@buserror.net> Cc: Diana Craciun <diana.craciun@nxp.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Christophe Leroy <christophe.leroy@c-s.fr> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Kees Cook <keescook@chromium.org> --- .../{kaslr-booke32.rst => kaslr-booke.rst} | 35 ++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-) rename Documentation/powerpc/{kaslr-booke32.rst => kaslr-booke.rst} (59%)