1*4882a593Smuzhiyun.. SPDX-License-Identifier: GPL-2.0 2*4882a593Smuzhiyun 3*4882a593Smuzhiyun=========================== 4*4882a593SmuzhiyunKASLR for Freescale BookE32 5*4882a593Smuzhiyun=========================== 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunThe word KASLR stands for Kernel Address Space Layout Randomization. 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunThis document tries to explain the implementation of the KASLR for 10*4882a593SmuzhiyunFreescale BookE32. KASLR is a security feature that deters exploit 11*4882a593Smuzhiyunattempts relying on knowledge of the location of kernel internals. 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunSince CONFIG_RELOCATABLE has already supported, what we need to do is 14*4882a593Smuzhiyunmap or copy kernel to a proper place and relocate. Freescale Book-E 15*4882a593Smuzhiyunparts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1 16*4882a593Smuzhiyunentries are not suitable to map the kernel directly in a randomized 17*4882a593Smuzhiyunregion, so we chose to copy the kernel to a proper place and restart to 18*4882a593Smuzhiyunrelocate. 19*4882a593Smuzhiyun 20*4882a593SmuzhiyunEntropy is derived from the banner and timer base, which will change every 21*4882a593Smuzhiyunbuild and boot. This not so much safe so additionally the bootloader may 22*4882a593Smuzhiyunpass entropy via the /chosen/kaslr-seed node in device tree. 23*4882a593Smuzhiyun 24*4882a593SmuzhiyunWe will use the first 512M of the low memory to randomize the kernel 25*4882a593Smuzhiyunimage. The memory will be split in 64M zones. We will use the lower 8 26*4882a593Smuzhiyunbit of the entropy to decide the index of the 64M zone. Then we chose a 27*4882a593Smuzhiyun16K aligned offset inside the 64M zone to put the kernel in:: 28*4882a593Smuzhiyun 29*4882a593Smuzhiyun KERNELBASE 30*4882a593Smuzhiyun 31*4882a593Smuzhiyun |--> 64M <--| 32*4882a593Smuzhiyun | | 33*4882a593Smuzhiyun +---------------+ +----------------+---------------+ 34*4882a593Smuzhiyun | |....| |kernel| | | 35*4882a593Smuzhiyun +---------------+ +----------------+---------------+ 36*4882a593Smuzhiyun | | 37*4882a593Smuzhiyun |-----> offset <-----| 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun kernstart_virt_addr 40*4882a593Smuzhiyun 41*4882a593SmuzhiyunTo enable KASLR, set CONFIG_RANDOMIZE_BASE = y. If KASLR is enable and you 42*4882a593Smuzhiyunwant to disable it at runtime, add "nokaslr" to the kernel cmdline. 43