xref: /OK3568_Linux_fs/kernel/Documentation/powerpc/kaslr-booke32.rst (revision 4882a59341e53eb6f0b4789bf948001014eff981)
1*4882a593Smuzhiyun.. SPDX-License-Identifier: GPL-2.0
2*4882a593Smuzhiyun
3*4882a593Smuzhiyun===========================
4*4882a593SmuzhiyunKASLR for Freescale BookE32
5*4882a593Smuzhiyun===========================
6*4882a593Smuzhiyun
7*4882a593SmuzhiyunThe word KASLR stands for Kernel Address Space Layout Randomization.
8*4882a593Smuzhiyun
9*4882a593SmuzhiyunThis document tries to explain the implementation of the KASLR for
10*4882a593SmuzhiyunFreescale BookE32. KASLR is a security feature that deters exploit
11*4882a593Smuzhiyunattempts relying on knowledge of the location of kernel internals.
12*4882a593Smuzhiyun
13*4882a593SmuzhiyunSince CONFIG_RELOCATABLE has already supported, what we need to do is
14*4882a593Smuzhiyunmap or copy kernel to a proper place and relocate. Freescale Book-E
15*4882a593Smuzhiyunparts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1
16*4882a593Smuzhiyunentries are not suitable to map the kernel directly in a randomized
17*4882a593Smuzhiyunregion, so we chose to copy the kernel to a proper place and restart to
18*4882a593Smuzhiyunrelocate.
19*4882a593Smuzhiyun
20*4882a593SmuzhiyunEntropy is derived from the banner and timer base, which will change every
21*4882a593Smuzhiyunbuild and boot. This not so much safe so additionally the bootloader may
22*4882a593Smuzhiyunpass entropy via the /chosen/kaslr-seed node in device tree.
23*4882a593Smuzhiyun
24*4882a593SmuzhiyunWe will use the first 512M of the low memory to randomize the kernel
25*4882a593Smuzhiyunimage. The memory will be split in 64M zones. We will use the lower 8
26*4882a593Smuzhiyunbit of the entropy to decide the index of the 64M zone. Then we chose a
27*4882a593Smuzhiyun16K aligned offset inside the 64M zone to put the kernel in::
28*4882a593Smuzhiyun
29*4882a593Smuzhiyun    KERNELBASE
30*4882a593Smuzhiyun
31*4882a593Smuzhiyun        |-->   64M   <--|
32*4882a593Smuzhiyun        |               |
33*4882a593Smuzhiyun        +---------------+    +----------------+---------------+
34*4882a593Smuzhiyun        |               |....|    |kernel|    |               |
35*4882a593Smuzhiyun        +---------------+    +----------------+---------------+
36*4882a593Smuzhiyun        |                         |
37*4882a593Smuzhiyun        |----->   offset    <-----|
38*4882a593Smuzhiyun
39*4882a593Smuzhiyun                              kernstart_virt_addr
40*4882a593Smuzhiyun
41*4882a593SmuzhiyunTo enable KASLR, set CONFIG_RANDOMIZE_BASE = y. If KASLR is enable and you
42*4882a593Smuzhiyunwant to disable it at runtime, add "nokaslr" to the kernel cmdline.
43