diff options
| author | Matt Redfearn <matt.redfearn@imgtec.com> | 2016-03-31 10:05:41 +0100 |
|---|---|---|
| committer | Ralf Baechle <ralf@linux-mips.org> | 2016-05-13 14:02:03 +0200 |
| commit | 405bc8fd12f59ec865714447b2f6e1a961f49025 (patch) | |
| tree | 1275cca041902f31c5b4cb8b5e6b7776bd246a22 /arch/mips/Kconfig | |
| parent | 5e7c1c918a4433c5dd1844d99f5648e17425fa16 (diff) | |
| download | linux-405bc8fd12f59ec865714447b2f6e1a961f49025.tar.bz2 | |
MIPS: Kernel: Implement KASLR using CONFIG_RELOCATABLE
This patch adds KASLR to the MIPS kernel.
Entropy is derived from the banner, which will change every build and
random_get_entropy() which should provide additional runtime entropy.
Additionally the bootloader may pass entropy via the /chosen/kaslr-seed
node in device tree.
The kernel is relocated by up to RANDOMIZE_BASE_MAX_OFFSET bytes from
its link address (PHYSICAL_START). Because relocation happens so early
in the kernel boot, the amount of physical memory has not yet been
determined. This means the only way to limit relocation within the
available memory is via Kconfig.
Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: kernel-hardening@lists.openwall.com
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/12990/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Diffstat (limited to 'arch/mips/Kconfig')
| -rw-r--r-- | arch/mips/Kconfig | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig index 7040a6bcc74f..68ddb45d6258 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig @@ -2507,6 +2507,36 @@ config RELOCATION_TABLE_SIZE If unsure, leave at the default value. +config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" + depends on RELOCATABLE + ---help--- + Randomizes the physical and virtual address at which the + kernel image is loaded, as a security feature that + deters exploit attempts relying on knowledge of the location + of kernel internals. + + Entropy is generated using any coprocessor 0 registers available. + + The kernel will be offset by up to RANDOMIZE_BASE_MAX_OFFSET. + + If unsure, say N. + +config RANDOMIZE_BASE_MAX_OFFSET + hex "Maximum kASLR offset" if EXPERT + depends on RANDOMIZE_BASE + range 0x0 0x40000000 if EVA || 64BIT + range 0x0 0x08000000 + default "0x01000000" + ---help--- + When kASLR is active, this provides the maximum offset that will + be applied to the kernel image. It should be set according to the + amount of physical RAM available in the target system minus + PHYSICAL_START and must be a power of 2. + + This is limited by the size of KSEG0, 256Mb on 32-bit or 1Gb with + EVA or 64-bit. The default is 16Mb. + config NODES_SHIFT int default "6" |