From 84fe419dc7578b03e721b9bd6eb07947db70fd0e Mon Sep 17 00:00:00 2001 From: Alexandre Ghiti Date: Sat, 22 Jul 2023 14:38:46 +0200 Subject: riscv: Introduce virtual kernel mapping KASLR KASLR implementation relies on a relocatable kernel so that we can move the kernel mapping. The seed needed to virtually move the kernel is taken from the device tree, so we rely on the bootloader to provide a correct seed. Zkr could be used unconditionnally instead if implemented, but that's for another patch. Signed-off-by: Alexandre Ghiti Tested-by: Conor Dooley Tested-by: Song Shuai Reviewed-by: Sami Tolvanen Tested-by: Sami Tolvanen Link: https://lore.kernel.org/r/20230722123850.634544-2-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt --- arch/riscv/Kconfig | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'arch/riscv/Kconfig') diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index 4c07b9189c86..6a606d5b74c6 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -719,6 +719,25 @@ config RELOCATABLE If unsure, say N. +config RANDOMIZE_BASE + bool "Randomize the address of the kernel image" + select RELOCATABLE + depends on MMU && 64BIT && !XIP_KERNEL + help + Randomizes the virtual address at which the kernel image is + loaded, as a security feature that deters exploit attempts + relying on knowledge of the location of kernel internals. + + It is the bootloader's job to provide entropy, by passing a + random u64 value in /chosen/kaslr-seed at kernel entry. + + When booting via the UEFI stub, it will invoke the firmware's + EFI_RNG_PROTOCOL implementation (if available) to supply entropy + to the kernel proper. In addition, it will randomise the physical + location of the kernel Image as well. + + If unsure, say N. + endmenu # "Kernel features" menu "Boot options" -- cgit v1.2.3