Date: Tue, 10 Sep 2019 13:34:59 +0800 From: Jason Yan <yanaijie@...wei.com> To: Scott Wood <oss@...error.net>, <mpe@...erman.id.au>, <linuxppc-dev@...ts.ozlabs.org>, <diana.craciun@....com>, <christophe.leroy@....fr>, <benh@...nel.crashing.org>, <paulus@...ba.org>, <npiggin@...il.com>, <keescook@...omium.org>, <kernel-hardening@...ts.openwall.com> CC: <wangkefeng.wang@...wei.com>, <linux-kernel@...r.kernel.org>, <jingxiangfeng@...wei.com>, <zhaohongjiang@...wei.com>, <thunder.leizhen@...wei.com>, <fanchengyang@...wei.com>, <yebin10@...wei.com> Subject: Re: [PATCH v6 00/12] implement KASLR for powerpc/fsl_booke/32 Hi Scott, On 2019/8/28 12:05, Scott Wood wrote: > On Fri, 2019-08-09 at 18:07 +0800, Jason Yan wrote: >> This series implements KASLR for powerpc/fsl_booke/32, as a security >> feature that deters exploit attempts relying on knowledge of the location >> of kernel internals. >> >> Since CONFIG_RELOCATABLE has already supported, what we need to do is >> map or copy kernel to a proper place and relocate. > > Have you tested this with a kernel that was loaded at a non-zero address? I > tried loading a kernel at 0x04000000 (by changing the address in the uImage, > and setting bootm_low to 04000000 in U-Boot), and it works without > CONFIG_RANDOMIZE and fails with. > How did you change the load address of the uImage, by changing the kernel config CONFIG_PHYSICAL_START or the "-a/-e" parameter of mkimage? I tried both, but it did not work with or without CONFIG_RANDOMIZE. Thanks, Jason >> Freescale Book-E >> parts expect lowmem to be mapped by fixed TLB entries(TLB1). The TLB1 >> entries are not suitable to map the kernel directly in a randomized >> region, so we chose to copy the kernel to a proper place and restart to >> relocate. >> >> Entropy is derived from the banner and timer base, which will change every >> build and boot. This not so much safe so additionally the bootloader may >> pass entropy via the /chosen/kaslr-seed node in device tree. > > How complicated would it be to directly access the HW RNG (if present) that > early in the boot? It'd be nice if a U-Boot update weren't required (and > particularly concerning that KASLR would appear to work without a U-Boot > update, but without decent entropy). > > -Scott > > > > . >
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.