diff options
| author |   Ard Biesheuvel <ard.biesheuvel@linaro.org> | 2016-01-26 14:48:29 +0100 |
|---|---|---|
| committer |   Catalin Marinas <catalin.marinas@arm.com> | 2016-02-24 14:57:29 +0000 |
| commit | 2b5fe07a78a09a32002642b8a823428ade611f16 (patch) | |
| tree | db8929655f2d9de7827d68fbfad1ea08d1cd0e29 /drivers/firmware/efi/libstub/fdt.c | |
| parent | efi: stub: use high allocation for converted command line (diff) | |
| download | linux-dev-2b5fe07a78a09a32002642b8a823428ade611f16.tar.xz linux-dev-2b5fe07a78a09a32002642b8a823428ade611f16.zip | |
arm64: efi: invoke EFI_RNG_PROTOCOL to supply KASLR randomness
Since arm64 does not use a decompressor that supplies an execution
environment where it is feasible to some extent to provide a source of
randomness, the arm64 KASLR kernel depends on the bootloader to supply
some random bits in the /chosen/kaslr-seed DT property upon kernel entry.
On UEFI systems, we can use the EFI_RNG_PROTOCOL, if supplied, to obtain
some random bits. At the same time, use it to randomize the offset of the
kernel Image in physical memory.
Reviewed-by: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Diffstat (limited to 'drivers/firmware/efi/libstub/fdt.c')
| -rw-r--r-- | drivers/firmware/efi/libstub/fdt.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c index cf7b7d46302a..6dba78aef337 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c @@ -147,6 +147,20 @@ efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt, if (status) goto fdt_set_fail; + if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { + efi_status_t efi_status; + + efi_status = efi_get_random_bytes(sys_table, sizeof(fdt_val64), + (u8 *)&fdt_val64); + if (efi_status == EFI_SUCCESS) { + status = fdt_setprop(fdt, node, "kaslr-seed", + &fdt_val64, sizeof(fdt_val64)); + if (status) + goto fdt_set_fail; + } else if (efi_status != EFI_NOT_FOUND) { + return efi_status; + } + } return EFI_SUCCESS; fdt_set_fail: |