redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0 

Add a Kconfig entry to control use of the entry trampoline, which allows
us to unmap the kernel whilst running in userspace and improve the
robustness of KASLR.

Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Laura Abbott <labbott@redhat.com>
Tested-by: Shanker Donthineni <shankerd@codeaurora.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
hifive-unleashed-5.1
Will Deacon 2017-11-14 14:41:01 +00:00
parent ea1e3de85e
commit 084eb77cd3
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
arch/arm64/Kconfig
View File

@ -833,6 +833,19 @@ config FORCE_MAX_ZONEORDER
However for 4K, we choose a higher default value, 11 as opposed to 10, giving us
4M allocations matching the default size used by generic code.
config UNMAP_KERNEL_AT_EL0
bool "Unmap kernel when running in userspace (aka \"KAISER\")"
default y
help
Some attacks against KASLR make use of the timing difference between
a permission fault which could arise from a page table entry that is
present in the TLB, and a translation fault which always requires a
page table walk. This option defends against these attacks by unmapping
the kernel whilst running in userspace, therefore forcing translation
faults for all of kernel space.
If unsure, say Y.
menuconfig ARMV8_DEPRECATED
bool "Emulate deprecated/obsolete ARMv8 instructions"
depends on COMPAT