• M
    arm64: KVM: Introduce EL2 VA randomisation · ed57cac8
    Marc Zyngier 提交于
    The main idea behind randomising the EL2 VA is that we usually have
    a few spare bits between the most significant bit of the VA mask
    and the most significant bit of the linear mapping.
    
    Those bits could be a bunch of zeroes, and could be useful
    to move things around a bit. Of course, the more memory you have,
    the less randomisation you get...
    
    Alternatively, these bits could be the result of KASLR, in which
    case they are already random. But it would be nice to have a
    *different* randomization, just to make the job of a potential
    attacker a bit more difficult.
    
    Inserting these random bits is a bit involved. We don't have a spare
    register (short of rewriting all the kern_hyp_va call sites), and
    the immediate we want to insert is too random to be used with the
    ORR instruction. The best option I could come up with is the following
    sequence:
    
    	and x0, x0, #va_mask
    	ror x0, x0, #first_random_bit
    	add x0, x0, #(random & 0xfff)
    	add x0, x0, #(random >> 12), lsl #12
    	ror x0, x0, #(63 - first_random_bit)
    
    making it a fairly long sequence, but one that a decent CPU should
    be able to execute without breaking a sweat. It is of course NOPed
    out on VHE. The last 4 instructions can also be turned into NOPs
    if it appears that there is no free bits to use.
    Acked-by: NCatalin Marinas <catalin.marinas@arm.com>
    Reviewed-by: NJames Morse <james.morse@arm.com>
    Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
    ed57cac8
va_layout.c 4.0 KB