motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-05 08:43:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/arm: add control knob to disable kaslr_seed via DTB

Browse source 
Generally a guest needs an external source of randomness to properly
enable things like address space randomisation. However in a trusted
boot environment where the firmware will cryptographically verify
components having random data in the DTB will cause verification to
fail. Add a control knob so we can prevent this being added to the
system DTB.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-Id: <20220105135009.1584676-22-alex.bennee@linaro.org>
This commit is contained in:
Alex Bennée 2022-01-05 13:49:56 +00:00
parent 7bef20d729
commit 33973e1e1f
3 changed files with 39 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/system/arm/virt.rst
View file

@ -121,6 +121,14 @@ ras
Set ``on``/``off`` to enable/disable reporting host memory errors to a guest
using ACPI and guest external abort exceptions. The default is off.
dtb-kaslr-seed
Set ``on``/``off`` to pass a random seed via the guest dtb
kaslr-seed node (in both "/chosen" and /secure-chosen) to use
for features like address space randomisation. The default is
``on``. You will want to disable it if your trusted boot chain will
verify the DTB it is passed. It would be the responsibility of the
firmware to come up with a seed and pass it on if it wants to.
Linux guest kernel configuration
""""""""""""""""""""""""""""""""