[PATCH 0/3] LoongArch: Move KASLR to EFI stub to avoid initrd overlap

[PATCH 0/3] LoongArch: Move KASLR to EFI stub to avoid initrd overlap

[WANG Rui]

This series addresses a potential overlap issue between the kernel
image and the initrd when KASLR is enabled.

In the normal boot flow, the bootloader is responsible for loading
both vmlinux and the initrd, and it can guarantee that the two do
not overlap in memory. However, this assumption only holds as long
as neither image changes its location afterwards.

The in-kernel KASLR implementation breaks that assumption. When the
initrd is placed close to the kernel image, randomizing the kernel
location at runtime may move it into the initrd region, leading to
memory corruption early during boot.

To fix this, this series moves the KASLR logic out of the kernel
proper and into the EFI stub. With this change, the final placement
of both the kernel image and the initrd is determined by the EFI
memory allocator. This ensures that the two allocations are
coordinated and cannot overlap.

Functionally, the kernel still supports KASLR as before, but the
randomization now happens before the kernel is entered, rather than
during early kernel relocation.

WANG Rui (3):
  LoongArch: Allow rdtime_h() and rdtime_l() in 64-bit builds
  efi/loongarch: Randomize kernel preferred address for KASLR
  LoongArch: Skip relocation-time KASLR if it has already been applied

 arch/loongarch/Kconfig                   |  2 +-
 arch/loongarch/include/asm/efi.h         |  4 +++-
 arch/loongarch/include/asm/loongarch.h   |  6 ------
 arch/loongarch/kernel/relocate.c         |  4 ++++
 drivers/firmware/efi/libstub/loongarch.c | 16 ++++++++++++++++
 5 files changed, 24 insertions(+), 8 deletions(-)

-- 
2.54.0

[PATCH 1/3] LoongArch: Allow rdtime_h() and rdtime_l() in 64-bit builds

[WANG Rui]

Remove the CONFIG_32BIT guard around rdtime_h() and rdtime_l()
so they can also be used in 64-bit builds.

Signed-off-by: WANG Rui <r@hev.cc>
---
 arch/loongarch/include/asm/loongarch.h | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h
index 2a6bc99177d8..bb2da9c58411 100644
--- a/arch/loongarch/include/asm/loongarch.h
+++ b/arch/loongarch/include/asm/loongarch.h
@@ -1248,8 +1248,6 @@
 
 #ifndef __ASSEMBLER__
 
-#ifdef CONFIG_32BIT
-
 static __always_inline u32 rdtime_h(void)
 {
 	u32 val = 0;
@@ -1274,8 +1272,6 @@ static __always_inline u32 rdtime_l(void)
 	return val;
 }
 
-#else
-
 static __always_inline u64 rdtime_d(void)
 {
 	u64 val = 0;
@@ -1288,8 +1284,6 @@ static __always_inline u64 rdtime_d(void)
 	return val;
 }
 
-#endif
-
 static inline unsigned int get_csr_cpuid(void)
 {
 	return csr_read32(LOONGARCH_CSR_CPUID);
-- 
2.54.0

[PATCH 2/3] efi/loongarch: Randomize kernel preferred address for KASLR

[WANG Rui]

Introduce efi_get_kimg_kaslr_address() to compute the preferred
kernel image address dynamically when CONFIG_RANDOMIZE_BASE is
enabled. The function derives a random offset using EFI-provided
randomness combined with the timer value, and constrains it within
CONFIG_RANDOMIZE_BASE_MAX_OFFSET.

Update EFI_KIMG_PREFERRED_ADDRESS to call this helper so that the
EFI stub can select a randomized load address when KASLR is active,
while preserving the original base address behavior when KASLR is
disabled or nokaslr is specified.

Signed-off-by: WANG Rui <r@hev.cc>
---
 arch/loongarch/Kconfig                   |  2 +-
 arch/loongarch/include/asm/efi.h         |  4 +++-
 drivers/firmware/efi/libstub/loongarch.c | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index 3b042dbb2c41..a5afb70f73d9 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -730,7 +730,7 @@ config RANDOMIZE_BASE
 config RANDOMIZE_BASE_MAX_OFFSET
 	hex "Maximum KASLR offset" if EXPERT
 	depends on RANDOMIZE_BASE
-	range 0x0 0x10000000
+	range 0x20000 0x10000000
 	default "0x01000000"
 	help
 	  When KASLR is active, this provides the maximum offset that will
diff --git a/arch/loongarch/include/asm/efi.h b/arch/loongarch/include/asm/efi.h
index eddc8e79b3fa..f831320efd41 100644
--- a/arch/loongarch/include/asm/efi.h
+++ b/arch/loongarch/include/asm/efi.h
@@ -30,6 +30,8 @@ static inline unsigned long efi_get_kimg_min_align(void)
 	return SZ_2M;
 }
 
-#define EFI_KIMG_PREFERRED_ADDRESS	PHYSADDR(VMLINUX_LOAD_ADDRESS)
+unsigned long efi_get_kimg_kaslr_address(void);
+
+#define EFI_KIMG_PREFERRED_ADDRESS	efi_get_kimg_kaslr_address()
 
 #endif /* _ASM_LOONGARCH_EFI_H */
diff --git a/drivers/firmware/efi/libstub/loongarch.c b/drivers/firmware/efi/libstub/loongarch.c
index 9825f5218137..df67ef8c68ab 100644
--- a/drivers/firmware/efi/libstub/loongarch.c
+++ b/drivers/firmware/efi/libstub/loongarch.c
@@ -38,6 +38,22 @@ static efi_status_t exit_boot_func(struct efi_boot_memmap *map, void *priv)
 	return EFI_SUCCESS;
 }
 
+unsigned long efi_get_kimg_kaslr_address(void)
+{
+	unsigned int random_offset = 0;
+
+#ifdef CONFIG_RANDOMIZE_BASE
+	if (!efi_nokaslr) {
+		efi_get_random_bytes(sizeof(random_offset), (u8 *)&random_offset);
+		random_offset ^= (rdtime_l() << 16);
+		random_offset &= (CONFIG_RANDOMIZE_BASE_MAX_OFFSET - SZ_64K - 1);
+		random_offset = ALIGN(random_offset, SZ_64K) + SZ_64K;
+	}
+#endif
+
+	return PHYSADDR(VMLINUX_LOAD_ADDRESS) + random_offset;
+}
+
 unsigned long __weak kernel_entry_address(unsigned long kernel_addr,
 		efi_loaded_image_t *image)
 {
-- 
2.54.0

[PATCH 3/3] LoongArch: Skip relocation-time KASLR if it has already been applied

[WANG Rui]

When the kernel is relocated during early boot, a randomized load
address may already have been selected and applied. In this case,
performing KASLR again in relocate.c is unnecessary.

Signed-off-by: WANG Rui <r@hev.cc>
---
 arch/loongarch/kernel/relocate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/loongarch/kernel/relocate.c b/arch/loongarch/kernel/relocate.c
index 16f6a9b39659..c36604a81d08 100644
--- a/arch/loongarch/kernel/relocate.c
+++ b/arch/loongarch/kernel/relocate.c
@@ -139,6 +139,10 @@ static inline __init bool kaslr_disabled(void)
 	char *str;
 	const char *builtin_cmdline = CONFIG_CMDLINE;
 
+	/* KASLR is performed during early boot. */
+	if (kaslr_offset())
+		return true;
+
 	str = strstr(builtin_cmdline, "nokaslr");
 	if (str == builtin_cmdline || (str > builtin_cmdline && *(str - 1) == ' ')) {
 		pr_info(KASLR_DISABLED_MESSAGE, "\'nokaslr\'", "built-in");
-- 
2.54.0

Re: [PATCH 2/3] efi/loongarch: Randomize kernel preferred address for KASLR

[Huacai Chen]

Hi, Rui,

On Mon, Apr 27, 2026 at 6:47 PM WANG Rui <r@hev.cc> wrote:
>
> Introduce efi_get_kimg_kaslr_address() to compute the preferred
> kernel image address dynamically when CONFIG_RANDOMIZE_BASE is
> enabled. The function derives a random offset using EFI-provided
> randomness combined with the timer value, and constrains it within
> CONFIG_RANDOMIZE_BASE_MAX_OFFSET.
>
> Update EFI_KIMG_PREFERRED_ADDRESS to call this helper so that the
> EFI stub can select a randomized load address when KASLR is active,
> while preserving the original base address behavior when KASLR is
> disabled or nokaslr is specified.
>
> Signed-off-by: WANG Rui <r@hev.cc>
> ---
>  arch/loongarch/Kconfig                   |  2 +-
>  arch/loongarch/include/asm/efi.h         |  4 +++-
>  drivers/firmware/efi/libstub/loongarch.c | 16 ++++++++++++++++
>  3 files changed, 20 insertions(+), 2 deletions(-)
>
> diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> index 3b042dbb2c41..a5afb70f73d9 100644
> --- a/arch/loongarch/Kconfig
> +++ b/arch/loongarch/Kconfig
> @@ -730,7 +730,7 @@ config RANDOMIZE_BASE
>  config RANDOMIZE_BASE_MAX_OFFSET
>         hex "Maximum KASLR offset" if EXPERT
>         depends on RANDOMIZE_BASE
> -       range 0x0 0x10000000
> +       range 0x20000 0x10000000
Why modify this?

>         default "0x01000000"
>         help
>           When KASLR is active, this provides the maximum offset that will
> diff --git a/arch/loongarch/include/asm/efi.h b/arch/loongarch/include/asm/efi.h
> index eddc8e79b3fa..f831320efd41 100644
> --- a/arch/loongarch/include/asm/efi.h
> +++ b/arch/loongarch/include/asm/efi.h
> @@ -30,6 +30,8 @@ static inline unsigned long efi_get_kimg_min_align(void)
>         return SZ_2M;
>  }
>
> -#define EFI_KIMG_PREFERRED_ADDRESS     PHYSADDR(VMLINUX_LOAD_ADDRESS)
> +unsigned long efi_get_kimg_kaslr_address(void);
> +
> +#define EFI_KIMG_PREFERRED_ADDRESS     efi_get_kimg_kaslr_address()
Can we reuse something in drivers/firmware/efi/libstub/kaslr.c?

>
>  #endif /* _ASM_LOONGARCH_EFI_H */
> diff --git a/drivers/firmware/efi/libstub/loongarch.c b/drivers/firmware/efi/libstub/loongarch.c
> index 9825f5218137..df67ef8c68ab 100644
> --- a/drivers/firmware/efi/libstub/loongarch.c
> +++ b/drivers/firmware/efi/libstub/loongarch.c
> @@ -38,6 +38,22 @@ static efi_status_t exit_boot_func(struct efi_boot_memmap *map, void *priv)
>         return EFI_SUCCESS;
>  }
>
> +unsigned long efi_get_kimg_kaslr_address(void)
> +{
> +       unsigned int random_offset = 0;
> +
> +#ifdef CONFIG_RANDOMIZE_BASE
> +       if (!efi_nokaslr) {
> +               efi_get_random_bytes(sizeof(random_offset), (u8 *)&random_offset);
> +               random_offset ^= (rdtime_l() << 16);
Use get_cycles() then the first patch can be dropped.

Huacai

> +               random_offset &= (CONFIG_RANDOMIZE_BASE_MAX_OFFSET - SZ_64K - 1);
> +               random_offset = ALIGN(random_offset, SZ_64K) + SZ_64K;
> +       }
> +#endif
> +
> +       return PHYSADDR(VMLINUX_LOAD_ADDRESS) + random_offset;
> +}
> +
>  unsigned long __weak kernel_entry_address(unsigned long kernel_addr,
>                 efi_loaded_image_t *image)
>  {
> --
> 2.54.0
>

Re: [PATCH 3/3] LoongArch: Skip relocation-time KASLR if it has already been applied

[Huacai Chen]

Hi, Rui,

On Mon, Apr 27, 2026 at 6:47 PM WANG Rui <r@hev.cc> wrote:
>
> When the kernel is relocated during early boot, a randomized load
> address may already have been selected and applied. In this case,
> performing KASLR again in relocate.c is unnecessary.
>
> Signed-off-by: WANG Rui <r@hev.cc>
> ---
>  arch/loongarch/kernel/relocate.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/arch/loongarch/kernel/relocate.c b/arch/loongarch/kernel/relocate.c
> index 16f6a9b39659..c36604a81d08 100644
> --- a/arch/loongarch/kernel/relocate.c
> +++ b/arch/loongarch/kernel/relocate.c
> @@ -139,6 +139,10 @@ static inline __init bool kaslr_disabled(void)
>         char *str;
>         const char *builtin_cmdline = CONFIG_CMDLINE;
>
> +       /* KASLR is performed during early boot. */
> +       if (kaslr_offset())
> +               return true;
Maybe the "kexec_file" case is also handled by this?

Huacai

> +
>         str = strstr(builtin_cmdline, "nokaslr");
>         if (str == builtin_cmdline || (str > builtin_cmdline && *(str - 1) == ' ')) {
>                 pr_info(KASLR_DISABLED_MESSAGE, "\'nokaslr\'", "built-in");
> --
> 2.54.0
>

Re: [PATCH 2/3] efi/loongarch: Randomize kernel preferred address for KASLR

[hev]

Hi Huacai,

On Mon, Apr 27, 2026 at 9:27 PM Huacai Chen <chenhuacai@kernel.org> wrote:
>
> Hi, Rui,
>
> On Mon, Apr 27, 2026 at 6:47 PM WANG Rui <r@hev.cc> wrote:
> >
> > Introduce efi_get_kimg_kaslr_address() to compute the preferred
> > kernel image address dynamically when CONFIG_RANDOMIZE_BASE is
> > enabled. The function derives a random offset using EFI-provided
> > randomness combined with the timer value, and constrains it within
> > CONFIG_RANDOMIZE_BASE_MAX_OFFSET.
> >
> > Update EFI_KIMG_PREFERRED_ADDRESS to call this helper so that the
> > EFI stub can select a randomized load address when KASLR is active,
> > while preserving the original base address behavior when KASLR is
> > disabled or nokaslr is specified.
> >
> > Signed-off-by: WANG Rui <r@hev.cc>
> > ---
> >  arch/loongarch/Kconfig                   |  2 +-
> >  arch/loongarch/include/asm/efi.h         |  4 +++-
> >  drivers/firmware/efi/libstub/loongarch.c | 16 ++++++++++++++++
> >  3 files changed, 20 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> > index 3b042dbb2c41..a5afb70f73d9 100644
> > --- a/arch/loongarch/Kconfig
> > +++ b/arch/loongarch/Kconfig
> > @@ -730,7 +730,7 @@ config RANDOMIZE_BASE
> >  config RANDOMIZE_BASE_MAX_OFFSET
> >         hex "Maximum KASLR offset" if EXPERT
> >         depends on RANDOMIZE_BASE
> > -       range 0x0 0x10000000
> > +       range 0x20000 0x10000000
> Why modify this?

The reason for changeing the lower bound is to simplify the
random_offset calculation, making sure that
(CONFIG_RANDOMIZE_BASE_MAX_OFFSET - SZ_64K - 1) is always >= 0.

>
> >         default "0x01000000"
> >         help
> >           When KASLR is active, this provides the maximum offset that will
> > diff --git a/arch/loongarch/include/asm/efi.h b/arch/loongarch/include/asm/efi.h
> > index eddc8e79b3fa..f831320efd41 100644
> > --- a/arch/loongarch/include/asm/efi.h
> > +++ b/arch/loongarch/include/asm/efi.h
> > @@ -30,6 +30,8 @@ static inline unsigned long efi_get_kimg_min_align(void)
> >         return SZ_2M;
> >  }
> >
> > -#define EFI_KIMG_PREFERRED_ADDRESS     PHYSADDR(VMLINUX_LOAD_ADDRESS)
> > +unsigned long efi_get_kimg_kaslr_address(void);
> > +
> > +#define EFI_KIMG_PREFERRED_ADDRESS     efi_get_kimg_kaslr_address()
> Can we reuse something in drivers/firmware/efi/libstub/kaslr.c?

This aligns with the kernel's built-in KASLR, ensuring the random
range stays within CONFIG_RANDOMIZE_BASE_MAX_OFFSET. This is also why
we didn't reuse kaslr.c.

>
> >
> >  #endif /* _ASM_LOONGARCH_EFI_H */
> > diff --git a/drivers/firmware/efi/libstub/loongarch.c b/drivers/firmware/efi/libstub/loongarch.c
> > index 9825f5218137..df67ef8c68ab 100644
> > --- a/drivers/firmware/efi/libstub/loongarch.c
> > +++ b/drivers/firmware/efi/libstub/loongarch.c
> > @@ -38,6 +38,22 @@ static efi_status_t exit_boot_func(struct efi_boot_memmap *map, void *priv)
> >         return EFI_SUCCESS;
> >  }
> >
> > +unsigned long efi_get_kimg_kaslr_address(void)
> > +{
> > +       unsigned int random_offset = 0;
> > +
> > +#ifdef CONFIG_RANDOMIZE_BASE
> > +       if (!efi_nokaslr) {
> > +               efi_get_random_bytes(sizeof(random_offset), (u8 *)&random_offset);
> > +               random_offset ^= (rdtime_l() << 16);
> Use get_cycles() then the first patch can be dropped.

I'll use random_get_entropy() here.

Thanks,
Rui


>
> Huacai
>
> > +               random_offset &= (CONFIG_RANDOMIZE_BASE_MAX_OFFSET - SZ_64K - 1);
> > +               random_offset = ALIGN(random_offset, SZ_64K) + SZ_64K;
> > +       }
> > +#endif
> > +
> > +       return PHYSADDR(VMLINUX_LOAD_ADDRESS) + random_offset;
> > +}
> > +
> >  unsigned long __weak kernel_entry_address(unsigned long kernel_addr,
> >                 efi_loaded_image_t *image)
> >  {
> > --
> > 2.54.0
> >

Re: [PATCH 3/3] LoongArch: Skip relocation-time KASLR if it has already been applied

[hev]

Hi Huacai,

On Mon, Apr 27, 2026 at 9:29 PM Huacai Chen <chenhuacai@kernel.org> wrote:
>
> Hi, Rui,
>
> On Mon, Apr 27, 2026 at 6:47 PM WANG Rui <r@hev.cc> wrote:
> >
> > When the kernel is relocated during early boot, a randomized load
> > address may already have been selected and applied. In this case,
> > performing KASLR again in relocate.c is unnecessary.
> >
> > Signed-off-by: WANG Rui <r@hev.cc>
> > ---
> >  arch/loongarch/kernel/relocate.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/arch/loongarch/kernel/relocate.c b/arch/loongarch/kernel/relocate.c
> > index 16f6a9b39659..c36604a81d08 100644
> > --- a/arch/loongarch/kernel/relocate.c
> > +++ b/arch/loongarch/kernel/relocate.c
> > @@ -139,6 +139,10 @@ static inline __init bool kaslr_disabled(void)
> >         char *str;
> >         const char *builtin_cmdline = CONFIG_CMDLINE;
> >
> > +       /* KASLR is performed during early boot. */
> > +       if (kaslr_offset())
> > +               return true;
> Maybe the "kexec_file" case is also handled by this?

Yeah, it looks like kexec_file doesn't load the kernel image to
VMLINUX_LOAD_ADDRESS, so it will disable KASLR here. This aligns with
our expectation of disabling KASLR for this case.

Thanks,
Rui


>
> Huacai
>
> > +
> >         str = strstr(builtin_cmdline, "nokaslr");
> >         if (str == builtin_cmdline || (str > builtin_cmdline && *(str - 1) == ' ')) {
> >                 pr_info(KASLR_DISABLED_MESSAGE, "\'nokaslr\'", "built-in");
> > --
> > 2.54.0
> >