lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 24 Jun 2022 14:19:59 +0100
From:   Will Deacon <will@...nel.org>
To:     Ard Biesheuvel <ardb@...nel.org>
Cc:     linux-arm-kernel@...ts.infradead.org,
        linux-hardening@...r.kernel.org, Marc Zyngier <maz@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Kees Cook <keescook@...omium.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Mark Brown <broonie@...nel.org>,
        Anshuman Khandual <anshuman.khandual@....com>
Subject: Re: [PATCH v4 00/26] arm64: refactor boot flow and add support for
 WXN

Hi Ard,

On Mon, Jun 13, 2022 at 04:45:24PM +0200, Ard Biesheuvel wrote:
> [ TL;DR this series does the following:
>   - move variable definitions and assignments out of early asm code
>     where possible, and get rid of explicit cache maintenance;
>   - convert initial ID map so it covers the entire loaded image as well
>     as the DT blob;
>   - create the kernel mapping only once instead of twice (for KASLR),
>     and do it with the MMU and caches on;
>   - avoid mappings that are both writable and executable entirely;
>   - avoid parsing the DT while the kernel text and rodata are still
>     mapped writable;
>   - allow WXN to be enabled (with an opt-out) so writable mappings are
>     never executable. ]

I really like this series -- it removes quite a few ugly warts from our
boot assembly that we've collected over the years and, while functional,
they have never been particularly satisfactory. Thank you for putting it
together.

I've left a handful of minor comments on some of the patches and if you
can address those then I'd like to queue the first 21 patches ASAP to
give them some more exposure before the next merge window.

The remaining patches are the WXN pieces, which I'd like to give others
a chance to chime in on first.

Cheers,

Will

Powered by blists - more mailing lists