linux-kernel - Re: [PATCH 0/3] arm64: cpufeature: Add filter function to control

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6dfdf691b5ed57df81c4c61422949af5@misterjones.org>
Date:   Mon, 11 Jan 2021 13:40:48 +0000
From:   Marc Zyngier <maz@...nel.org>
To:     Srinivas Ramana <sramana@...eaurora.org>
Cc:     catalin.marinas@....com, will@...nel.org, pajay@....qualcomm.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        linux-doc@...r.kernel.org, linux-arm-msm@...r.kernel.org
Subject: Re: [PATCH 0/3] arm64: cpufeature: Add filter function to control

Hi Srinivas,

On 2021-01-09 00:29, Srinivas Ramana wrote:
> This patchset adds a control function for cpufeature framework
> so that the feature can be controlled at runtime.
> 
> Defer PAC on boot core and use the filter function added to disable
> PAC from command line. This will help toggling the feature on systems
> that do not support PAC or where PAC needs to be disabled at runtime,
> without modifying the core kernel.
> 
> The idea of adding the filter function for cpufeature is taken from
> https://lore.kernel.org/linux-arm-kernel/20200515171612.1020-25-catalin.marinas@arm.com/
> https://lore.kernel.org/linux-arm-kernel/20200515171612.1020-24-catalin.marinas@arm.com/
> 
> Srinivas Ramana (3):
>   arm64: Defer enabling pointer authentication on boot core
>   arm64: cpufeature: Add a filter function to cpufeature
>   arm64: Enable control of pointer authentication using early param
> 
>  Documentation/admin-guide/kernel-parameters.txt |  6 +++
>  arch/arm64/include/asm/cpufeature.h             |  8 +++-
>  arch/arm64/include/asm/pointer_auth.h           | 10 +++++
>  arch/arm64/include/asm/stackprotector.h         |  1 +
>  arch/arm64/kernel/cpufeature.c                  | 53 
> +++++++++++++++++++------
>  arch/arm64/kernel/head.S                        |  4 --
>  6 files changed, 64 insertions(+), 18 deletions(-)

I've been working for some time on a similar series to allow a feature
set to be disabled during the early boot phase, initially to prevent
booting a kernel with VHE, but the mechanism is generic enough to
deal with most architectural features.

I took the liberty to lift your first patch and to add it to my 
series[1],
further allowing PAuth to be disabled at boot time on top of BTI and 
VHE.

I'd appreciate your comments on this.

Thanks,

         M.

[1] https://lore.kernel.org/r/20210111132811.2455113-1-maz@kernel.org
-- 
Jazz is not dead. It just smells funny...