linux-kernel - Re: [PATCH v2] ACPI: Add config to disable ACPI SPCR console by default on arm64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 21 Jun 2024 07:26:51 -0400
From: Prarit Bhargava <prarit@...hat.com>
To: Liu Wei <liuwei09@...tc.cn>
Cc: catalin.marinas@....com, guohanjun@...wei.com,
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
 lpieralisi@...nel.org, rafael@...nel.org, sudeep.holla@....com,
 will@...nel.org
Subject: Re: [PATCH v2] ACPI: Add config to disable ACPI SPCR console by
 default on arm64

On 6/21/24 00:47, Liu Wei wrote:
> For varying privacy and security reasons, sometimes we would like to
> completely silence the serial console output, and only enable it through
> cmdline when needed.
> 
> But there are many existing systems that depend on this console,
> so add CONFIG_ARM_DISABLE_ACPI_SPCR_CONSOLE for this situation.
> 
> Signed-off-by: Liu Wei <liuwei09@...tc.cn>
> Suggested-by: Prarit Bhargava <prarit@...hat.com>
> ---
> 
> v2: Add a config option suggested by Prarit
> ---
>   arch/arm64/kernel/acpi.c   | 12 ++++++++++++
>   drivers/acpi/arm64/Kconfig | 11 +++++++++++
>   2 files changed, 23 insertions(+)
> 
> diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
> index dba8fcec7f33..3365fabb5cf8 100644
> --- a/arch/arm64/kernel/acpi.c
> +++ b/arch/arm64/kernel/acpi.c
> @@ -227,7 +227,19 @@ void __init acpi_boot_table_init(void)
>   		if (earlycon_acpi_spcr_enable)
>   			early_init_dt_scan_chosen_stdout();
>   	} else {
> +		/*
> +		 * For varying privacy and security reasons, sometimes need
> +		 * to completely silence the serial console output, and only
> +		 * enable it by cmdline when needed.
> +		 * But there are many existing systems that depend on this
> +		 * behavior, so use CONFIG_ARM_DISABLE_ACPI_SPCR_CONSOLE.
> +		 */
> +#ifdef CONFIG_ARM_DISABLE_ACPI_SPCR_CONSOLE
> +		acpi_parse_spcr(earlycon_acpi_spcr_enable, false);
> +#else
>   		acpi_parse_spcr(earlycon_acpi_spcr_enable, true);
> +#endif
> +

I don't think you want a config option here after all.  See my previous 
comment about "acpi=nospcr".  I realized that if you do use a config 
then distros will not have the ability to default 'on', and advise users 
to disable it for their use cases.

Try the 'acpi=nospcr' option.  That should keep everyone happy.

P.

>   		if (IS_ENABLED(CONFIG_ACPI_BGRT))
>   			acpi_table_parse(ACPI_SIG_BGRT, acpi_parse_bgrt);
>   	}
> diff --git a/drivers/acpi/arm64/Kconfig b/drivers/acpi/arm64/Kconfig
> index b3ed6212244c..7e4d860d7089 100644
> --- a/drivers/acpi/arm64/Kconfig
> +++ b/drivers/acpi/arm64/Kconfig
> @@ -21,3 +21,14 @@ config ACPI_AGDI
>   
>   config ACPI_APMT
>   	bool
> +
> +config ARM_DISABLE_ACPI_SPCR_CONSOLE
> +	bool "Disable ACPI SPCR Console by Default on Arm64"
> +	depends on ARM64 && ACPI_SPCR_TABLE
> +	default n
> +	help
> +		For varying privacy and security reasons, sometimes need to
> +		completely silence the serial console output, and only enable
> +		it by kernel cmdline when needed.
> +
> +		Say Y to disable ACPI SPCR console by default.