From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751482AbeA2RYU (ORCPT ); Mon, 29 Jan 2018 12:24:20 -0500 Received: from foss.arm.com ([217.140.101.70]:43132 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751264AbeA2RYT (ORCPT ); Mon, 29 Jan 2018 12:24:19 -0500 Date: Mon, 29 Jan 2018 17:24:14 +0000 From: Dave Martin To: Suzuki K Poulose Cc: mark.rutland@arm.com, ckadabi@codeaurora.org, ard.biesheuvel@linaro.org, marc.zyngier@arm.com, catalin.marinas@arm.com, will.deacon@arm.com, linux-kernel@vger.kernel.org, jnair@caviumnetworks.com, linux-arm-kernel@lists.infradead.org Subject: Re: [PATCH 10/16] arm64: Make KPTI strict CPU local feature Message-ID: <20180129172414.GC5862@e103592.cambridge.arm.com> References: <20180123122809.16269-1-suzuki.poulose@arm.com> <20180123122809.16269-11-suzuki.poulose@arm.com> <20180126122519.GR5862@e103592.cambridge.arm.com> <4bf35de5-ae61-93b8-f202-52d734997cc5@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4bf35de5-ae61-93b8-f202-52d734997cc5@arm.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jan 26, 2018 at 03:46:59PM +0000, Suzuki K Poulose wrote: > On 26/01/18 12:25, Dave Martin wrote: > >On Tue, Jan 23, 2018 at 12:28:03PM +0000, Suzuki K Poulose wrote: > >>KPTI capability is a security feature which should be enabled > >>when at least one CPU on the system needs it. Any late CPU > >>which needs the kernel support, should be prevented from > >>booting (and thus making the system unsecure) if the feature > >>was not already enabled. > > > >Is there an actual change to behaviour here? > > Yes, we now prevent any new CPU from booting if it *matches* the capability, > which we didn't do earlier. Ok > > > >It's not very obvious from the commit message, or the patch when read in > >isolation. > > > > I will fix the commit message to indicate the current behavior. How about : > > "KPTI is treated as a system wide feature, where we enable the feature > when all the CPUs on the system suffers from the security vulnerability, > unless it is enabled via kernel command line. Also, we ignore a late CPU Maybe "enabled" -> "forcibly enabled", if the command-line really is supposed to have override semantics (which I guess it is). > which might need the defense if the KPTI is not enabled, making the system > insecure. This is not sufficient, as > we should enable the defense when at least one CPU needs it. Also, if > it is not enabled at boot-time, we can no longer enable it when a late > CPU turns up. This patch makes sure that the KPTI is checked on all CPUs There's some repetition here. Does the following work: "[...] command line. Also, if a late CPU needs KPTI but KPTI was not enabled at boot time, the CPU is currently allowed to boot, which is a potential security vulnerability. This patch ensures that late CPUs are rejected as appropriate if they need KPTI but it wasn't enabled." Hmmm. That's no shorter after all. Oh well :P Cheers ---Dave