Re: [sw-dev] SBI extension proposal v2

From: ron minnich <rminnich@gmail.com>
To: Bruce Hoult <brucehoult@sifive.com>
Cc: "mark.rutland@arm.com" <mark.rutland@arm.com>,
	Christoph Hellwig <hch@infradead.org>,
	Damien Le Moal <Damien.LeMoal@wdc.com>,
	Olof Johansson <olof.johansson@gmail.com>,
	"alankao@andestech.com" <alankao@andestech.com>,
	"abner.chang@hpe.com" <abner.chang@hpe.com>,
	Benjamin Herrenschmidt <benh@kernel.crashing.org>,
	Palmer Dabbelt <palmer@sifive.com>,
	Alexander Graf <agraf@suse.de>,
	"zong@andestech.com" <zong@andestech.com>,
	Atish Patra <atish.patra@wdc.com>,
	"sw-dev@groups.riscv.org" <sw-dev@groups.riscv.org>,
	Paul Walmsley <paul.walmsley@sifive.com>,
	Anup Patel <anup@brainfault.org>,
	"mick@ics.forth.gr" <mick@ics.forth.gr>,
	Alistair Francis <Alistair.Francis@wdc.com>,
	Luke Kenneth Casson Leighton <lkcl@lkcl.net>,
	"linux-riscv@lists.infradead.org"
	<linux-riscv@lists.infradead.org>,
	Andrew Waterman <andrew@sifive.com>
Subject: Re: [sw-dev] SBI extension proposal v2
Date: Mon, 28 Jan 2019 20:28:24 -0800	[thread overview]
Message-ID: <CAP6exYJD0Qrnni+yCUBdNWv0tmR=3vYzLwJTy+oOnQEb83ja1g@mail.gmail.com> (raw)
In-Reply-To: <CAP8PnuS4vE-w07dENEpJWx_nu-yx3fsyM3nu3kUQoVFW5nzJcQ@mail.gmail.com>

On Mon, Jan 28, 2019 at 3:22 PM Bruce Hoult <brucehoult@sifive.com> wrote:
>
> On Mon, Jan 28, 2019 at 11:40 AM ron minnich <rminnich@gmail.com> wrote:
> > Short form: if the PMP makes it impossible to measure, disable and
> > replace firmware from the kernel, then PMP is a bug, not a feature.
>
> I disagree.
>
> The owner/user should be able to change the SBI, perhaps by booting
> into a special mode. The kernel in a system running normally shouldn't
> be able to.

The nice thing about riscv is that we can both get what we want here :-)

I can tell you that security-oriented folks I'm working with much
prefer that the kernel be able to measure, selectively disable, or
replace firmware; and then set the PMP registers. The kernel should
drive the security, not firmware, because we have such ample evidence
that firmware is far less secure than kernels, in how it's written,
how it's built, and how it's deployed. In such a world, platforms that
do not allow this will be marked as not trustable.

The good news is that neither you nor I have to to dictate this for
everyone. There are going to be multiple SBI implementations and
firmware implementations for riscv, and we can see where this ends up.
One thing I can say for sure is there won't be just one.

ron

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv