Re: [PATCH] arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: Will Deacon <will.deacon@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>,
	John Garry <john.garry@huawei.com>,
	Linuxarm <linuxarm@huawei.com>, James Morse <james.morse@arm.com>,
	huangdaode <huangdaode@hisilicon.com>,
	"Guohanjun \(Hanjun Guo\)" <guohanjun@huawei.com>,
	linux-arm-kernel <linux-arm-kernel@lists.infradead.org>
Subject: Re: [PATCH] arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on
Date: Fri, 1 Mar 2019 12:46:51 +0100	[thread overview]
Message-ID: <CAKv+Gu-gMi+G4eF3yEJJuWvQTtDr82A-xSstgCVLbidmkwUBgA@mail.gmail.com> (raw)
In-Reply-To: <20190301114515.GA22795@fuggles.cambridge.arm.com>

On Fri, 1 Mar 2019 at 12:45, Will Deacon <will.deacon@arm.com> wrote:
>
> On Fri, Mar 01, 2019 at 12:43:01PM +0100, Ard Biesheuvel wrote:
> > On Fri, 1 Mar 2019 at 12:35, Will Deacon <will.deacon@arm.com> wrote:
> > >
> > > On Fri, Mar 01, 2019 at 11:18:21AM +0000, John Garry wrote:
> > > > On 16/01/2019 09:38, John Garry wrote:
> > > > > On 15/01/2019 18:49, James Morse wrote:
> > > > > > Since commit b89d82ef01b3 ("arm64: kpti: Avoid rewriting early page
> > > > >
> > > > > About b89d82ef01b3, I got an *unconfirmed* (emphasis on this, I don't
> > > > > want to cry wolf) report yesterday that the symptom I saw (boot delay)
> > > > > has been seen on 5.0-rc2 on our D06 board. I could not see it.
> > > > >
> > > > > Please note that this would be same board which we saw this on:
> > > > > https://lkml.org/lkml/2018/6/20/589
> > > > >
> > > > > I only witnessed the issue on the predecessor A72-based D05 board.
> > > > >
> > > > > The reporter is very busy, but we'll keep tabs on it.
> > > > >
> > > >
> > > > FYI, this just came in this morning:
> > >
> > > This isn't completely surprising, because the kernel doesn't know about
> > > the CPU in D06:
> > >
> > > > [    0.000000] Booting Linux on physical CPU 0x0000010000 [0x480fd010]
> > >
> > > [...]
> > >
> > > > [    0.000000] CPU features: detected: Kernel page table isolation (KPTI)
> > >
> > > If the CPU is not affected by meltdown, you can add the MIDR above to the
> > > kpti_safe_list[] table. If it *is* affected by meltdown, then I'm afraid
> > > that you're stuck with the delay at boot for !KASLR kernels (which is an
> > > awful lot better than getting pwned by userspace :)
> > >
> > > I think D06 is 8.2, so I would've hoped that you'd implemented
> > > AA64PFR0_EL1.CSV3, which would make this MIDR-based whitelisting
> > > unnecessary.
> > >
> >
> > Note that this is also still tied to the new rodata handling. The new
> > default is rodata=full, and reverting back to rodata=on (which used to
> > be the default in prior releases) or rodata=off (not recommended)
> > should get around this as well.
>
> Or, somewhat perversely, enabling CONFIG_RANDOMIZE_BASE and passing a
> valid kaslr seed. Performance /and/ security!
>

Yeah but unfortunately, it seems the UEFI on that box does not
implement EFI_RNG_PROTOCOL.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel