All of lore.kernel.org
 help / color / mirror / Atom feed
From: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
To: Russell King - ARM Linux admin <linux@armlinux.org.uk>
Cc: Jann Horn <jannh@google.com>, Kees Cook <keescook@chromium.org>,
	Emese Revfy <re.emese@gmail.com>,
	Paul Kocialkowski <paul.kocialkowski@bootlin.com>,
	Kernel Hardening <kernel-hardening@lists.openwall.com>,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] security: do not enable CONFIG_GCC_PLUGINS by default
Date: Fri, 14 Jun 2019 20:14:34 +0200	[thread overview]
Message-ID: <20190614201434.3fa4bb6d@primarylaptop.localdomain> (raw)
In-Reply-To: <20190614162811.o33yeq65ythjumrh@shell.armlinux.org.uk>

[-- Attachment #1: Type: text/plain, Size: 1452 bytes --]

On Fri, 14 Jun 2019 17:28:11 +0100
Russell King - ARM Linux admin <linux@armlinux.org.uk> wrote:
> I'm wondering whether this is sloppy wording or whether the author is
> really implying that they call the kernel decompressor with the MMU
> enabled, against the express instructions in
> Documentation/arm/Booting.
According to [1]
> If they are going against the express instructions, all bets are off.

More background on the decompressor patch:
- The "ANDROID: arm: decompressor: Flush tlb before swiching domain 0 to
  client mode" patch is needed anyway since 3.4 in any case, and
  according to the thread about it [1], the MMU is on at boot.
- There is a downstream u-boot port for the Galaxy SIII and other very
  similar devices, which doesn't setup the MMU at boot, but I'm not
  confident enough to test in on the devices I have. To test with
  u-boot I'd need to find a new device.
- If I don't manage to find a new device to test on, since there is
  already some setup code like arch/arm/boot/compressed/head-sa1100.S
  that deal with MMU that are enabled with the bootloader, are patches
  to add a new file like that still accepted? The big downside is that
  using something like that is probably incompatible with
  ARCH_MULTIPLATFORM.

References:
-----------
[1]http://lkml.iu.edu/hypermail/linux/kernel/1212.1/02099.html
[2]https://blog.forkwhiletrue.me/posts/an-almost-fully-libre-galaxy-s3/

Denis.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
To: Russell King - ARM Linux admin <linux@armlinux.org.uk>
Cc: Kees Cook <keescook@chromium.org>,
	Kernel Hardening <kernel-hardening@lists.openwall.com>,
	Jann Horn <jannh@google.com>,
	Paul Kocialkowski <paul.kocialkowski@bootlin.com>,
	Emese Revfy <re.emese@gmail.com>,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] security: do not enable CONFIG_GCC_PLUGINS by default
Date: Fri, 14 Jun 2019 20:14:34 +0200	[thread overview]
Message-ID: <20190614201434.3fa4bb6d@primarylaptop.localdomain> (raw)
In-Reply-To: <20190614162811.o33yeq65ythjumrh@shell.armlinux.org.uk>


[-- Attachment #1.1: Type: text/plain, Size: 1452 bytes --]

On Fri, 14 Jun 2019 17:28:11 +0100
Russell King - ARM Linux admin <linux@armlinux.org.uk> wrote:
> I'm wondering whether this is sloppy wording or whether the author is
> really implying that they call the kernel decompressor with the MMU
> enabled, against the express instructions in
> Documentation/arm/Booting.
According to [1]
> If they are going against the express instructions, all bets are off.

More background on the decompressor patch:
- The "ANDROID: arm: decompressor: Flush tlb before swiching domain 0 to
  client mode" patch is needed anyway since 3.4 in any case, and
  according to the thread about it [1], the MMU is on at boot.
- There is a downstream u-boot port for the Galaxy SIII and other very
  similar devices, which doesn't setup the MMU at boot, but I'm not
  confident enough to test in on the devices I have. To test with
  u-boot I'd need to find a new device.
- If I don't manage to find a new device to test on, since there is
  already some setup code like arch/arm/boot/compressed/head-sa1100.S
  that deal with MMU that are enabled with the bootloader, are patches
  to add a new file like that still accepted? The big downside is that
  using something like that is probably incompatible with
  ARCH_MULTIPLATFORM.

References:
-----------
[1]http://lkml.iu.edu/hypermail/linux/kernel/1212.1/02099.html
[2]https://blog.forkwhiletrue.me/posts/an-almost-fully-libre-galaxy-s3/

Denis.

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 176 bytes --]

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  reply	other threads:[~2019-06-14 18:14 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-14 14:57 [PATCH] security: do not enable CONFIG_GCC_PLUGINS by default Denis 'GNUtoo' Carikli
2019-06-14 16:05 ` Jann Horn
2019-06-14 16:05   ` Jann Horn
2019-06-14 16:12   ` Denis 'GNUtoo' Carikli
2019-06-14 16:12     ` Denis 'GNUtoo' Carikli
2019-06-14 16:28   ` Russell King - ARM Linux admin
2019-06-14 16:28     ` Russell King - ARM Linux admin
2019-06-14 18:14     ` Denis 'GNUtoo' Carikli [this message]
2019-06-14 18:14       ` Denis 'GNUtoo' Carikli
2019-06-14 18:54       ` Russell King - ARM Linux admin
2019-06-14 18:54         ` Russell King - ARM Linux admin
2019-06-15 10:13       ` Paul Kocialkowski
2019-06-15 10:13         ` Paul Kocialkowski
2019-06-21 23:42         ` Denis 'GNUtoo' Carikli
2019-06-21 23:42           ` Denis 'GNUtoo' Carikli
2019-06-24 13:31           ` Paul Kocialkowski
2019-06-24 13:31             ` Paul Kocialkowski
2019-06-15  3:08   ` Kees Cook
2019-06-15  3:08     ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190614201434.3fa4bb6d@primarylaptop.localdomain \
    --to=gnutoo@cyberdimension.org \
    --cc=jannh@google.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux@armlinux.org.uk \
    --cc=paul.kocialkowski@bootlin.com \
    --cc=re.emese@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.