Date: Thu, 10 Dec 2015 10:47:48 -0800 From: Kees Cook <keescook@...omium.org> To: Catalin Marinas <catalin.marinas@....com> Cc: "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com> Subject: Re: Self Introduction On Thu, Dec 10, 2015 at 10:42 AM, Catalin Marinas <catalin.marinas@....com> wrote: > On Thu, Dec 10, 2015 at 09:49:13AM -0800, Kees Cook wrote: >> On Thu, Dec 10, 2015 at 9:14 AM, Stephen Smalley >> <stephen.smalley@...il.com> wrote: >> > On Wed, Dec 9, 2015 at 7:41 PM, Kees Cook <keescook@...omium.org> wrote: >> >> On Wed, Dec 9, 2015 at 4:26 PM, David Brown <david.brown@...aro.org> wrote: >> >>> On Wed, Dec 09, 2015 at 04:14:20PM -0800, Kees Cook wrote: >> >>>> I'd love to see CONFIG_CPU_SW_DOMAIN_PAN into the AOSP 3.18 android kernel >> >>>> too. >> >>> >> >>> I'll put this on my list to investigate. Sadly, it looks like there >> >>> is a bit of a window of ARM CPUs where neither solution will work; >> >>> Basically the pre V8.1 64-bit. >> >> >> >> The LPAE support for PAN emulation exists in grsecurity, if someone >> >> wanted to look at how to extract it and add it to >> >> CONFIG_CPU_SW_DOMAIN_PAN (or similar). >> > >> > Are you looking for this: >> > http://marc.info/?l=linux-arm-kernel&m=144308911409429&w=2 >> > >> > Haven't seen any follow up on it though... >> >> Ah yes! Thank you! >> >> https://patchwork.kernel.org/patch/7250401/ >> https://patchwork.kernel.org/patch/7250391/ >> https://patchwork.kernel.org/patch/7250421/ >> https://patchwork.kernel.org/patch/7250441/ >> >> Catalin, where does this stand? > > I haven't done any further improvements to them, nor have I received any > feedback. I'll rebase them against latest kernel if anyone else is > willing to test. I had a plan to run some benchmarks and see how > performance is affected (including the CPU_SW_DOMAIN_PAN) before pushing > again for upstreaming but I haven't had the time. Please CC this mailing list when you do. I'd like to give it a spin (and maybe other folks will too). >> Also, what options do ARMv8 (not ARMv8.1) devices have for PAN if >> they're running 64-bit? > > No PAN support for ARMv8.0. It could be done similarly to the 32-bit > LPAE support. > >> The matrix for PAN seems to be: >> >> ARMv7 32-bit non-LPAE: CONFIG_CPU_SW_DOMAIN_PAN >> ARMv7 32-bit LPAE: Catalin's series (CPU_TTBR0_PAN) > > Correct. > >> ARMv8 32-bit: Catalin's series? > > ARMv8 32-bit is backwards compatible with ARMv7, so the same arm32 > kernel. > >> ARMv8 64-bit: ?? > > None. > >> ARMv8.1: hardware PAN > > Correct. Excellent, thanks! -Kees -- Kees Cook Chrome OS & Brillo Security
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.