Enable CONFIG_ARM64_PTR_AUTH and CONFIG_PAC_MTE_COMPART Simultaneously

[joshuachen3333]

Request: Enable CONFIG_ARM64_PTR_AUTH and CONFIG_PAC_MTE_COMPART Simultaneously

Problem Statement

Currently, enabling both CONFIG_ARM64_PTR_AUTH and CONFIG_PAC_MTE_COMPART in the Linux kernel results in conflicts and boot failures.

Desired Configuration:

CONFIG_ARM64_PTR_AUTH=y
CONFIG_PAC_MTE_COMPART=y

Current Situation:

• These two features cannot coexist
• Users must choose one or the other
• This limits the security benefits that could be achieved

Why This Matters

HAKC Background

HAKC (Hardware-Assisted Kernel Compartmentalization) is a kernel security enhancement presented at NDSS 2022 by MIT Lincoln Laboratory.

• Repository: https://github.com/mit-ll/HAKC
• Paper: HAKC: Hardware-Assisted Kernel Compartmentalization (NDSS 2022)
• Goal: Provide efficient kernel compartmentalization using ARM hardware features (MTE + PAC)

Security Value

ARM64_PTR_AUTH (Pointer Authentication):

• Protects return addresses and function pointers
• Mitigates ROP (Return-Oriented Programming) attacks
• Industry-standard security feature

PAC_MTE_COMPART (HAKC Compartmentalization):

• Isolates kernel modules into compartments
• Prevents unauthorized cross-compartment access
• Uses PAC for efficient boundary enforcement
• Adds defense-in-depth to kernel security

Combined Benefits

If both features could work together:

• ✅ ROP attack mitigation (ARM64_PTR_AUTH)
• ✅ Kernel compartmentalization (PAC_MTE_COMPART)
• ✅ Defense-in-depth security architecture
• ✅ Minimal performance overhead (hardware-assisted)

Current Observations

With both enabled, the system experiences:

• Kernel boot failures
• Initialization hangs (particularly in IPv6 module)
• Conflicts in PAC usage

Workaround (loses security benefits):

• Disable one feature to enable the other
• Current production systems must choose between ROP protection OR compartmentalization

Request for Community Input

We're reaching out to the kernel community for:

1. Guidance: Is enabling both features a realistic goal?
2. Technical direction: What's the right approach to make these features coexist?
3. Collaboration: Others interested in kernel compartmentalization and defense-in-depth
4. Upstream path: Steps toward mainline support for combined usage

Use Case

Security-focused deployments (embedded systems, IoT, critical infrastructure) would benefit significantly from having both:

• Pointer authentication for exploit mitigation
• Compartmentalization for privilege separation and fault isolation

Environment

• Kernel: Linux 5.10.24 (HAKC-modified)
• Architecture: ARM64 (ARMv8.3+ with PAC and MTE support)
• Hardware: Cortex-A710 (QEMU emulation)

Questions for the Community

1. Has anyone successfully enabled both features?
2. Are there known architectural conflicts?
3. What would be the recommended approach for investigation?
4. Is this something the community would find valuable?

References

• HAKC Repository: https://github.com/mit-ll/HAKC
• HAKC Paper (PDF): https://www.ndss-symposium.org/wp-content/uploads/2022-26-paper.pdf
• NDSS 2022 Presentation: https://www.ndss-symposium.org/ndss-paper/auto-draft-226/
• ARM PAC Documentation: ARM Architecture Reference Manual (ARMv8.3+)

---

We believe combining these features would significantly enhance kernel security and welcome community collaboration on this challenge.