Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 4 Dec 2017 08:54:57 -0800 | Subject | Re: [patch 57/60] x86/mm/kpti: Add Kconfig |
| |
On Mon, Dec 4, 2017 at 6:08 AM, Thomas Gleixner <tglx@linutronix.de> wrote: > From: Dave Hansen <dave.hansen@linux.intel.com> > > Finally allow CONFIG_KERNEL_PAGE_TABLE_ISOLATION to be enabled. > > PARAVIRT generally requires that the kernel not manage its own page tables. > It also means that the hypervisor and kernel must agree wholeheartedly > about what format the page tables are in and what they contain. > KERNEL_PAGE_TABLE_ISOLATION, unfortunately, changes the rules and they > can not be used together. > > I've seen conflicting feedback from maintainers lately about whether they > want the Kconfig magic to go first or last in a patch series. It's going > last here because the partially-applied series leads to kernels that can > not boot in a bunch of cases. I did a run through the entire series with > CONFIG_KERNEL_PAGE_TABLE_ISOLATION=y to look for build errors, though. > > [ tglx: Removed SMP and !PARAVIRT dependencies as they not longer exist ] > > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> > Signed-off-by: Ingo Molnar <mingo@kernel.org> > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > Cc: Rik van Riel <riel@redhat.com> > Cc: keescook@google.com > Cc: Denys Vlasenko <dvlasenk@redhat.com> > Cc: moritz.lipp@iaik.tugraz.at > Cc: linux-mm@kvack.org > Cc: Peter Zijlstra <peterz@infradead.org> > Cc: Brian Gerst <brgerst@gmail.com> > Cc: hughd@google.com > Cc: daniel.gruss@iaik.tugraz.at > Cc: Borislav Petkov <bp@alien8.de> > Cc: Andy Lutomirski <luto@kernel.org> > Cc: Josh Poimboeuf <jpoimboe@redhat.com> > Cc: michael.schwarz@iaik.tugraz.at > Cc: Linus Torvalds <torvalds@linux-foundation.org> > Cc: richard.fellner@student.tugraz.at > Link: https://lkml.kernel.org/r/20171123003524.88C90659@viggo.jf.intel.com > > --- > security/Kconfig | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -54,6 +54,16 @@ config SECURITY_NETWORK > implement socket and networking access controls. > If you are unsure how to answer this question, answer N. > > +config KERNEL_PAGE_TABLE_ISOLATION > + bool "Remove the kernel mapping in user mode" > + depends on X86_64 && JUMP_LABEL
select JUMP_LABEL perhaps?
> + help > + This feature reduces the number of hardware side channels by > + ensuring that the majority of kernel addresses are not mapped > + into userspace. > + > + See Documentation/x86/pagetable-isolation.txt for more details. > + > config SECURITY_INFINIBAND > bool "Infiniband Security Hooks" > depends on SECURITY && INFINIBAND > >
| |