lkml.org 
[lkml]   [2017]   [Dec]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [patch 57/60] x86/mm/kpti: Add Kconfig
    On Mon, Dec 4, 2017 at 6:08 AM, Thomas Gleixner <tglx@linutronix.de> wrote:
    > From: Dave Hansen <dave.hansen@linux.intel.com>
    >
    > Finally allow CONFIG_KERNEL_PAGE_TABLE_ISOLATION to be enabled.
    >
    > PARAVIRT generally requires that the kernel not manage its own page tables.
    > It also means that the hypervisor and kernel must agree wholeheartedly
    > about what format the page tables are in and what they contain.
    > KERNEL_PAGE_TABLE_ISOLATION, unfortunately, changes the rules and they
    > can not be used together.
    >
    > I've seen conflicting feedback from maintainers lately about whether they
    > want the Kconfig magic to go first or last in a patch series. It's going
    > last here because the partially-applied series leads to kernels that can
    > not boot in a bunch of cases. I did a run through the entire series with
    > CONFIG_KERNEL_PAGE_TABLE_ISOLATION=y to look for build errors, though.
    >
    > [ tglx: Removed SMP and !PARAVIRT dependencies as they not longer exist ]
    >
    > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    > Signed-off-by: Ingo Molnar <mingo@kernel.org>
    > Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    > Cc: Rik van Riel <riel@redhat.com>
    > Cc: keescook@google.com
    > Cc: Denys Vlasenko <dvlasenk@redhat.com>
    > Cc: moritz.lipp@iaik.tugraz.at
    > Cc: linux-mm@kvack.org
    > Cc: Peter Zijlstra <peterz@infradead.org>
    > Cc: Brian Gerst <brgerst@gmail.com>
    > Cc: hughd@google.com
    > Cc: daniel.gruss@iaik.tugraz.at
    > Cc: Borislav Petkov <bp@alien8.de>
    > Cc: Andy Lutomirski <luto@kernel.org>
    > Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    > Cc: michael.schwarz@iaik.tugraz.at
    > Cc: Linus Torvalds <torvalds@linux-foundation.org>
    > Cc: richard.fellner@student.tugraz.at
    > Link: https://lkml.kernel.org/r/20171123003524.88C90659@viggo.jf.intel.com
    >
    > ---
    > security/Kconfig | 10 ++++++++++
    > 1 file changed, 10 insertions(+)
    >
    > --- a/security/Kconfig
    > +++ b/security/Kconfig
    > @@ -54,6 +54,16 @@ config SECURITY_NETWORK
    > implement socket and networking access controls.
    > If you are unsure how to answer this question, answer N.
    >
    > +config KERNEL_PAGE_TABLE_ISOLATION
    > + bool "Remove the kernel mapping in user mode"
    > + depends on X86_64 && JUMP_LABEL

    select JUMP_LABEL perhaps?

    > + help
    > + This feature reduces the number of hardware side channels by
    > + ensuring that the majority of kernel addresses are not mapped
    > + into userspace.
    > +
    > + See Documentation/x86/pagetable-isolation.txt for more details.
    > +
    > config SECURITY_INFINIBAND
    > bool "Infiniband Security Hooks"
    > depends on SECURITY && INFINIBAND
    >
    >

    \
     
     \ /
      Last update: 2017-12-04 17:56    [W:3.147 / U:0.264 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site