lkml.org 
[lkml]   [2017]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 43/43] x86/mm/kaiser: Add Kconfig
    Date
    From: Dave Hansen <dave.hansen@linux.intel.com>

    PARAVIRT generally requires that the kernel not manage its own page
    tables. It also means that the hypervisor and kernel must agree
    wholeheartedly about what format the page tables are in and what
    they contain. KAISER, unfortunately, changes the rules and they
    can not be used together.

    I've seen conflicting feedback from maintainers lately about whether
    they want the Kconfig magic to go first or last in a patch series.
    It's going last here because the partially-applied series leads to
    kernels that can not boot in a bunch of cases. I did a run through
    the entire series with CONFIG_KAISER=y to look for build errors,
    though.

    Note from Hugh Dickins on why it depends on SMP:

    It is absurd that KAISER should depend on SMP, but
    apparently nobody has tried a UP build before: which
    breaks on implicit declaration of function
    'per_cpu_offset' in arch/x86/mm/kaiser.c.

    Now, you would expect that to be trivially fixed up; but
    looking at the System.map when that block is #ifdef'ed
    out of kaiser_init(), I see that in a UP build
    __per_cpu_user_mapped_end is precisely at
    __per_cpu_user_mapped_start, and the items carefully
    gathered into that section for user-mapping on SMP,
    dispersed elsewhere on UP.

    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: daniel.gruss@iaik.tugraz.at
    Cc: hughd@google.com
    Cc: keescook@google.com
    Cc: linux-mm@kvack.org
    Cc: luto@kernel.org
    Cc: michael.schwarz@iaik.tugraz.at
    Cc: moritz.lipp@iaik.tugraz.at
    Cc: richard.fellner@student.tugraz.at
    Link: https://lkml.kernel.org/r/20171123003524.88C90659@viggo.jf.intel.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    ---
    security/Kconfig | 10 ++++++++++
    1 file changed, 10 insertions(+)

    diff --git a/security/Kconfig b/security/Kconfig
    index e8e449444e65..99b530d0dd9e 100644
    --- a/security/Kconfig
    +++ b/security/Kconfig
    @@ -54,6 +54,16 @@ config SECURITY_NETWORK
    implement socket and networking access controls.
    If you are unsure how to answer this question, answer N.

    +config KAISER
    + bool "Remove the kernel mapping in user mode"
    + depends on X86_64 && SMP && !PARAVIRT
    + help
    + This feature reduces the number of hardware side channels by
    + ensuring that the majority of kernel addresses are not mapped
    + into userspace.
    +
    + See Documentation/x86/kaiser.txt for more details.
    +
    config SECURITY_INFINIBAND
    bool "Infiniband Security Hooks"
    depends on SECURITY && INFINIBAND
    --
    2.14.1
    \
     
     \ /
      Last update: 2017-11-24 18:27    [W:3.133 / U:0.504 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site