lkml.org 
[lkml]   [2017]   [Dec]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 57/60] x86/mm/kpti: Add Kconfig
    From: Dave Hansen <dave.hansen@linux.intel.com>

    Finally allow CONFIG_KERNEL_PAGE_TABLE_ISOLATION to be enabled.

    PARAVIRT generally requires that the kernel not manage its own page tables.
    It also means that the hypervisor and kernel must agree wholeheartedly
    about what format the page tables are in and what they contain.
    KERNEL_PAGE_TABLE_ISOLATION, unfortunately, changes the rules and they
    can not be used together.

    I've seen conflicting feedback from maintainers lately about whether they
    want the Kconfig magic to go first or last in a patch series. It's going
    last here because the partially-applied series leads to kernels that can
    not boot in a bunch of cases. I did a run through the entire series with
    CONFIG_KERNEL_PAGE_TABLE_ISOLATION=y to look for build errors, though.

    [ tglx: Removed SMP and !PARAVIRT dependencies as they not longer exist ]

    Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: keescook@google.com
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: moritz.lipp@iaik.tugraz.at
    Cc: linux-mm@kvack.org
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: hughd@google.com
    Cc: daniel.gruss@iaik.tugraz.at
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: michael.schwarz@iaik.tugraz.at
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: richard.fellner@student.tugraz.at
    Link: https://lkml.kernel.org/r/20171123003524.88C90659@viggo.jf.intel.com

    ---
    security/Kconfig | 10 ++++++++++
    1 file changed, 10 insertions(+)

    --- a/security/Kconfig
    +++ b/security/Kconfig
    @@ -54,6 +54,16 @@ config SECURITY_NETWORK
    implement socket and networking access controls.
    If you are unsure how to answer this question, answer N.

    +config KERNEL_PAGE_TABLE_ISOLATION
    + bool "Remove the kernel mapping in user mode"
    + depends on X86_64 && JUMP_LABEL
    + help
    + This feature reduces the number of hardware side channels by
    + ensuring that the majority of kernel addresses are not mapped
    + into userspace.
    +
    + See Documentation/x86/pagetable-isolation.txt for more details.
    +
    config SECURITY_INFINIBAND
    bool "Infiniband Security Hooks"
    depends on SECURITY && INFINIBAND

    \
     
     \ /
      Last update: 2017-12-04 17:58    [W:5.026 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site