From: Kees Cook <keescook@google.com> To: Dave Hansen <dave.hansen@linux.intel.com> Cc: LKML <linux-kernel@vger.kernel.org>, Linux-MM <linux-mm@kvack.org>, moritz.lipp@iaik.tugraz.at, daniel.gruss@iaik.tugraz.at, michael.schwarz@iaik.tugraz.at, Andy Lutomirski <luto@kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>, Hugh Dickins <hughd@google.com>, x86@kernel.org Subject: Re: [PATCH 23/23] x86, kaiser: add Kconfig Date: Tue, 31 Oct 2017 16:59:37 -0700 [thread overview] Message-ID: <CAGXu5jK3nwcO=520a0V22bs_-8wBYAO+E5aeX53PUfevA2KvVQ@mail.gmail.com> (raw) In-Reply-To: <20171031223228.9F2B69B4@viggo.jf.intel.com> On Tue, Oct 31, 2017 at 3:32 PM, Dave Hansen <dave.hansen@linux.intel.com> wrote: > > PARAVIRT generally requires that the kernel not manage its own page > tables. It also means that the hypervisor and kernel must agree > wholeheartedly about what format the page tables are in and what > they contain. KAISER, unfortunately, changes the rules and they > can not be used together. A quick look through "#ifdef CONFIG_KAISER" looks like it might be possible to make this a runtime setting at some point. When doing KASLR, it was much more useful to make this runtime selectable so that distro kernels could build the support in, but let users decide if they wanted to enable it. > I've seen conflicting feedback from maintainers lately about whether > they want the Kconfig magic to go first or last in a patch series. > It's going last here because the partially-applied series leads to > kernels that can not boot in a bunch of cases. I did a run through > the entire series with CONFIG_KAISER=y to look for build errors, > though. Yeah, I think last tends to be the best, though it isn't great for debugging. Doing it earlier, though, tends to lead to a lot of confusion about whether some feature is actually operating sanely or not. -Kees > Note from Hugh Dickins on why it depends on SMP: > > It is absurd that KAISER should depend on SMP, but > apparently nobody has tried a UP build before: which > breaks on implicit declaration of function > 'per_cpu_offset' in arch/x86/mm/kaiser.c. > > Now, you would expect that to be trivially fixed up; but > looking at the System.map when that block is #ifdef'ed > out of kaiser_init(), I see that in a UP build > __per_cpu_user_mapped_end is precisely at > __per_cpu_user_mapped_start, and the items carefully > gathered into that section for user-mapping on SMP, > dispersed elsewhere on UP. > > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> > Cc: Moritz Lipp <moritz.lipp@iaik.tugraz.at> > Cc: Daniel Gruss <daniel.gruss@iaik.tugraz.at> > Cc: Michael Schwarz <michael.schwarz@iaik.tugraz.at> > Cc: Andy Lutomirski <luto@kernel.org> > Cc: Linus Torvalds <torvalds@linux-foundation.org> > Cc: Kees Cook <keescook@google.com> > Cc: Hugh Dickins <hughd@google.com> > Cc: x86@kernel.org > --- > > b/security/Kconfig | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff -puN security/Kconfig~kaiser-kconfig security/Kconfig > --- a/security/Kconfig~kaiser-kconfig 2017-10-31 15:04:01.680648908 -0700 > +++ b/security/Kconfig 2017-10-31 15:04:01.684649097 -0700 > @@ -54,6 +54,16 @@ config SECURITY_NETWORK > implement socket and networking access controls. > If you are unsure how to answer this question, answer N. > > +config KAISER > + bool "Remove the kernel mapping in user mode" > + depends on X86_64 && SMP && !PARAVIRT > + help > + This feature reduces the number of hardware side channels by > + ensuring that the majority of kernel addresses are not mapped > + into userspace. > + > + See Documentation/x86/kaiser.txt for more details. > + > config SECURITY_INFINIBAND > bool "Infiniband Security Hooks" > depends on SECURITY && INFINIBAND > _ -- Kees Cook Pixel Security
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@google.com> To: Dave Hansen <dave.hansen@linux.intel.com> Cc: LKML <linux-kernel@vger.kernel.org>, Linux-MM <linux-mm@kvack.org>, moritz.lipp@iaik.tugraz.at, daniel.gruss@iaik.tugraz.at, michael.schwarz@iaik.tugraz.at, Andy Lutomirski <luto@kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>, Hugh Dickins <hughd@google.com>, x86@kernel.org Subject: Re: [PATCH 23/23] x86, kaiser: add Kconfig Date: Tue, 31 Oct 2017 16:59:37 -0700 [thread overview] Message-ID: <CAGXu5jK3nwcO=520a0V22bs_-8wBYAO+E5aeX53PUfevA2KvVQ@mail.gmail.com> (raw) In-Reply-To: <20171031223228.9F2B69B4@viggo.jf.intel.com> On Tue, Oct 31, 2017 at 3:32 PM, Dave Hansen <dave.hansen@linux.intel.com> wrote: > > PARAVIRT generally requires that the kernel not manage its own page > tables. It also means that the hypervisor and kernel must agree > wholeheartedly about what format the page tables are in and what > they contain. KAISER, unfortunately, changes the rules and they > can not be used together. A quick look through "#ifdef CONFIG_KAISER" looks like it might be possible to make this a runtime setting at some point. When doing KASLR, it was much more useful to make this runtime selectable so that distro kernels could build the support in, but let users decide if they wanted to enable it. > I've seen conflicting feedback from maintainers lately about whether > they want the Kconfig magic to go first or last in a patch series. > It's going last here because the partially-applied series leads to > kernels that can not boot in a bunch of cases. I did a run through > the entire series with CONFIG_KAISER=y to look for build errors, > though. Yeah, I think last tends to be the best, though it isn't great for debugging. Doing it earlier, though, tends to lead to a lot of confusion about whether some feature is actually operating sanely or not. -Kees > Note from Hugh Dickins on why it depends on SMP: > > It is absurd that KAISER should depend on SMP, but > apparently nobody has tried a UP build before: which > breaks on implicit declaration of function > 'per_cpu_offset' in arch/x86/mm/kaiser.c. > > Now, you would expect that to be trivially fixed up; but > looking at the System.map when that block is #ifdef'ed > out of kaiser_init(), I see that in a UP build > __per_cpu_user_mapped_end is precisely at > __per_cpu_user_mapped_start, and the items carefully > gathered into that section for user-mapping on SMP, > dispersed elsewhere on UP. > > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> > Cc: Moritz Lipp <moritz.lipp@iaik.tugraz.at> > Cc: Daniel Gruss <daniel.gruss@iaik.tugraz.at> > Cc: Michael Schwarz <michael.schwarz@iaik.tugraz.at> > Cc: Andy Lutomirski <luto@kernel.org> > Cc: Linus Torvalds <torvalds@linux-foundation.org> > Cc: Kees Cook <keescook@google.com> > Cc: Hugh Dickins <hughd@google.com> > Cc: x86@kernel.org > --- > > b/security/Kconfig | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff -puN security/Kconfig~kaiser-kconfig security/Kconfig > --- a/security/Kconfig~kaiser-kconfig 2017-10-31 15:04:01.680648908 -0700 > +++ b/security/Kconfig 2017-10-31 15:04:01.684649097 -0700 > @@ -54,6 +54,16 @@ config SECURITY_NETWORK > implement socket and networking access controls. > If you are unsure how to answer this question, answer N. > > +config KAISER > + bool "Remove the kernel mapping in user mode" > + depends on X86_64 && SMP && !PARAVIRT > + help > + This feature reduces the number of hardware side channels by > + ensuring that the majority of kernel addresses are not mapped > + into userspace. > + > + See Documentation/x86/kaiser.txt for more details. > + > config SECURITY_INFINIBAND > bool "Infiniband Security Hooks" > depends on SECURITY && INFINIBAND > _ -- Kees Cook Pixel Security -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-10-31 23:59 UTC|newest] Thread overview: 206+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-10-31 22:31 [PATCH 00/23] KAISER: unmap most of the kernel from userspace page tables Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-10-31 22:31 ` [PATCH 01/23] x86, kaiser: prepare assembly for entry/exit CR3 switching Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-11-01 0:43 ` Brian Gerst 2017-11-01 0:43 ` Brian Gerst 2017-11-01 1:08 ` Dave Hansen 2017-11-01 1:08 ` Dave Hansen 2017-11-01 18:18 ` Borislav Petkov 2017-11-01 18:18 ` Borislav Petkov 2017-11-01 18:27 ` Dave Hansen 2017-11-01 18:27 ` Dave Hansen 2017-11-01 20:42 ` Borislav Petkov 2017-11-01 20:42 ` Borislav Petkov 2017-11-01 21:01 ` Thomas Gleixner 2017-11-01 21:01 ` Thomas Gleixner 2017-11-01 22:58 ` Dave Hansen 2017-11-01 22:58 ` Dave Hansen 2017-10-31 22:31 ` [PATCH 02/23] x86, kaiser: do not set _PAGE_USER for init_mm page tables Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-11-01 21:11 ` Thomas Gleixner 2017-11-01 21:11 ` Thomas Gleixner 2017-11-01 21:24 ` Andy Lutomirski 2017-11-01 21:24 ` Andy Lutomirski 2017-11-01 21:28 ` Thomas Gleixner 2017-11-01 21:28 ` Thomas Gleixner 2017-11-01 21:52 ` Dave Hansen 2017-11-01 21:52 ` Dave Hansen 2017-11-01 22:11 ` Thomas Gleixner 2017-11-01 22:11 ` Thomas Gleixner 2017-11-01 22:12 ` Linus Torvalds 2017-11-01 22:12 ` Linus Torvalds 2017-11-01 22:20 ` Thomas Gleixner 2017-11-01 22:20 ` Thomas Gleixner 2017-11-01 22:45 ` Kees Cook 2017-11-01 22:45 ` Kees Cook 2017-11-02 7:10 ` Andy Lutomirski 2017-11-02 7:10 ` Andy Lutomirski 2017-11-02 11:33 ` Thomas Gleixner 2017-11-02 11:33 ` Thomas Gleixner 2017-11-02 11:59 ` Andy Lutomirski 2017-11-02 11:59 ` Andy Lutomirski 2017-11-02 12:56 ` Thomas Gleixner 2017-11-02 12:56 ` Thomas Gleixner 2017-11-02 16:38 ` Dave Hansen 2017-11-02 16:38 ` Dave Hansen 2017-11-02 18:19 ` Andy Lutomirski 2017-11-02 18:19 ` Andy Lutomirski 2017-11-02 18:24 ` Thomas Gleixner 2017-11-02 18:24 ` Thomas Gleixner 2017-11-02 18:24 ` Linus Torvalds 2017-11-02 18:24 ` Linus Torvalds 2017-11-02 18:40 ` Thomas Gleixner 2017-11-02 18:40 ` Thomas Gleixner 2017-11-02 18:57 ` Linus Torvalds 2017-11-02 18:57 ` Linus Torvalds 2017-11-02 21:41 ` Thomas Gleixner 2017-11-02 21:41 ` Thomas Gleixner 2017-11-02 7:07 ` Andy Lutomirski 2017-11-02 7:07 ` Andy Lutomirski 2017-11-02 11:21 ` Thomas Gleixner 2017-11-02 11:21 ` Thomas Gleixner 2017-10-31 22:31 ` [PATCH 03/23] x86, kaiser: disable global pages Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-11-01 21:18 ` Thomas Gleixner 2017-11-01 21:18 ` Thomas Gleixner 2017-11-01 22:12 ` Dave Hansen 2017-11-01 22:12 ` Dave Hansen 2017-11-01 22:28 ` Thomas Gleixner 2017-11-01 22:28 ` Thomas Gleixner 2017-10-31 22:31 ` [PATCH 04/23] x86, tlb: make CR4-based TLB flushes more robust Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-11-01 8:01 ` Andy Lutomirski 2017-11-01 8:01 ` Andy Lutomirski 2017-11-01 10:11 ` Kirill A. Shutemov 2017-11-01 10:11 ` Kirill A. Shutemov 2017-11-01 10:38 ` Andy Lutomirski 2017-11-01 10:38 ` Andy Lutomirski 2017-11-01 10:56 ` Kirill A. Shutemov 2017-11-01 10:56 ` Kirill A. Shutemov 2017-11-01 11:18 ` Andy Lutomirski 2017-11-01 11:18 ` Andy Lutomirski 2017-11-01 22:21 ` Dave Hansen 2017-11-01 22:21 ` Dave Hansen 2017-11-01 21:25 ` Thomas Gleixner 2017-11-01 21:25 ` Thomas Gleixner 2017-11-01 22:24 ` Dave Hansen 2017-11-01 22:24 ` Dave Hansen 2017-11-01 22:30 ` Thomas Gleixner 2017-11-01 22:30 ` Thomas Gleixner 2017-10-31 22:31 ` [PATCH 05/23] x86, mm: document X86_CR4_PGE toggling behavior Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-10-31 23:31 ` Kees Cook 2017-10-31 23:31 ` Kees Cook 2017-10-31 22:31 ` [PATCH 06/23] x86, kaiser: introduce user-mapped percpu areas Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-11-01 21:47 ` Thomas Gleixner 2017-11-01 21:47 ` Thomas Gleixner 2017-10-31 22:31 ` [PATCH 07/23] x86, kaiser: unmap kernel from userspace page tables (core patch) Dave Hansen 2017-10-31 22:31 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 08/23] x86, kaiser: only populate shadow page tables for userspace Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 23:35 ` Kees Cook 2017-10-31 23:35 ` Kees Cook 2017-10-31 22:32 ` [PATCH 09/23] x86, kaiser: allow NX to be set in p4d/pgd Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 10/23] x86, kaiser: make sure static PGDs are 8k in size Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 11/23] x86, kaiser: map GDT into user page tables Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 12/23] x86, kaiser: map dynamically-allocated LDTs Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-11-01 8:00 ` Andy Lutomirski 2017-11-01 8:00 ` Andy Lutomirski 2017-11-01 8:06 ` Ingo Molnar 2017-11-01 8:06 ` Ingo Molnar 2017-10-31 22:32 ` [PATCH 13/23] x86, kaiser: map espfix structures Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 14/23] x86, kaiser: map entry stack variables Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 15/23] x86, kaiser: map trace interrupt entry Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 16/23] x86, kaiser: map debug IDT tables Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 17/23] x86, kaiser: map virtually-addressed performance monitoring buffers Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 18/23] x86, mm: Move CR3 construction functions Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 19/23] x86, mm: remove hard-coded ASID limit checks Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 20/23] x86, mm: put mmu-to-h/w ASID translation in one place Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 21/23] x86, pcid, kaiser: allow flushing for future ASID switches Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-11-01 8:03 ` Andy Lutomirski 2017-11-01 8:03 ` Andy Lutomirski 2017-11-01 14:17 ` Dave Hansen 2017-11-01 14:17 ` Dave Hansen 2017-11-01 20:31 ` Andy Lutomirski 2017-11-01 20:31 ` Andy Lutomirski 2017-11-01 20:59 ` Dave Hansen 2017-11-01 20:59 ` Dave Hansen 2017-11-01 21:04 ` Andy Lutomirski 2017-11-01 21:04 ` Andy Lutomirski 2017-11-01 21:06 ` Dave Hansen 2017-11-01 21:06 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 22/23] x86, kaiser: use PCID feature to make user and kernel switches faster Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 22:32 ` [PATCH 23/23] x86, kaiser: add Kconfig Dave Hansen 2017-10-31 22:32 ` Dave Hansen 2017-10-31 23:59 ` Kees Cook [this message] 2017-10-31 23:59 ` Kees Cook 2017-11-01 9:07 ` Borislav Petkov 2017-11-01 9:07 ` Borislav Petkov 2017-10-31 23:27 ` [PATCH 00/23] KAISER: unmap most of the kernel from userspace page tables Linus Torvalds 2017-10-31 23:27 ` Linus Torvalds 2017-10-31 23:44 ` Dave Hansen 2017-10-31 23:44 ` Dave Hansen 2017-11-01 0:21 ` Dave Hansen 2017-11-01 0:21 ` Dave Hansen 2017-11-01 7:59 ` Andy Lutomirski 2017-11-01 7:59 ` Andy Lutomirski 2017-11-01 16:08 ` Linus Torvalds 2017-11-01 16:08 ` Linus Torvalds 2017-11-01 17:31 ` Dave Hansen 2017-11-01 17:58 ` Randy Dunlap 2017-11-01 17:58 ` Randy Dunlap 2017-11-01 18:27 ` Linus Torvalds 2017-11-01 18:27 ` Linus Torvalds 2017-11-01 18:46 ` Dave Hansen 2017-11-01 18:46 ` Dave Hansen 2017-11-01 19:05 ` Linus Torvalds 2017-11-01 19:05 ` Linus Torvalds 2017-11-01 20:33 ` Andy Lutomirski 2017-11-01 20:33 ` Andy Lutomirski 2017-11-02 7:32 ` Andy Lutomirski 2017-11-02 7:32 ` Andy Lutomirski 2017-11-02 7:54 ` Andy Lutomirski 2017-11-02 7:54 ` Andy Lutomirski 2017-11-01 15:53 ` Dave Hansen 2017-11-01 15:53 ` Dave Hansen 2017-11-01 8:54 ` Ingo Molnar 2017-11-01 8:54 ` Ingo Molnar 2017-11-01 14:09 ` Thomas Gleixner 2017-11-01 14:09 ` Thomas Gleixner 2017-11-01 22:14 ` Dave Hansen 2017-11-01 22:14 ` Dave Hansen 2017-11-01 22:28 ` Linus Torvalds 2017-11-01 22:28 ` Linus Torvalds 2017-11-02 8:03 ` Peter Zijlstra 2017-11-02 8:03 ` Peter Zijlstra 2017-11-03 11:07 ` Kirill A. Shutemov 2017-11-03 11:07 ` Kirill A. Shutemov 2017-11-02 19:01 ` Will Deacon 2017-11-02 19:01 ` Will Deacon 2017-11-02 19:01 ` Will Deacon 2017-11-02 19:38 ` Dave Hansen 2017-11-02 19:38 ` Dave Hansen 2017-11-02 19:38 ` Dave Hansen 2017-11-03 13:41 ` Will Deacon 2017-11-03 13:41 ` Will Deacon 2017-11-03 13:41 ` Will Deacon 2017-11-22 16:19 ` Pavel Machek 2017-11-23 10:47 ` Pavel Machek 2017-11-23 0:34 [PATCH 00/23] [v4] " Dave Hansen 2017-11-23 0:35 ` [PATCH 23/23] x86, kaiser: add Kconfig Dave Hansen 2017-11-23 0:35 ` Dave Hansen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAGXu5jK3nwcO=520a0V22bs_-8wBYAO+E5aeX53PUfevA2KvVQ@mail.gmail.com' \ --to=keescook@google.com \ --cc=daniel.gruss@iaik.tugraz.at \ --cc=dave.hansen@linux.intel.com \ --cc=hughd@google.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@kernel.org \ --cc=michael.schwarz@iaik.tugraz.at \ --cc=moritz.lipp@iaik.tugraz.at \ --cc=torvalds@linux-foundation.org \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.