From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753433AbdK0TSq (ORCPT ); Mon, 27 Nov 2017 14:18:46 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46254 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753063AbdK0TSp (ORCPT ); Mon, 27 Nov 2017 14:18:45 -0500 Date: Mon, 27 Nov 2017 13:18:40 -0600 From: Josh Poimboeuf To: Thomas Gleixner Cc: Dave Hansen , LKML , Andy Lutomirski , Ingo Molnar , Borislav Petkov , Brian Gerst , Denys Vlasenko , "H. Peter Anvin" , Linus Torvalds , Peter Zijlstra , Rik van Riel , daniel.gruss@iaik.tugraz.at, hughd@google.com, keescook@google.com, linux-mm@kvack.org, michael.schwarz@iaik.tugraz.at, moritz.lipp@iaik.tugraz.at, richard.fellner@student.tugraz.at Subject: Re: [patch V2 5/5] x86/kaiser: Add boottime disable switch Message-ID: <20171127191840.xv34rffmfb6oombh@treble> References: <20171126231403.657575796@linutronix.de> <20171126232414.645128754@linutronix.de> <24359653-5b93-7146-8f65-ac38c3af0069@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Mon, 27 Nov 2017 19:18:45 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 27, 2017 at 08:00:19PM +0100, Thomas Gleixner wrote: > On Mon, 27 Nov 2017, Dave Hansen wrote: > > > On 11/26/2017 03:14 PM, Thomas Gleixner wrote: > > > --- a/security/Kconfig > > > +++ b/security/Kconfig > > > @@ -56,7 +56,7 @@ config SECURITY_NETWORK > > > > > > config KAISER > > > bool "Remove the kernel mapping in user mode" > > > - depends on X86_64 && SMP && !PARAVIRT > > > + depends on X86_64 && SMP && !PARAVIRT && JUMP_LABEL > > > help > > > This feature reduces the number of hardware side channels by > > > ensuring that the majority of kernel addresses are not mapped > > > > One of the reasons for doing the runtime-disable was to get rid of the > > !PARAVIRT dependency. I can add a follow-on here that will act as if we > > did "nokaiser" whenever Xen is in play so we can remove this dependency. > > > > I just hope Xen is detectable early enough to do the static patching. > > Yes, it is. I'm currently trying to figure out why it fails on a KVM guest. > > If I boot with 'nokaiser' on the command line it works. If kaiser is > runtime enabled then some early klibc user space in the ramdisk > explodes. Not sure yet whats going on. I'm also seeing weirdness with PARAVIRT+KAISER on kvm. The symptoms aren't consistent. Sometimes it boots, sometimes it hangs before the login prompt, sometimes there are user space seg faults. It almost seems like the interrupt handler is corrupting user space state somehow. This is with tip/WIP.x86/mm plus a patch to remove the KAISER dependency on !PARAVIRT. -- Josh