From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752386AbdLDQ5M (ORCPT ); Mon, 4 Dec 2017 11:57:12 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:60661 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753105AbdLDQv6 (ORCPT ); Mon, 4 Dec 2017 11:51:58 -0500 Message-Id: <20171204150609.511885345@linutronix.de> User-Agent: quilt/0.63-1 Date: Mon, 04 Dec 2017 15:08:03 +0100 From: Thomas Gleixner To: LKML Cc: x86@kernel.org, Linus Torvalds , Andy Lutomirsky , Peter Zijlstra , Dave Hansen , Borislav Petkov , Greg KH , keescook@google.com, hughd@google.com, Brian Gerst , Josh Poimboeuf , Denys Vlasenko , Rik van Riel , Boris Ostrovsky , Juergen Gross , David Laight , Eduardo Valentin , aliguori@amazon.com, Will Deacon , daniel.gruss@iaik.tugraz.at, Dave Hansen , Ingo Molnar , moritz.lipp@iaik.tugraz.at, linux-mm@kvack.org, Borislav Petkov , michael.schwarz@iaik.tugraz.at, richard.fellner@student.tugraz.at Subject: [patch 57/60] x86/mm/kpti: Add Kconfig References: <20171204140706.296109558@linutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Disposition: inline; filename=x86-mm-kpti--Add_Kconfig.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Hansen Finally allow CONFIG_KERNEL_PAGE_TABLE_ISOLATION to be enabled. PARAVIRT generally requires that the kernel not manage its own page tables. It also means that the hypervisor and kernel must agree wholeheartedly about what format the page tables are in and what they contain. KERNEL_PAGE_TABLE_ISOLATION, unfortunately, changes the rules and they can not be used together. I've seen conflicting feedback from maintainers lately about whether they want the Kconfig magic to go first or last in a patch series. It's going last here because the partially-applied series leads to kernels that can not boot in a bunch of cases. I did a run through the entire series with CONFIG_KERNEL_PAGE_TABLE_ISOLATION=y to look for build errors, though. [ tglx: Removed SMP and !PARAVIRT dependencies as they not longer exist ] Signed-off-by: Dave Hansen Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Cc: Rik van Riel Cc: keescook@google.com Cc: Denys Vlasenko Cc: moritz.lipp@iaik.tugraz.at Cc: linux-mm@kvack.org Cc: Peter Zijlstra Cc: Brian Gerst Cc: hughd@google.com Cc: daniel.gruss@iaik.tugraz.at Cc: Borislav Petkov Cc: Andy Lutomirski Cc: Josh Poimboeuf Cc: michael.schwarz@iaik.tugraz.at Cc: Linus Torvalds Cc: richard.fellner@student.tugraz.at Link: https://lkml.kernel.org/r/20171123003524.88C90659@viggo.jf.intel.com --- security/Kconfig | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/security/Kconfig +++ b/security/Kconfig @@ -54,6 +54,16 @@ config SECURITY_NETWORK implement socket and networking access controls. If you are unsure how to answer this question, answer N. +config KERNEL_PAGE_TABLE_ISOLATION + bool "Remove the kernel mapping in user mode" + depends on X86_64 && JUMP_LABEL + help + This feature reduces the number of hardware side channels by + ensuring that the majority of kernel addresses are not mapped + into userspace. + + See Documentation/x86/pagetable-isolation.txt for more details. + config SECURITY_INFINIBAND bool "Infiniband Security Hooks" depends on SECURITY && INFINIBAND