From: Thomas Gleixner <tglx@linutronix.de>
To: Dave Hansen <dave.hansen@linux.intel.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Andy Lutomirski <luto@kernel.org>, Ingo Molnar <mingo@kernel.org>,
Borislav Petkov <bp@alien8.de>, Brian Gerst <brgerst@gmail.com>,
Denys Vlasenko <dvlasenk@redhat.com>,
"H. Peter Anvin" <hpa@zytor.com>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Peter Zijlstra <peterz@infradead.org>,
Rik van Riel <riel@redhat.com>,
daniel.gruss@iaik.tugraz.at, hughd@google.com,
keescook@google.com, linux-mm@kvack.org,
michael.schwarz@iaik.tugraz.at, moritz.lipp@iaik.tugraz.at,
richard.fellner@student.tugraz.at
Subject: Re: [patch V2 5/5] x86/kaiser: Add boottime disable switch
Date: Mon, 27 Nov 2017 20:00:19 +0100 (CET) [thread overview]
Message-ID: <alpine.DEB.2.20.1711271958450.2333@nanos> (raw)
In-Reply-To: <24359653-5b93-7146-8f65-ac38c3af0069@linux.intel.com>
On Mon, 27 Nov 2017, Dave Hansen wrote:
> On 11/26/2017 03:14 PM, Thomas Gleixner wrote:
> > --- a/security/Kconfig
> > +++ b/security/Kconfig
> > @@ -56,7 +56,7 @@ config SECURITY_NETWORK
> >
> > config KAISER
> > bool "Remove the kernel mapping in user mode"
> > - depends on X86_64 && SMP && !PARAVIRT
> > + depends on X86_64 && SMP && !PARAVIRT && JUMP_LABEL
> > help
> > This feature reduces the number of hardware side channels by
> > ensuring that the majority of kernel addresses are not mapped
>
> One of the reasons for doing the runtime-disable was to get rid of the
> !PARAVIRT dependency. I can add a follow-on here that will act as if we
> did "nokaiser" whenever Xen is in play so we can remove this dependency.
>
> I just hope Xen is detectable early enough to do the static patching.
Yes, it is. I'm currently trying to figure out why it fails on a KVM guest.
If I boot with 'nokaiser' on the command line it works. If kaiser is
runtime enabled then some early klibc user space in the ramdisk
explodes. Not sure yet whats going on.
Thanks,
tglx
next prev parent reply other threads:[~2017-11-27 19:00 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-26 23:14 [patch V2 0/5] x86/kaiser: Boot time disabling and debug support Thomas Gleixner
2017-11-26 23:14 ` [patch V2 1/5] x86/kaiser: Respect disabled CPU features Thomas Gleixner
2017-11-27 9:57 ` Peter Zijlstra
2017-11-27 11:47 ` Thomas Gleixner
2017-11-27 12:31 ` Brian Gerst
2017-11-27 13:18 ` Thomas Gleixner
2017-11-27 18:11 ` Dave Hansen
2017-11-27 18:37 ` Kees Cook
2017-11-26 23:14 ` [patch V2 2/5] x86/kaiser: Simplify disabling of global pages Thomas Gleixner
2017-11-27 11:49 ` Thomas Gleixner
2017-11-27 18:15 ` Dave Hansen
2017-11-27 20:28 ` Thomas Gleixner
2017-11-26 23:14 ` [patch V2 3/5] x86/dump_pagetables: Check KAISER shadow page table for WX pages Thomas Gleixner
2017-11-27 18:17 ` Dave Hansen
2017-11-26 23:14 ` [patch V2 4/5] x86/mm/debug_pagetables: Allow dumping current pagetables Thomas Gleixner
2017-11-27 9:41 ` Peter Zijlstra
2017-11-27 10:06 ` [PATCH] vfs: Add PERM_* symbolic helpers for common file mode/permissions Ingo Molnar
2017-11-27 19:21 ` Linus Torvalds
2017-11-28 10:54 ` Ingo Molnar
2017-11-28 11:12 ` Ingo Molnar
2017-11-29 8:52 ` Michael Ellerman
2017-11-27 18:18 ` [patch V2 4/5] x86/mm/debug_pagetables: Allow dumping current pagetables Dave Hansen
2017-11-26 23:14 ` [patch V2 5/5] x86/kaiser: Add boottime disable switch Thomas Gleixner
2017-11-27 9:48 ` Peter Zijlstra
2017-11-27 10:22 ` Peter Zijlstra
2017-11-27 11:50 ` Thomas Gleixner
2017-11-27 12:49 ` Peter Zijlstra
2017-11-27 21:43 ` Peter Zijlstra
2017-11-27 18:22 ` Dave Hansen
2017-11-27 19:00 ` Thomas Gleixner [this message]
2017-11-27 19:18 ` Josh Poimboeuf
2017-11-27 20:47 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.20.1711271958450.2333@nanos \
--to=tglx@linutronix.de \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=daniel.gruss@iaik.tugraz.at \
--cc=dave.hansen@linux.intel.com \
--cc=dvlasenk@redhat.com \
--cc=hpa@zytor.com \
--cc=hughd@google.com \
--cc=jpoimboe@redhat.com \
--cc=keescook@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=michael.schwarz@iaik.tugraz.at \
--cc=mingo@kernel.org \
--cc=moritz.lipp@iaik.tugraz.at \
--cc=peterz@infradead.org \
--cc=richard.fellner@student.tugraz.at \
--cc=riel@redhat.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).