From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S932492AbdK0TAe (ORCPT <rfc822;w@1wt.eu>);
        Mon, 27 Nov 2017 14:00:34 -0500
Received: from Galois.linutronix.de ([146.0.238.70]:57592 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S932446AbdK0TAb (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 27 Nov 2017 14:00:31 -0500
Date: Mon, 27 Nov 2017 20:00:19 +0100 (CET)
From: Thomas Gleixner <tglx@linutronix.de>
To: Dave Hansen <dave.hansen@linux.intel.com>
cc: LKML <linux-kernel@vger.kernel.org>, Andy Lutomirski <luto@kernel.org>,
        Ingo Molnar <mingo@kernel.org>, Borislav Petkov <bp@alien8.de>,
        Brian Gerst <brgerst@gmail.com>, Denys Vlasenko <dvlasenk@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Josh Poimboeuf <jpoimboe@redhat.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Peter Zijlstra <peterz@infradead.org>, Rik van Riel <riel@redhat.com>,
        daniel.gruss@iaik.tugraz.at, hughd@google.com, keescook@google.com,
        linux-mm@kvack.org, michael.schwarz@iaik.tugraz.at,
        moritz.lipp@iaik.tugraz.at, richard.fellner@student.tugraz.at
Subject: Re: [patch V2 5/5] x86/kaiser: Add boottime disable switch
In-Reply-To: <24359653-5b93-7146-8f65-ac38c3af0069@linux.intel.com>
Message-ID: <alpine.DEB.2.20.1711271958450.2333@nanos>
References: <20171126231403.657575796@linutronix.de> <20171126232414.645128754@linutronix.de> <24359653-5b93-7146-8f65-ac38c3af0069@linux.intel.com>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
X-Linutronix-Spam-Score: -1.0
X-Linutronix-Spam-Level: -
X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required,  ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, 27 Nov 2017, Dave Hansen wrote:

> On 11/26/2017 03:14 PM, Thomas Gleixner wrote:
> > --- a/security/Kconfig
> > +++ b/security/Kconfig
> > @@ -56,7 +56,7 @@ config SECURITY_NETWORK
> >  
> >  config KAISER
> >  	bool "Remove the kernel mapping in user mode"
> > -	depends on X86_64 && SMP && !PARAVIRT
> > +	depends on X86_64 && SMP && !PARAVIRT && JUMP_LABEL
> >  	help
> >  	  This feature reduces the number of hardware side channels by
> >  	  ensuring that the majority of kernel addresses are not mapped
> 
> One of the reasons for doing the runtime-disable was to get rid of the
> !PARAVIRT dependency.  I can add a follow-on here that will act as if we
> did "nokaiser" whenever Xen is in play so we can remove this dependency.
> 
> I just hope Xen is detectable early enough to do the static patching.

Yes, it is. I'm currently trying to figure out why it fails on a KVM guest.

If I boot with 'nokaiser' on the command line it works. If kaiser is
runtime enabled then some early klibc user space in the ramdisk
explodes. Not sure yet whats going on.

Thanks,

	tglx