patches/kernel/0214-x86-mm-pti-Add-Kconfig.patch

   1 From 0692cf84257a92f7be9553af55d65c668e2b3bc8 Mon Sep 17 00:00:00 2001
   2 From: Dave Hansen <dave.hansen@linux.intel.com>
   3 Date: Mon, 4 Dec 2017 15:08:03 +0100
   4 Subject: [PATCH 214/233] x86/mm/pti: Add Kconfig
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 Finally allow CONFIG_PAGE_TABLE_ISOLATION to be enabled.
  12
  13 PARAVIRT generally requires that the kernel not manage its own page tables.
  14 It also means that the hypervisor and kernel must agree wholeheartedly
  15 about what format the page tables are in and what they contain.
  16 PAGE_TABLE_ISOLATION, unfortunately, changes the rules and they
  17 can not be used together.
  18
  19 I've seen conflicting feedback from maintainers lately about whether they
  20 want the Kconfig magic to go first or last in a patch series.  It's going
  21 last here because the partially-applied series leads to kernels that can
  22 not boot in a bunch of cases.  I did a run through the entire series with
  23 CONFIG_PAGE_TABLE_ISOLATION=y to look for build errors, though.
  24
  25 [ tglx: Removed SMP and !PARAVIRT dependencies as they not longer exist ]
  26
  27 Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
  28 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  29 Cc: Andy Lutomirski <luto@kernel.org>
  30 Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
  31 Cc: Borislav Petkov <bp@alien8.de>
  32 Cc: Brian Gerst <brgerst@gmail.com>
  33 Cc: David Laight <David.Laight@aculab.com>
  34 Cc: Denys Vlasenko <dvlasenk@redhat.com>
  35 Cc: Eduardo Valentin <eduval@amazon.com>
  36 Cc: Greg KH <gregkh@linuxfoundation.org>
  37 Cc: H. Peter Anvin <hpa@zytor.com>
  38 Cc: Josh Poimboeuf <jpoimboe@redhat.com>
  39 Cc: Juergen Gross <jgross@suse.com>
  40 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  41 Cc: Peter Zijlstra <peterz@infradead.org>
  42 Cc: Will Deacon <will.deacon@arm.com>
  43 Cc: aliguori@amazon.com
  44 Cc: daniel.gruss@iaik.tugraz.at
  45 Cc: hughd@google.com
  46 Cc: keescook@google.com
  47 Cc: linux-mm@kvack.org
  48 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  49 (cherry picked from commit 385ce0ea4c078517fa51c261882c4e72fba53005)
  50 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  51 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  52 (cherry picked from commit ce12963b837e809f6ae048587d9377a298c1094d)
  53 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  54 ---
  55  security/Kconfig | 10 ++++++++++
  56  1 file changed, 10 insertions(+)
  57
  58 diff --git a/security/Kconfig b/security/Kconfig
  59 index 305b496ff6a3..91cb8f611a0d 100644
  60 --- a/security/Kconfig
  61 +++ b/security/Kconfig
  62 @@ -96,6 +96,16 @@ config SECURITY_NETWORK
  63           implement socket and networking access controls.
  64           If you are unsure how to answer this question, answer N.
  65
  66 +config PAGE_TABLE_ISOLATION
  67 +       bool "Remove the kernel mapping in user mode"
  68 +       depends on X86_64 && !UML
  69 +       help
  70 +         This feature reduces the number of hardware side channels by
  71 +         ensuring that the majority of kernel addresses are not mapped
  72 +         into userspace.
  73 +
  74 +         See Documentation/x86/pagetable-isolation.txt for more details.
  75 +
  76  config SECURITY_INFINIBAND
  77         bool "Infiniband Security Hooks"
  78         depends on SECURITY && INFINIBAND
  79 --
  80 2.14.2
  81