lkml.org 
[lkml]   [2023]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v7 09/12] x86/cpu: Add a configuration and command line option for Key Locker
    Date
    Add CONFIG_X86_KEYLOCKER to gate whether Key Locker is initialized at
    boot. The option is selected by the Key Locker cipher module
    CRYPTO_AES_KL (to be added in a later patch).

    Add a new command line option "nokeylocker" to optionally override the
    default CONFIG_X86_KEYLOCKER=y behavior.

    Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
    Reviewed-by: Dan Williams <dan.j.williams@intel.com>
    Cc: Jonathan Corbet <corbet@lwn.net>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: linux-doc@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    ---
    Changes from v6:
    * Rebase on the upstream: commit a894a8a56b57 ("Documentation:
    kernel-parameters: sort all "no..." parameters")

    Changes from RFC v2:
    * Make the option selected by CRYPTO_AES_KL. (Dan Williams)
    * Massage the changelog and the config option description.
    ---
    Documentation/admin-guide/kernel-parameters.txt | 2 ++
    arch/x86/Kconfig | 3 +++
    arch/x86/kernel/cpu/common.c | 16 ++++++++++++++++
    3 files changed, 21 insertions(+)

    diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
    index c1247ec4589a..b42fc53cbcf9 100644
    --- a/Documentation/admin-guide/kernel-parameters.txt
    +++ b/Documentation/admin-guide/kernel-parameters.txt
    @@ -3749,6 +3749,8 @@
    kernel and module base offset ASLR (Address Space
    Layout Randomization).

    + nokeylocker [X86] Disable Key Locker hardware feature.
    +
    no-kvmapf [X86,KVM] Disable paravirtualized asynchronous page
    fault handling.

    diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
    index a98c5f82be48..f9788b477db1 100644
    --- a/arch/x86/Kconfig
    +++ b/arch/x86/Kconfig
    @@ -1879,6 +1879,9 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS

    If unsure, say y.

    +config X86_KEYLOCKER
    + bool
    +
    choice
    prompt "TSX enable mode"
    depends on CPU_SUP_INTEL
    diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
    index 5882ff6e3c6b..718ff1b1d6dd 100644
    --- a/arch/x86/kernel/cpu/common.c
    +++ b/arch/x86/kernel/cpu/common.c
    @@ -402,6 +402,22 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c)
    static const unsigned long cr4_pinned_mask =
    X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP |
    X86_CR4_FSGSBASE | X86_CR4_CET;
    +
    +static __init int x86_nokeylocker_setup(char *arg)
    +{
    + /* Expect an exact match without trailing characters. */
    + if (strlen(arg))
    + return 0;
    +
    + if (!cpu_feature_enabled(X86_FEATURE_KEYLOCKER))
    + return 1;
    +
    + setup_clear_cpu_cap(X86_FEATURE_KEYLOCKER);
    + pr_info("x86/keylocker: Disabled by kernel command line.\n");
    + return 1;
    +}
    +__setup("nokeylocker", x86_nokeylocker_setup);
    +
    static DEFINE_STATIC_KEY_FALSE_RO(cr_pinning);
    static unsigned long cr4_pinned_bits __ro_after_init;

    --
    2.17.1
    \
     
     \ /
      Last update: 2023-05-24 19:11    [W:2.674 / U:0.448 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site