Kernel patch with KPTI ?

[kevinff]

Hi

I noticed the repo is stuck since the kpti patches have been released.
Do you have troubles to merge the patches? Is there any hope to see them?
Or do you have a workaround?

Unfortunately i cannot help.

[matthewruffell]

Hello. Cheers for taking interest in my patchset.

KPTI has really put a spanner in the cogs when it comes to keeping the patchset alive. I made a forward port to 4.9.75, and got it compiling but I can't manage to get the system to boot. There are a lot of changes needed deep down to pax to make it compatible with KAISER, and I'm probably not capable of performing those changes at the moment.

Spender has been writing on twitter about resolving the problem by extending UDEREF and disabling the KPTI / KAISER patches altogether, which means even he does not want to use the code from upstream.

I have been having a chat to Kees about the next steps, and he replied that while I could try and fix the patchset, sooner or later "there will be another wall" and that I will also have decide how to get over problems that arise in the future.

Don't get me wrong, I really like the patchset and depend on its features to power Dapper Linux, but I'm starting to think that I might spend my time upstreaming features and working with Kees. You are probably aware of my 4.14 port in the other repo, and thats where I will probably start, breaking features up and landing them slowly.

Are there specific features you want to see upstream? I have a list, but it will be some time before I am fully up to speed with upstream development.

In the meantime, I could probably go through 4.9.75 and 4.9.76 etc and remove the specific KPTI changes that break boot, so we can get all the small fixes we expect from the point releases, but we would still remain vulnerable to meltdown and spectre. In the end, an attacker needs local access to exploit meltdown and spectre, and if you believe this patchset protects you against most classes of attacks (which it does) then the risk of getting completely owned by meltdown and spectre is slightly less, since the attacker has to work harder to compromise your machine.

Would this be something you are interested in? I could probably get a patch out to the latest 4.9.78 sometime in the next week or two if I drop the KPTI patches.

I know its not the most ideal solution. If you are concerned about your security, it may be the time to move to the latest upstream kernel release (4.15). In the end of the day, I started forward porting in late April, and have managed to keep the 4.9.x patchset alive until now, so 8 months is a pretty solid effort.

[kevinff]

Hello

Well i'm not interested in a patch without the kpti patches, you really did a good job and i thank you for your hard work during all those months.

About the patches i'd like to see, i don't know much about all the complex features grsec has compared to the latest kernel version. So what i will miss mostly are "fun" or useful features such as:
-Harden module auto-loading
-Restrict /proc to user
-TPE

For the "non fun" ones, i believe you will do a better job at choosing which ones should go upstream.
I will definitely look at the 4.15 release.

Thank you again and good luck