leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

arm64/speculation: Support 'mitigations=' cmdline option

Browse Source 
Configure arm64 runtime CPU speculation bug mitigations in accordance
with the 'mitigations=' cmdline option.  This affects Meltdown, Spectre
v2, and Speculative Store Bypass.

The default behavior is unchanged.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
[will: reorder checks so KASLR implies KPTI and SSBS is affected by cmdline]
Signed-off-by: Will Deacon <will.deacon@arm.com>
This commit is contained in:
Josh Poimboeuf 2019-04-12 15:39:32 -05:00 committed by Will Deacon
parent eb337cdfcd
commit a111b7c0f2
3 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Documentation/admin-guide/kernel-parameters.txt
View File

@ -2545,8 +2545,8 @@
http://repo.or.cz/w/linux-2.6/mini2440.git http://repo.or.cz/w/linux-2.6/mini2440.git
mitigations= mitigations=
[X86,PPC,S390] Control optional mitigations for CPU [X86,PPC,S390,ARM64] Control optional mitigations for
vulnerabilities. This is a set of curated, CPU vulnerabilities. This is a set of curated,
arch-independent options, each of which is an arch-independent options, each of which is an
aggregation of existing arch-specific options. aggregation of existing arch-specific options.
@ -2555,11 +2555,13 @@
improves system performance, but it may also improves system performance, but it may also
expose users to several CPU vulnerabilities. expose users to several CPU vulnerabilities.
Equivalent to: nopti [X86,PPC] Equivalent to: nopti [X86,PPC]
kpti=0 [ARM64]
nospectre_v1 [PPC] nospectre_v1 [PPC]
nobp=0 [S390] nobp=0 [S390]
nospectre_v2 [X86,PPC,S390] nospectre_v2 [X86,PPC,S390,ARM64]
spectre_v2_user=off [X86] spectre_v2_user=off [X86]
spec_store_bypass_disable=off [X86,PPC] spec_store_bypass_disable=off [X86,PPC]
ssbd=force-off [ARM64]
l1tf=off [X86] l1tf=off [X86]
auto (default) auto (default)

6
arch/arm64/kernel/cpu_errata.c
View File

@ -19,6 +19,7 @@
#include <linux/arm-smccc.h> #include <linux/arm-smccc.h>
#include <linux/psci.h> #include <linux/psci.h>
#include <linux/types.h> #include <linux/types.h>
#include <linux/cpu.h>
#include <asm/cpu.h> #include <asm/cpu.h>
#include <asm/cputype.h> #include <asm/cputype.h>
#include <asm/cpufeature.h> #include <asm/cpufeature.h>
@ -386,6 +387,9 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible()); WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
if (cpu_mitigations_off())
ssbd_state = ARM64_SSBD_FORCE_DISABLE;
/* delay setting __ssb_safe until we get a firmware response */ /* delay setting __ssb_safe until we get a firmware response */
if (is_midr_in_range_list(read_cpuid_id(), entry->midr_range_list)) if (is_midr_in_range_list(read_cpuid_id(), entry->midr_range_list))
this_cpu_safe = true; this_cpu_safe = true;
@ -589,7 +593,7 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope)
} }
/* forced off */ /* forced off */
if (__nospectre_v2) { if (__nospectre_v2 || cpu_mitigations_off()) {
pr_info_once("spectrev2 mitigation disabled by command line option\n"); pr_info_once("spectrev2 mitigation disabled by command line option\n");
__hardenbp_enab = false; __hardenbp_enab = false;
return false; return false;

8
arch/arm64/kernel/cpufeature.c
View File

@ -25,6 +25,7 @@
#include <linux/stop_machine.h> #include <linux/stop_machine.h>
#include <linux/types.h> #include <linux/types.h>
#include <linux/mm.h> #include <linux/mm.h>
#include <linux/cpu.h>
#include <asm/cpu.h> #include <asm/cpu.h>
#include <asm/cpufeature.h> #include <asm/cpufeature.h>
#include <asm/cpu_ops.h> #include <asm/cpu_ops.h>
@ -966,7 +967,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
{ /* sentinel */ } { /* sentinel */ }
}; };
char const *str = "command line option"; char const *str = "kpti command line option";
bool meltdown_safe; bool meltdown_safe;
meltdown_safe = is_midr_in_range_list(read_cpuid_id(), kpti_safe_list); meltdown_safe = is_midr_in_range_list(read_cpuid_id(), kpti_safe_list);
@ -996,6 +997,11 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
} }
} }
if (cpu_mitigations_off() && !__kpti_forced) {
str = "mitigations=off";
__kpti_forced = -1;
}
if (!IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0)) { if (!IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0)) {
pr_info_once("kernel page table isolation disabled by kernel configuration\n"); pr_info_once("kernel page table isolation disabled by kernel configuration\n");
return false; return false;