Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a111b7c0 authored by Josh Poimboeuf's avatar Josh Poimboeuf Committed by Will Deacon
Browse files

arm64/speculation: Support 'mitigations=' cmdline option 



Configure arm64 runtime CPU speculation bug mitigations in accordance
with the 'mitigations=' cmdline option.  This affects Meltdown, Spectre
v2, and Speculative Store Bypass.

The default behavior is unchanged.

Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
[will: reorder checks so KASLR implies KPTI and SSBS is affected by cmdline]
Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
parent eb337cdf

Documentation/admin-guide/kernel-parameters.txt

+5 −3
Original line number Diff line number Diff line
@@ -2545,8 +2545,8 @@ 
			http://repo.or.cz/w/linux-2.6/mini2440.git



	mitigations=

			[X86,PPC,S390] Control optional mitigations for CPU

			vulnerabilities.  This is a set of curated,

			[X86,PPC,S390,ARM64] Control optional mitigations for

			CPU vulnerabilities.  This is a set of curated,

			arch-independent options, each of which is an

			aggregation of existing arch-specific options.
@@ -2555,11 +2555,13 @@ 
				improves system performance, but it may also

				expose users to several CPU vulnerabilities.

				Equivalent to: nopti [X86,PPC]

					       kpti=0 [ARM64]

					       nospectre_v1 [PPC]

					       nobp=0 [S390]

					       nospectre_v2 [X86,PPC,S390]

					       nospectre_v2 [X86,PPC,S390,ARM64]

					       spectre_v2_user=off [X86]

					       spec_store_bypass_disable=off [X86,PPC]

					       ssbd=force-off [ARM64]

					       l1tf=off [X86]



			auto (default)

arch/arm64/kernel/cpu_errata.c

+5 −1
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#include <linux/arm-smccc.h>

#include <linux/psci.h>

#include <linux/types.h>

#include <linux/cpu.h>

#include <asm/cpu.h>

#include <asm/cputype.h>

#include <asm/cpufeature.h>
@@ -386,6 +387,9 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry, 


	WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());



	if (cpu_mitigations_off())

		ssbd_state = ARM64_SSBD_FORCE_DISABLE;



	/* delay setting __ssb_safe until we get a firmware response */

	if (is_midr_in_range_list(read_cpuid_id(), entry->midr_range_list))

		this_cpu_safe = true;
@@ -589,7 +593,7 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope) 
	}



	/* forced off */

	if (__nospectre_v2) {

	if (__nospectre_v2 || cpu_mitigations_off()) {

		pr_info_once("spectrev2 mitigation disabled by command line option\n");

		__hardenbp_enab = false;

		return false;

arch/arm64/kernel/cpufeature.c

+7 −1
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <linux/stop_machine.h>

#include <linux/types.h>

#include <linux/mm.h>

#include <linux/cpu.h>

#include <asm/cpu.h>

#include <asm/cpufeature.h>

#include <asm/cpu_ops.h>
@@ -966,7 +967,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, 
		MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),

		{ /* sentinel */ }

	};

	char const *str = "command line option";

	char const *str = "kpti command line option";

	bool meltdown_safe;



	meltdown_safe = is_midr_in_range_list(read_cpuid_id(), kpti_safe_list);
@@ -996,6 +997,11 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, 
		}

	}



	if (cpu_mitigations_off() && !__kpti_forced) {

		str = "mitigations=off";

		__kpti_forced = -1;

	}



	if (!IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0)) {

		pr_info_once("kernel page table isolation disabled by kernel configuration\n");

		return false;