Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3aec8a2 authored by Suzuki K Poulose's avatar Suzuki K Poulose Committed by Will Deacon
Browse files

arm64: capabilities: Restrict KPTI detection to boot-time CPUs 



KPTI is treated as a system wide feature and is only detected if all
the CPUs in the sysetm needs the defense, unless it is forced via kernel
command line. This leaves a system with a mix of CPUs with and without
the defense vulnerable. Also, if a late CPU needs KPTI but KPTI was not
activated at boot time, the CPU is currently allowed to boot, which is a
potential security vulnerability.
This patch ensures that the KPTI is turned on if at least one CPU detects
the capability (i.e, change scope to SCOPE_LOCAL_CPU). Also rejetcs a late
CPU, if it requires the defense, when the system hasn't enabled it,

Cc: Will Deacon <will.deacon@arm.com>
Reviewed-by: default avatarDave Martin <dave.martin@arm.com>
Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
parent 5c137714

arch/arm64/include/asm/cpufeature.h

+9 −0
Original line number Original line Diff line number Diff line
@@ -248,6 +248,15 @@ extern struct arm64_ftr_reg arm64_ftr_reg_ctrel0; 
	 ARM64_CPUCAP_OPTIONAL_FOR_LATE_CPU	|	\

	 ARM64_CPUCAP_OPTIONAL_FOR_LATE_CPU	|	\

	 ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU)

	 ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU)





/*

 * CPU feature detected at boot time, on one or more CPUs. A late CPU

 * is not allowed to have the capability when the system doesn't have it.

 * It is Ok for a late CPU to miss the feature.

 */

#define ARM64_CPUCAP_BOOT_RESTRICTED_CPU_LOCAL_FEATURE	\

	(ARM64_CPUCAP_SCOPE_LOCAL_CPU		|	\

	 ARM64_CPUCAP_OPTIONAL_FOR_LATE_CPU)



struct arm64_cpu_capabilities {

struct arm64_cpu_capabilities {

	const char *desc;

	const char *desc;

	u16 capability;

	u16 capability;

arch/arm64/kernel/cpufeature.c

+11 −5
Original line number Original line Diff line number Diff line
@@ -880,10 +880,9 @@ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry, 
static int __kpti_forced; /* 0: not forced, >0: forced on, <0: forced off */

static int __kpti_forced; /* 0: not forced, >0: forced on, <0: forced off */





static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,

static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,

				int __unused)

				int scope)

{

{

	char const *str = "command line option";

	char const *str = "command line option";

	u64 pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);





	/*

	/*

	 * For reasons that aren't entirely clear, enabling KPTI on Cavium

	 * For reasons that aren't entirely clear, enabling KPTI on Cavium
@@ -914,8 +913,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, 
	}

	}





	/* Defer to CPU feature registers */

	/* Defer to CPU feature registers */

	return !cpuid_feature_extract_unsigned_field(pfr0,

	return !has_cpuid_feature(entry, scope);

						     ID_AA64PFR0_CSV3_SHIFT);

}

}





static void

static void
@@ -1062,7 +1060,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { 
	{

	{

		.desc = "Kernel page table isolation (KPTI)",

		.desc = "Kernel page table isolation (KPTI)",

		.capability = ARM64_UNMAP_KERNEL_AT_EL0,

		.capability = ARM64_UNMAP_KERNEL_AT_EL0,

		.type = ARM64_CPUCAP_SYSTEM_FEATURE,

		.type = ARM64_CPUCAP_BOOT_RESTRICTED_CPU_LOCAL_FEATURE,

		/*

		 * The ID feature fields below are used to indicate that

		 * the CPU doesn't need KPTI. See unmap_kernel_at_el0 for

		 * more details.

		 */

		.sys_reg = SYS_ID_AA64PFR0_EL1,

		.field_pos = ID_AA64PFR0_CSV3_SHIFT,

		.min_field_value = 1,

		.matches = unmap_kernel_at_el0,

		.matches = unmap_kernel_at_el0,

		.cpu_enable = kpti_install_ng_mappings,

		.cpu_enable = kpti_install_ng_mappings,

	},

	},