arm64: Add skeleton to harden the branch predictor against aliasing attacks

[mirror_ubuntu-artful-kernel.git] / arch / arm64 / Kconfig

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index c298069af6ba1ecfa5c9dbed749e4cb20cd2ec14..809d81914164e430c0898707b899ba4a5634efa7 100644 (file)
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -92,6 +92,7 @@ config ARM64
        select HAVE_ARCH_SECCOMP_FILTER
        select HAVE_ARCH_TRACEHOOK
        select HAVE_ARCH_TRANSPARENT_HUGEPAGE
+       select HAVE_ARCH_VMAP_STACK
        select HAVE_ARM_SMCCC
        select HAVE_EBPF_JIT
        select HAVE_C_RECORDMCOUNT
@@ -520,20 +521,13 @@ config CAVIUM_ERRATUM_30115
 config QCOM_FALKOR_ERRATUM_1003
        bool "Falkor E1003: Incorrect translation due to ASID change"
        default y
-       select ARM64_PAN if ARM64_SW_TTBR0_PAN
        help
          On Falkor v1, an incorrect ASID may be cached in the TLB when ASID
-         and BADDR are changed together in TTBRx_EL1. The workaround for this
-         issue is to use a reserved ASID in cpu_do_switch_mm() before
-         switching to the new ASID. Saying Y here selects ARM64_PAN if
-         ARM64_SW_TTBR0_PAN is selected. This is done because implementing and
-         maintaining the E1003 workaround in the software PAN emulation code
-         would be an unnecessary complication. The affected Falkor v1 CPU
-         implements ARMv8.1 hardware PAN support and using hardware PAN
-         support versus software PAN emulation is mutually exclusive at
-         runtime.
-
-         If unsure, say Y.
+         and BADDR are changed together in TTBRx_EL1. Since we keep the ASID
+         in TTBR1_EL1, this situation only occurs in the entry trampoline and
+         then only for entries in the walk cache, since the leaf translation
+         is unchanged. Work around the erratum by invalidating the walk cache
+         entries for the trampoline before entering the kernel proper.
 
 config QCOM_FALKOR_ERRATUM_1009
        bool "Falkor E1009: Prematurely complete a DSB after a TLBI"
@@ -830,6 +824,35 @@ config FORCE_MAX_ZONEORDER
          However for 4K, we choose a higher default value, 11 as opposed to 10, giving us
          4M allocations matching the default size used by generic code.
 
+config UNMAP_KERNEL_AT_EL0
+       bool "Unmap kernel when running in userspace (aka \"KAISER\")" if EXPERT
+       default y
+       help
+         Speculation attacks against some high-performance processors can
+         be used to bypass MMU permission checks and leak kernel data to
+         userspace. This can be defended against by unmapping the kernel
+         when running in userspace, mapping it back in on exception entry
+         via a trampoline page in the vector table.
+
+         If unsure, say Y.
+
+config HARDEN_BRANCH_PREDICTOR
+       bool "Harden the branch predictor against aliasing attacks" if EXPERT
+       default y
+       help
+         Speculation attacks against some high-performance processors rely on
+         being able to manipulate the branch predictor for a victim context by
+         executing aliasing branches in the attacker context.  Such attacks
+         can be partially mitigated against by clearing internal branch
+         predictor state and limiting the prediction logic in some situations.
+
+         This config option will take CPU-specific actions to harden the
+         branch predictor against aliasing attacks and may rely on specific
+         instruction sequences or control bits being set by the system
+         firmware.
+
+         If unsure, say Y.
+
 menuconfig ARMV8_DEPRECATED
        bool "Emulate deprecated/obsolete ARMv8 instructions"
        depends on COMPAT
@@ -988,6 +1011,18 @@ config ARM64_UAO
          regular load/store instructions if the cpu does not implement the
          feature.
 
+config ARM64_PMEM
+       bool "Enable support for persistent memory"
+       select ARCH_HAS_PMEM_API
+       select ARCH_HAS_UACCESS_FLUSHCACHE
+       help
+         Say Y to enable support for the persistent memory API based on the
+         ARMv8.2 DCPoP feature.
+
+         The feature is detected at runtime, and the kernel will use DC CVAC
+         operations if DC CVAP is not supported (following the behaviour of
+         DC CVAP itself if the system does not define a point of persistence).
+
 endmenu
 
 config ARM64_MODULE_CMODEL_LARGE