arm64: Add skeleton to harden the branch predictor against aliasing attacks

[mirror_ubuntu-artful-kernel.git] / arch / arm64 / Kconfig

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index d0c728cc9c8723c72f7f68c3891f5f3acee12c1f..809d81914164e430c0898707b899ba4a5634efa7 100644 (file)
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -825,15 +825,31 @@ config FORCE_MAX_ZONEORDER
          4M allocations matching the default size used by generic code.
 
 config UNMAP_KERNEL_AT_EL0
-       bool "Unmap kernel when running in userspace (aka \"KAISER\")"
+       bool "Unmap kernel when running in userspace (aka \"KAISER\")" if EXPERT
        default y
        help
-         Some attacks against KASLR make use of the timing difference between
-         a permission fault which could arise from a page table entry that is
-         present in the TLB, and a translation fault which always requires a
-         page table walk. This option defends against these attacks by unmapping
-         the kernel whilst running in userspace, therefore forcing translation
-         faults for all of kernel space.
+         Speculation attacks against some high-performance processors can
+         be used to bypass MMU permission checks and leak kernel data to
+         userspace. This can be defended against by unmapping the kernel
+         when running in userspace, mapping it back in on exception entry
+         via a trampoline page in the vector table.
+
+         If unsure, say Y.
+
+config HARDEN_BRANCH_PREDICTOR
+       bool "Harden the branch predictor against aliasing attacks" if EXPERT
+       default y
+       help
+         Speculation attacks against some high-performance processors rely on
+         being able to manipulate the branch predictor for a victim context by
+         executing aliasing branches in the attacker context.  Such attacks
+         can be partially mitigated against by clearing internal branch
+         predictor state and limiting the prediction logic in some situations.
+
+         This config option will take CPU-specific actions to harden the
+         branch predictor against aliasing attacks and may rely on specific
+         instruction sequences or control bits being set by the system
+         firmware.
 
          If unsure, say Y.