Patch "[PATCH 21/27] x86/speculation: Support 'mitigations=' cmdline option" has been added to the 5.1-stable tree
Subsystems (4)
[email protected]
AppliedThis is a note to let you know that I've just added the patch titled
[PATCH 21/27] x86/speculation: Support 'mitigations=' cmdline option
to the 5.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
0021-x86-speculation-Support-mitigations-cmdline-option.patch
and it can be found in the queue-5.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
From bb42508b4ffd4daa964388437887fa4f1bfc4c43 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <[email protected]>
Date: Fri, 12 Apr 2019 15:39:29 -0500
Subject: [PATCH 21/27] x86/speculation: Support 'mitigations=' cmdline option
commit d68be4c4d31295ff6ae34a8ddfaa4c1a8ff42812 upstream
Configure x86 runtime CPU speculation bug mitigations in accordance with the 'mitigations=' cmdline option. This affects Meltdown, Spectre v2, Speculative Store Bypass, and L1TF.
The default behavior is unchanged.
--- Documentation/admin-guide/kernel-parameters.txt | 16 +++++++++++----- arch/x86/kernel/cpu/bugs.c | 11 +++++++++-- arch/x86/mm/pti.c | 4 +++- 3 files changed, 23 insertions(+), 8 deletions(-)
Documentation/admin-guide/kernel-parameters.txt +11 -5
@@ -2571,15 +2571,20 @@ http://repo.or.cz/w/linux-2.6/mini2440.git mitigations= - Control optional mitigations for CPU vulnerabilities. - This is a set of curated, arch-independent options, each - of which is an aggregation of existing arch-specific - options. + [X86] Control optional mitigations for CPU + vulnerabilities. This is a set of curated, + arch-independent options, each of which is an + aggregation of existing arch-specific options. off Disable all optional CPU mitigations. This improves system performance, but it may also expose users to several CPU vulnerabilities. + Equivalent to: nopti [X86] + nospectre_v2 [X86] + spectre_v2_user=off [X86] + spec_store_bypass_disable=off [X86] + l1tf=off [X86] auto (default) Mitigate all CPU vulnerabilities, but leave SMT
@@ -2587,12 +2592,13 @@ users who don't want to be surprised by SMT getting disabled across kernel upgrades, or who have other ways of avoiding SMT-based attacks. - This is the default behavior. + Equivalent to: (default behavior) auto,nosmt Mitigate all CPU vulnerabilities, disabling SMT if needed. This is for users who always want to be fully mitigated, even if it means losing SMT. + Equivalent to: l1tf=flush,nosmt [X86] mminit_loglevel= [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
arch/x86/kernel/cpu/bugs.c +9 -2
@@ -506,7 +506,8 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)char arg[20 ];int ret, i; -if (cmdline_find_option_bool (boot_command_line,"nospectre_v2" )) +if (cmdline_find_option_bool (boot_command_line,"nospectre_v2" ) || +cpu_mitigations_off ())return SPECTRE_V2_CMD_NONE ; ret =cmdline_find_option (boot_command_line,"spectre_v2" , arg,sizeof (arg));
@@ -771,7 +772,8 @@ static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void)char arg[20 ];int ret, i; -if (cmdline_find_option_bool (boot_command_line,"nospec_store_bypass_disable" )) { +if (cmdline_find_option_bool (boot_command_line,"nospec_store_bypass_disable" ) || +cpu_mitigations_off ()) {return SPEC_STORE_BYPASS_CMD_NONE ; }else { ret = cmdline_find_option(boot_command_line, "spec_store_bypass_disable",
@@ -1107,6 +1109,11 @@ static void __init l1tf_select_mitigation(void)if (!boot_cpu_has_bug (X86_BUG_L1TF ))return ; +if (cpu_mitigations_off ()) + l1tf_mitigation =L1TF_MITIGATION_OFF ; +else if (cpu_mitigations_auto_nosmt ()) + l1tf_mitigation =L1TF_MITIGATION_FLUSH_NOSMT ; +override_cache_bits (&boot_cpu_data);switch (l1tf_mitigation) {
arch/x86/mm/pti.c +3 -1
@@ -35,6 +35,7 @@#include <linux/spinlock.h> #include <linux/mm.h> #include <linux/uaccess.h> +#include <linux/cpu.h> #include <asm/cpufeature.h> #include <asm/hypervisor.h>
@@ -115,7 +116,8 @@ void __init pti_check_boottime_disable(void) } } -if (cmdline_find_option_bool (boot_command_line,"nopti" )) { +if (cmdline_find_option_bool (boot_command_line,"nopti" ) || +cpu_mitigations_off ()) { pti_mode =PTI_FORCE_OFF ;pti_print_if_insecure ("disabled on command line." );return ;
Signature · 22 lines
2.21.0 Patches currently in stable-queue which might be from [email protected] are queue-5.1/0019-x86-speculation-mds-Print-SMT-vulnerable-on-MSBDS-wi.patch queue-5.1/0016-x86-speculation-Move-arch_smt_update-call-to-after-m.patch queue-5.1/0024-x86-speculation-mds-Add-mitigations-support-for-MDS.patch queue-5.1/0021-x86-speculation-Support-mitigations-cmdline-option.patch queue-5.1/0022-powerpc-speculation-Support-mitigations-cmdline-opti.patch queue-5.1/0020-cpu-speculation-Add-mitigations-cmdline-option.patch queue-5.1/0023-s390-speculation-Support-mitigations-cmdline-option.patch queue-5.1/0015-x86-speculation-mds-Add-mds-full-nosmt-cmdline-optio.patch queue-5.1/0027-x86-speculation-mds-Fix-documentation-typo.patch queue-5.1/0017-x86-speculation-mds-Add-SMT-warning-message.patch queue-5.1/0018-x86-speculation-mds-Fix-comment.patch _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel