# Mitigations of CPU vulnerabilities:
# Аrch-independent:
# X86:
-# l1tf=full,force
# l1d_flush=on (a part of the l1tf option)
-# mds=full,nosmt
# tsx=off
# ARM64:
# kpti=on
CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not set'))]
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not off'),
CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not set'))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not off'),
+ CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set'))]
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not off'),
CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set'))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not off'),
+ CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not set'))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not off'),
+ CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not set'))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not off'),
+ CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not set'))]
if arch == 'ARM64':
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'),
AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'),
def normalize_cmdline_options(option, value):
# Don't normalize the cmdline option values if
# the Linux kernel doesn't use kstrtobool() for them
- if option == 'pti':
- # See pti_check_boottime_disable() in linux/arch/x86/mm/pti.c
- return value
- if option == 'spectre_v2':
- # See spectre_v2_parse_cmdline() in linux/arch/x86/kernel/cpu/bugs.c
- return value
if option == 'debugfs':
# See debugfs_kernel() in fs/debugfs/inode.c
return value
if option == 'mitigations':
- # See mitigations_parse_cmdline() in linux/kernel/cpu.c
+ # See mitigations_parse_cmdline() in kernel/cpu.c
+ return value
+ if option == 'pti':
+ # See pti_check_boottime_disable() in arch/x86/mm/pti.c
+ return value
+ if option == 'spectre_v2':
+ # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+ return value
+ if option == 'spectre_v2_user':
+ # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c
return value
if option == 'spec_store_bypass_disable':
# See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
return value
+ if option == 'l1tf':
+ # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c
+ return value
+ if option == 'mds':
+ # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c
+ return value
+ if option == 'tsx_async_abort':
+ # See tsx_async_abort_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+ return value
# Implement a limited part of the kstrtobool() logic
if value in ('1', 'on', 'On', 'ON', 'y', 'Y', 'yes', 'Yes', 'YES'):