svn commit: r328166 - in head/sys: amd64/amd64 x86/include x86/x86
Ed Maste
emaste at FreeBSD.org
Fri Jan 19 15:42:36 UTC 2018
Author: emaste
Date: Fri Jan 19 15:42:34 2018
New Revision: 328166
URL: https://svnweb.freebsd.org/changeset/base/328166
Log:
Enable KPTI by default on amd64 for non-AMD CPUs
Kernel Page Table Isolation (KPTI) was introduced in r328083 as a
mitigation for the 'Meltdown' vulnerability. AMD CPUs are not affected,
per https://www.amd.com/en/corporate/speculative-execution:
We believe AMD processors are not susceptible due to our use of
privilege level protections within paging architecture and no
mitigation is required.
Thus default KPTI to off for AMD CPUs, and to on for others. This may
be refined later as we obtain more specific information on the sets of
CPUs that are and are not affected.
Submitted by: Mitchell Horne
Reviewed by: cem
Relnotes: Yes
Security: CVE-2017-5754
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D13971
Modified:
head/sys/amd64/amd64/machdep.c
head/sys/x86/include/x86_var.h
head/sys/x86/x86/identcpu.c
Modified: head/sys/amd64/amd64/machdep.c
==============================================================================
--- head/sys/amd64/amd64/machdep.c Fri Jan 19 15:32:27 2018 (r328165)
+++ head/sys/amd64/amd64/machdep.c Fri Jan 19 15:42:34 2018 (r328166)
@@ -1621,6 +1621,7 @@ hammer_time(u_int64_t modulep, u_int64_t physfree)
mtx_init(&dt_lock, "descriptor tables", NULL, MTX_DEF);
/* exceptions */
+ pti = pti_get_default();
TUNABLE_INT_FETCH("vm.pmap.pti", &pti);
for (x = 0; x < NIDT; x++)
Modified: head/sys/x86/include/x86_var.h
==============================================================================
--- head/sys/x86/include/x86_var.h Fri Jan 19 15:32:27 2018 (r328165)
+++ head/sys/x86/include/x86_var.h Fri Jan 19 15:42:34 2018 (r328166)
@@ -136,6 +136,7 @@ void nmi_call_kdb_smp(u_int type, struct trapframe *fr
void nmi_handle_intr(u_int type, struct trapframe *frame);
void pagecopy(void *from, void *to);
void printcpuinfo(void);
+int pti_get_default(void);
int user_dbreg_trap(void);
int minidumpsys(struct dumperinfo *);
struct pcb *get_pcb_td(struct thread *td);
Modified: head/sys/x86/x86/identcpu.c
==============================================================================
--- head/sys/x86/x86/identcpu.c Fri Jan 19 15:32:27 2018 (r328165)
+++ head/sys/x86/x86/identcpu.c Fri Jan 19 15:42:34 2018 (r328166)
@@ -1608,6 +1608,16 @@ finishidentcpu(void)
#endif
}
+int
+pti_get_default(void)
+{
+
+ if (strcmp(cpu_vendor, AMD_VENDOR_ID) == 0)
+ return (0);
+
+ return (1);
+}
+
static u_int
find_cpu_vendor_id(void)
{
More information about the svn-src-all
mailing list