diff mbox series

[RFC,1/4] arm64: kpti: enable KPTI only when KASLR is truly enabled.

Message ID 20181213172036.14504-2-ard.biesheuvel@linaro.org (mailing list archive)
State RFC
Headers show
Series arm64: kpti: use nG mappings unless KPTI is force disabled | expand

Commit Message

Ard Biesheuvel Dec. 13, 2018, 5:20 p.m. UTC 
Kernels built with CONFIG_RANDOMIZE_BASE=y may run with KASLR disabled
when no RNG is provided by the firmware, or when it has been turned
off explicitly by putting 'nokaslr' on the command line.

In this case, there is no point in enabling KPTI on cores that have no
need for it otherwise, so take kaslr_offset() into account here.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 arch/arm64/kernel/cpufeature.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index aec5ecb85737..ef8118274ca9 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -937,7 +937,7 @@  static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
 	}
 
 	/* Useful for KASLR robustness */
-	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
+	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && kaslr_offset() > 0)
 		return true;
 
 	/* Don't force KPTI for CPUs that are not vulnerable */