Whilst it is always correct to invalidate the TLB even if no page was unampped this
provides a small optimization and makes the modeUnmapPage behaviour mirror the general
arch behaviour
This fixes a problem with -O0 SMP builds on ARM visible as kernel
data aborts whenever the idle thread executes.
The idle thread receives no stack pointer. At -O2, this is fine
as the wfi() call is inlined and stack operations in idle_thread
are optimized out. At -O0, the stack operations remain and wfi()
is not inlined, resulting in stack accesses in the idle thread
that cause data aborts.
Forcing -O2 behaviour was deemed the simplest solution for now.
Giving the idle thread a stack would have had larger verification
ramifications for what is now a fairly uncommon use case.
Allows architectures to define their own operations for post deletion of capabilities.
The Arch_ variants could be extended to Mode_ if desired in the future, but there is
no need to do this until it is necessary.
Changes Arch_finaliseCap and Mode_finaliseCap to return the same finaliseCap_ret_t type
as finaliseCap. This allows the Arch and Mode specific functions to define cleanup
information of its capabilities if necessary, just like the generic capabilities can
in finaliseCap.
Provides the ability to enable the IBRS hardware Spectre mitigation strategies, as well
as completes the software mitigation by disabling jump tables in compilation. The
hardware mitigations are largely provided "for completeness" in the hopes that they
eventually become less expensive. For the moment there is no reason to turn on any
beyond STIBP if running in multicore
(1) Use NODE_STATE() to access per-core kernel data.
(2) Allocate kernel stack in src/arch/arm/64/head.S.
(3) Use the TPIDR_EL1 to contain the kernel stack pointer
as well as the logical core ID. The kernel stack must
be 4-KiB aligned, and the lowest 12 bits of TPIDR_EL1
are for the logical core ID.
(4) Define the LD_EX, ST_EX, and OP_WIDTH as "ldxr", "stxr",
and "w".
(5) Add irq_remote_call_ipi and irq_reschedule_ipi
Prevents the kernel from writing to read only memory. This shouldn't happen, but catching
such attempts aids debugging and costs nothing to have neabled.
Introduces a kernel option that, when enabled, reduces the kernel window in a user address
space to just be Static Kernel Image and Microstate (SKIM), instead of the full kernel
address space. This isolates the important kernel data from the user preventing a
Meltdown style attack being able to violate secrecy. The kernel text and read only data,
i.e. anything that is static from boot, is not secret and can be allowed in the SKIM window
and potentially read by the user. Additionally to switch to and from the actual kernel
address space a small amount of state needs to also be in the SKIM window.
This is only an implementation for x86-64, although the same design is applicable to ia32
