patches/kernel/0193-x86-pti-Add-the-pti-cmdline-option-and-documentation.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Borislav Petkov <bp@suse.de>
   3 Date: Tue, 12 Dec 2017 14:39:52 +0100
   4 Subject: [PATCH] x86/pti: Add the pti= cmdline option and documentation
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 Keep the "nopti" optional for traditional reasons.
  12
  13 [ tglx: Don't allow force on when running on XEN PV and made 'on'
  14         printout conditional ]
  15
  16 Requested-by: Linus Torvalds <torvalds@linux-foundation.org>
  17 Signed-off-by: Borislav Petkov <bp@suse.de>
  18 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  19 Cc: Andy Lutomirski <luto@kernel.org>
  20 Cc: Andy Lutomirsky <luto@kernel.org>
  21 Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
  22 Cc: Borislav Petkov <bp@alien8.de>
  23 Cc: Brian Gerst <brgerst@gmail.com>
  24 Cc: Dave Hansen <dave.hansen@intel.com>
  25 Cc: Dave Hansen <dave.hansen@linux.intel.com>
  26 Cc: David Laight <David.Laight@aculab.com>
  27 Cc: Denys Vlasenko <dvlasenk@redhat.com>
  28 Cc: Eduardo Valentin <eduval@amazon.com>
  29 Cc: Greg KH <gregkh@linuxfoundation.org>
  30 Cc: H. Peter Anvin <hpa@zytor.com>
  31 Cc: Josh Poimboeuf <jpoimboe@redhat.com>
  32 Cc: Juergen Gross <jgross@suse.com>
  33 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  34 Cc: Peter Zijlstra <peterz@infradead.org>
  35 Cc: Will Deacon <will.deacon@arm.com>
  36 Cc: aliguori@amazon.com
  37 Cc: daniel.gruss@iaik.tugraz.at
  38 Cc: hughd@google.com
  39 Cc: keescook@google.com
  40 Link: https://lkml.kernel.org/r/20171212133952.10177-1-bp@alien8.de
  41 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  42 (cherry picked from commit 41f4c20b57a4890ea7f56ff8717cc83fefb8d537)
  43 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  44 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  45 (cherry picked from commit 96d3670fa8f88989fb7c0be5172a1378143f3296)
  46 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  47 ---
  48  Documentation/admin-guide/kernel-parameters.txt |  6 ++++++
  49  arch/x86/mm/pti.c                               | 26 ++++++++++++++++++++++++-
  50  2 files changed, 31 insertions(+), 1 deletion(-)
  51
  52 diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
  53 index e2a4608da5d2..b4d2edf316db 100644
  54 --- a/Documentation/admin-guide/kernel-parameters.txt
  55 +++ b/Documentation/admin-guide/kernel-parameters.txt
  56 @@ -3247,6 +3247,12 @@
  57         pt.             [PARIDE]
  58                         See Documentation/blockdev/paride.txt.
  59
  60 +       pti=            [X86_64]
  61 +                       Control user/kernel address space isolation:
  62 +                       on - enable
  63 +                       off - disable
  64 +                       auto - default setting
  65 +
  66         pty.legacy_count=
  67                         [KNL] Number of legacy pty's. Overwrites compiled-in
  68                         default number.
  69 diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
  70 index 375f23a758bc..a13f6b109865 100644
  71 --- a/arch/x86/mm/pti.c
  72 +++ b/arch/x86/mm/pti.c
  73 @@ -54,21 +54,45 @@ static void __init pti_print_if_insecure(const char *reason)
  74                 pr_info("%s\n", reason);
  75  }
  76
  77 +static void __init pti_print_if_secure(const char *reason)
  78 +{
  79 +       if (!boot_cpu_has_bug(X86_BUG_CPU_INSECURE))
  80 +               pr_info("%s\n", reason);
  81 +}
  82 +
  83  void __init pti_check_boottime_disable(void)
  84  {
  85 +       char arg[5];
  86 +       int ret;
  87 +
  88         if (hypervisor_is_type(X86_HYPER_XEN_PV)) {
  89                 pti_print_if_insecure("disabled on XEN PV.");
  90                 return;
  91         }
  92
  93 +       ret = cmdline_find_option(boot_command_line, "pti", arg, sizeof(arg));
  94 +       if (ret > 0)  {
  95 +               if (ret == 3 && !strncmp(arg, "off", 3)) {
  96 +                       pti_print_if_insecure("disabled on command line.");
  97 +                       return;
  98 +               }
  99 +               if (ret == 2 && !strncmp(arg, "on", 2)) {
 100 +                       pti_print_if_secure("force enabled on command line.");
 101 +                       goto enable;
 102 +               }
 103 +               if (ret == 4 && !strncmp(arg, "auto", 4))
 104 +                       goto autosel;
 105 +       }
 106 +
 107         if (cmdline_find_option_bool(boot_command_line, "nopti")) {
 108                 pti_print_if_insecure("disabled on command line.");
 109                 return;
 110         }
 111
 112 +autosel:
 113         if (!boot_cpu_has_bug(X86_BUG_CPU_INSECURE))
 114                 return;
 115 -
 116 +enable:
 117         setup_force_cpu_cap(X86_FEATURE_PTI);
 118  }
 119
 120 --
 121 2.14.2
 122