]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 3 Jan 2018 19:49:50 +0000 (20:49 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 3 Jan 2018 19:49:50 +0000 (20:49 +0100)
added patches:
kpti-rename-to-page_table_isolation.patch
kpti-report-when-enabled.patch

queue-4.4/kpti-rename-to-page_table_isolation.patch [new file with mode: 0644]
queue-4.4/kpti-report-when-enabled.patch [new file with mode: 0644]
queue-4.4/series

diff --git a/queue-4.4/kpti-rename-to-page_table_isolation.patch b/queue-4.4/kpti-rename-to-page_table_isolation.patch
new file mode 100644 (file)
index 0000000..f4cc47e
--- /dev/null
@@ -0,0 +1,306 @@
+From keescook@chromium.org  Wed Jan  3 20:49:20 2018
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 3 Jan 2018 10:43:15 -0800
+Subject: KPTI: Rename to PAGE_TABLE_ISOLATION
+To: Greg KH <gregkh@linuxfoundation.org>
+Message-ID: <20180103184315.GA18863@beast>
+Content-Disposition: inline
+
+From: Kees Cook <keescook@chromium.org>
+
+This renames CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/compressed/misc.h           |    2 +-
+ arch/x86/entry/entry_64.S                 |   12 ++++++------
+ arch/x86/include/asm/cpufeature.h         |    2 +-
+ arch/x86/include/asm/kaiser.h             |   12 ++++++------
+ arch/x86/include/asm/pgtable.h            |    4 ++--
+ arch/x86/include/asm/pgtable_64.h         |    4 ++--
+ arch/x86/include/asm/pgtable_types.h      |    2 +-
+ arch/x86/include/asm/tlbflush.h           |    2 +-
+ arch/x86/kernel/cpu/perf_event_intel_ds.c |    4 ++--
+ arch/x86/kernel/head_64.S                 |    2 +-
+ arch/x86/mm/Makefile                      |    2 +-
+ include/linux/kaiser.h                    |    6 +++---
+ include/linux/percpu-defs.h               |    2 +-
+ security/Kconfig                          |    2 +-
+ 14 files changed, 29 insertions(+), 29 deletions(-)
+
+--- a/arch/x86/boot/compressed/misc.h
++++ b/arch/x86/boot/compressed/misc.h
+@@ -9,7 +9,7 @@
+  */
+ #undef CONFIG_PARAVIRT
+ #undef CONFIG_PARAVIRT_SPINLOCKS
+-#undef CONFIG_KAISER
++#undef CONFIG_PAGE_TABLE_ISOLATION
+ #undef CONFIG_KASAN
+ #include <linux/linkage.h>
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -1043,7 +1043,7 @@ ENTRY(paranoid_entry)
+       SWAPGS
+       xorl    %ebx, %ebx
+ 1:
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       /*
+        * We might have come in between a swapgs and a SWITCH_KERNEL_CR3
+        * on entry, or between a SWITCH_USER_CR3 and a swapgs on exit.
+@@ -1083,7 +1083,7 @@ ENTRY(paranoid_exit)
+       DISABLE_INTERRUPTS(CLBR_NONE)
+       TRACE_IRQS_OFF_DEBUG
+       TRACE_IRQS_IRETQ_DEBUG
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       /* No ALTERNATIVE for X86_FEATURE_KAISER: paranoid_entry sets %ebx */
+       testl   $2, %ebx                        /* SWITCH_USER_CR3 needed? */
+       jz      paranoid_exit_no_switch
+@@ -1314,7 +1314,7 @@ ENTRY(nmi)
+       movq    %rsp, %rdi
+       movq    $-1, %rsi
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       /* Unconditionally use kernel CR3 for do_nmi() */
+       /* %rax is saved above, so OK to clobber here */
+       ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER
+@@ -1328,7 +1328,7 @@ ENTRY(nmi)
+ #endif
+       call    do_nmi
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       /*
+        * Unconditionally restore CR3.  I know we return to
+        * kernel code that needs user CR3, but do we ever return
+@@ -1558,7 +1558,7 @@ end_repeat_nmi:
+ 1:
+       movq    %rsp, %rdi
+       movq    $-1, %rsi
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       /* Unconditionally use kernel CR3 for do_nmi() */
+       /* %rax is saved above, so OK to clobber here */
+       ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER
+@@ -1574,7 +1574,7 @@ end_repeat_nmi:
+       /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
+       call    do_nmi
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       /*
+        * Unconditionally restore CR3.  We might be returning to
+        * kernel code that needs user CR3, like just just before
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -201,7 +201,7 @@
+ #define X86_FEATURE_INTEL_PT  ( 7*32+15) /* Intel Processor Trace */
+ /* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */
+-#define X86_FEATURE_KAISER    ( 7*32+31) /* CONFIG_KAISER w/o nokaiser */
++#define X86_FEATURE_KAISER    ( 7*32+31) /* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */
+ /* Virtualization flags: Linux defined, word 8 */
+ #define X86_FEATURE_TPR_SHADOW  ( 8*32+ 0) /* Intel TPR Shadow */
+--- a/arch/x86/include/asm/kaiser.h
++++ b/arch/x86/include/asm/kaiser.h
+@@ -20,7 +20,7 @@
+ #define KAISER_SHADOW_PGD_OFFSET 0x1000
+ #ifdef __ASSEMBLY__
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ .macro _SWITCH_TO_KERNEL_CR3 reg
+ movq %cr3, \reg
+@@ -69,7 +69,7 @@ movq PER_CPU_VAR(unsafe_stack_register_b
+ 8:
+ .endm
+-#else /* CONFIG_KAISER */
++#else /* CONFIG_PAGE_TABLE_ISOLATION */
+ .macro SWITCH_KERNEL_CR3
+ .endm
+@@ -78,11 +78,11 @@ movq PER_CPU_VAR(unsafe_stack_register_b
+ .macro SWITCH_KERNEL_CR3_NO_STACK
+ .endm
+-#endif /* CONFIG_KAISER */
++#endif /* CONFIG_PAGE_TABLE_ISOLATION */
+ #else /* __ASSEMBLY__ */
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ /*
+  * Upon kernel/user mode switch, it may happen that the address
+  * space has to be switched before the registers have been
+@@ -100,10 +100,10 @@ extern void __init kaiser_check_boottime
+ #else
+ #define kaiser_enabled        0
+ static inline void __init kaiser_check_boottime_disable(void) {}
+-#endif /* CONFIG_KAISER */
++#endif /* CONFIG_PAGE_TABLE_ISOLATION */
+ /*
+- * Kaiser function prototypes are needed even when CONFIG_KAISER is not set,
++ * Kaiser function prototypes are needed even when CONFIG_PAGE_TABLE_ISOLATION is not set,
+  * so as to build with tests on kaiser_enabled instead of #ifdefs.
+  */
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -18,7 +18,7 @@
+ #ifndef __ASSEMBLY__
+ #include <asm/x86_init.h>
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ extern int kaiser_enabled;
+ #else
+ #define kaiser_enabled 0
+@@ -872,7 +872,7 @@ static inline void pmdp_set_wrprotect(st
+ static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
+ {
+       memcpy(dst, src, count * sizeof(pgd_t));
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       if (kaiser_enabled) {
+               /* Clone the shadow pgd part as well */
+               memcpy(native_get_shadow_pgd(dst),
+--- a/arch/x86/include/asm/pgtable_64.h
++++ b/arch/x86/include/asm/pgtable_64.h
+@@ -106,7 +106,7 @@ static inline void native_pud_clear(pud_
+       native_set_pud(pud, native_make_pud(0));
+ }
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ extern pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd);
+ static inline pgd_t *native_get_shadow_pgd(pgd_t *pgdp)
+@@ -127,7 +127,7 @@ static inline pgd_t *native_get_shadow_p
+       BUILD_BUG_ON(1);
+       return NULL;
+ }
+-#endif /* CONFIG_KAISER */
++#endif /* CONFIG_PAGE_TABLE_ISOLATION */
+ static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
+ {
+--- a/arch/x86/include/asm/pgtable_types.h
++++ b/arch/x86/include/asm/pgtable_types.h
+@@ -109,7 +109,7 @@
+ #define X86_CR3_PCID_MASK       (X86_CR3_PCID_NOFLUSH | X86_CR3_PCID_ASID_MASK)
+ #define X86_CR3_PCID_ASID_KERN  (_AC(0x0,UL))
+-#if defined(CONFIG_KAISER) && defined(CONFIG_X86_64)
++#if defined(CONFIG_PAGE_TABLE_ISOLATION) && defined(CONFIG_X86_64)
+ /* Let X86_CR3_PCID_ASID_USER be usable for the X86_CR3_PCID_NOFLUSH bit */
+ #define X86_CR3_PCID_ASID_USER        (_AC(0x80,UL))
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -135,7 +135,7 @@ static inline void cr4_set_bits_and_upda
+  * Declare a couple of kaiser interfaces here for convenience,
+  * to avoid the need for asm/kaiser.h in unexpected places.
+  */
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ extern int kaiser_enabled;
+ extern void kaiser_setup_pcid(void);
+ extern void kaiser_flush_tlb_on_return_to_user(void);
+--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+@@ -274,7 +274,7 @@ static DEFINE_PER_CPU(void *, insn_buffe
+ static void *dsalloc(size_t size, gfp_t flags, int node)
+ {
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       unsigned int order = get_order(size);
+       struct page *page;
+       unsigned long addr;
+@@ -295,7 +295,7 @@ static void *dsalloc(size_t size, gfp_t
+ static void dsfree(const void *buffer, size_t size)
+ {
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+       if (!buffer)
+               return;
+       kaiser_remove_mapping((unsigned long)buffer, size);
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -441,7 +441,7 @@ early_idt_ripmsg:
+       .balign PAGE_SIZE; \
+ GLOBAL(name)
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ /*
+  * Each PGD needs to be 8k long and 8k aligned.  We do not
+  * ever go out to userspace with these, so we do not
+--- a/arch/x86/mm/Makefile
++++ b/arch/x86/mm/Makefile
+@@ -32,4 +32,4 @@ obj-$(CONFIG_ACPI_NUMA)              += srat.o
+ obj-$(CONFIG_NUMA_EMU)                += numa_emulation.o
+ obj-$(CONFIG_X86_INTEL_MPX)   += mpx.o
+-obj-$(CONFIG_KAISER)          += kaiser.o
++obj-$(CONFIG_PAGE_TABLE_ISOLATION)            += kaiser.o
+--- a/include/linux/kaiser.h
++++ b/include/linux/kaiser.h
+@@ -1,7 +1,7 @@
+ #ifndef _LINUX_KAISER_H
+ #define _LINUX_KAISER_H
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ #include <asm/kaiser.h>
+ static inline int kaiser_map_thread_stack(void *stack)
+@@ -24,7 +24,7 @@ static inline void kaiser_unmap_thread_s
+ #else
+ /*
+- * These stubs are used whenever CONFIG_KAISER is off, which
++ * These stubs are used whenever CONFIG_PAGE_TABLE_ISOLATION is off, which
+  * includes architectures that support KAISER, but have it disabled.
+  */
+@@ -48,5 +48,5 @@ static inline void kaiser_unmap_thread_s
+ {
+ }
+-#endif /* !CONFIG_KAISER */
++#endif /* !CONFIG_PAGE_TABLE_ISOLATION */
+ #endif /* _LINUX_KAISER_H */
+--- a/include/linux/percpu-defs.h
++++ b/include/linux/percpu-defs.h
+@@ -35,7 +35,7 @@
+ #endif
+-#ifdef CONFIG_KAISER
++#ifdef CONFIG_PAGE_TABLE_ISOLATION
+ #define USER_MAPPED_SECTION "..user_mapped"
+ #else
+ #define USER_MAPPED_SECTION ""
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -31,7 +31,7 @@ config SECURITY
+         If you are unsure how to answer this question, answer N.
+-config KAISER
++config PAGE_TABLE_ISOLATION
+       bool "Remove the kernel mapping in user mode"
+       default y
+       depends on X86_64 && SMP
diff --git a/queue-4.4/kpti-report-when-enabled.patch b/queue-4.4/kpti-report-when-enabled.patch
new file mode 100644 (file)
index 0000000..deb4a9a
--- /dev/null
@@ -0,0 +1,48 @@
+From keescook@chromium.org  Wed Jan  3 20:49:35 2018
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 3 Jan 2018 10:43:32 -0800
+Subject: KPTI: Report when enabled
+To: Greg KH <gregkh@linuxfoundation.org>
+Message-ID: <20180103184332.GA18888@beast>
+Content-Disposition: inline
+
+From: Kees Cook <keescook@chromium.org>
+
+Make sure dmesg reports when KPTI is enabled.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/kaiser.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/mm/kaiser.c
++++ b/arch/x86/mm/kaiser.c
+@@ -11,6 +11,9 @@
+ #include <linux/uaccess.h>
+ #include <linux/ftrace.h>
++#undef pr_fmt
++#define pr_fmt(fmt)     "Kernel/User page tables isolation: " fmt
++
+ #include <asm/kaiser.h>
+ #include <asm/tlbflush.h>     /* to verify its kaiser declarations */
+ #include <asm/pgtable.h>
+@@ -293,7 +296,7 @@ enable:
+       return;
+ disable:
+-      pr_info("Kernel/User page tables isolation: disabled\n");
++      pr_info("disabled\n");
+ silent_disable:
+       kaiser_enabled = 0;
+@@ -353,6 +356,8 @@ void __init kaiser_init(void)
+       kaiser_add_user_map_early(&debug_idt_table,
+                                 sizeof(gate_desc) * NR_VECTORS,
+                                 __PAGE_KERNEL);
++
++      pr_info("enabled\n");
+ }
+ /* Add a mapping to the shadow mapping, and synchronize the mappings */
index 124673a3689ac285b97dda79cee0145e0e6da7e4..1c42ce4b35cbeafc4161c15f9de20d77cb202f4b 100644 (file)
@@ -33,3 +33,5 @@ x86-paravirt-dont-patch-flush_tlb_single.patch
 x86-kaiser-reenable-paravirt.patch
 kaiser-disabled-on-xen-pv.patch
 x86-kaiser-move-feature-detection-up.patch
+kpti-rename-to-page_table_isolation.patch
+kpti-report-when-enabled.patch