From dba7d654b0f3fc1cf9a749467464016fc7b2b13b Mon Sep 17 00:00:00 2001 From: David P Date: Fri, 5 Jan 2018 23:42:45 -0300 Subject: libre/linux-libre: add Arch Linux security patches and fix objtool issue --- ...6-pti-Do-not-enable-PTI-on-AMD-processors.patch | 42 ++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 libre/linux-libre/0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch (limited to 'libre/linux-libre/0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch') diff --git a/libre/linux-libre/0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch b/libre/linux-libre/0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch new file mode 100644 index 000000000..f3af870c7 --- /dev/null +++ b/libre/linux-libre/0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch @@ -0,0 +1,42 @@ +From 51786b65797aed683ca72293a3cb86a2cab987c0 Mon Sep 17 00:00:00 2001 +Message-Id: <51786b65797aed683ca72293a3cb86a2cab987c0.1514959852.git.jan.steffens@gmail.com> +In-Reply-To: +References: +From: Tom Lendacky +Date: Tue, 26 Dec 2017 23:43:54 -0600 +Subject: [PATCH 7/7] x86/cpu, x86/pti: Do not enable PTI on AMD processors + +AMD processors are not subject to the types of attacks that the kernel +page table isolation feature protects against. The AMD microarchitecture +does not allow memory references, including speculative references, that +access higher privileged data when running in a lesser privileged mode +when that access would result in a page fault. + +Disable page table isolation by default on AMD processors by not setting +the X86_BUG_CPU_INSECURE feature, which controls whether X86_FEATURE_PTI +is set. + +Signed-off-by: Tom Lendacky +Reviewed-by: Borislav Petkov +--- + arch/x86/kernel/cpu/common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index f2a94dfb434e9a7c..b1be494ab4e8badf 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -899,8 +899,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) + + setup_force_cpu_cap(X86_FEATURE_ALWAYS); + +- /* Assume for now that ALL x86 CPUs are insecure */ +- setup_force_cpu_bug(X86_BUG_CPU_INSECURE); ++ if (c->x86_vendor != X86_VENDOR_AMD) ++ setup_force_cpu_bug(X86_BUG_CPU_INSECURE); + + fpu__init_system(c); + +-- +2.15.1 + -- cgit v1.2.3