x86, smap: Turn on Supervisor Mode Access Prevention
authorH. Peter Anvin <hpa@linux.intel.com>
Fri, 21 Sep 2012 19:43:13 +0000 (12:43 -0700)
committerH. Peter Anvin <hpa@linux.intel.com>
Fri, 21 Sep 2012 19:45:27 +0000 (12:45 -0700)
If Supervisor Mode Access Prevention is available and not disabled by
the user, turn it on.  Also fix the expansion of SMEP (Supervisor Mode
Execution Prevention.)

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1348256595-29119-10-git-send-email-hpa@linux.intel.com
Documentation/kernel-parameters.txt
arch/x86/kernel/cpu/common.c

index ad7e2e5088c126ce48e0362d1f3296f3e8b55d2b..49c5c41b07e1d1a21327f51d16f950045a5e1b66 100644 (file)
@@ -1812,8 +1812,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        noexec=on: enable non-executable mappings (default)
                        noexec=off: disable non-executable mappings
 
+       nosmap          [X86]
+                       Disable SMAP (Supervisor Mode Access Prevention)
+                       even if it is supported by processor.
+
        nosmep          [X86]
-                       Disable SMEP (Supervisor Mode Execution Protection)
+                       Disable SMEP (Supervisor Mode Execution Prevention)
                        even if it is supported by processor.
 
        noexec32        [X86-64]
index cd43e525fde8e9309f773ce9675fb5b0107ebebe..7d35d65941181d4c5db49293ff4f49448451c638 100644 (file)
@@ -278,6 +278,31 @@ static __cpuinit void setup_smep(struct cpuinfo_x86 *c)
        }
 }
 
+static int disable_smap __cpuinitdata;
+static __init int setup_disable_smap(char *arg)
+{
+       disable_smap = 1;
+       return 1;
+}
+__setup("nosmap", setup_disable_smap);
+
+static __cpuinit void setup_smap(struct cpuinfo_x86 *c)
+{
+       if (cpu_has(c, X86_FEATURE_SMAP)) {
+               if (unlikely(disable_smap)) {
+                       setup_clear_cpu_cap(X86_FEATURE_SMAP);
+                       clear_in_cr4(X86_CR4_SMAP);
+               } else {
+                       set_in_cr4(X86_CR4_SMAP);
+                       /*
+                        * Don't use clac() here since alternatives
+                        * haven't run yet...
+                        */
+                       asm volatile(__stringify(__ASM_CLAC) ::: "memory");
+               }
+       }
+}
+
 /*
  * Some CPU features depend on higher CPUID levels, which may not always
  * be available due to CPUID level capping or broken virtualization
@@ -713,6 +738,7 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
        filter_cpuid_features(c, false);
 
        setup_smep(c);
+       setup_smap(c);
 
        if (this_cpu->c_bsp_init)
                this_cpu->c_bsp_init(c);