uniformlyrandom

  +void __init pti_check_boottime_disable(void)
  ...
  +	ret = cmdline_find_option(boot_command_line, "pti", arg, sizeof(arg));
  +	if (ret > 0)  {
  +		if (ret == 3 && !strncmp(arg, "off", 3)) {
  +			pti_print_if_insecure("disabled on command line.");
  +			return;
  +		}
  +		if (ret == 2 && !strncmp(arg, "on", 2)) {
  +			pti_print_if_secure("force enabled on command line.");
  +			goto enable;
  +  		}
  +		if (ret == 4 && !strncmp(arg, "auto", 4))
  +			goto autosel;
  +	}
  +
  +	if (cmdline_find_option_bool(boot_command_line, "nopti")) {
  +		pti_print_if_insecure("disabled on command line.");
  +		return;
  +	}
  +
  +autosel:
  +	if (!boot_cpu_has_bug(X86_BUG_CPU_INSECURE))
  +		return;

  --- a/arch/x86/include/asm/processor.h  
  +++ b/arch/x86/include/asm/processor.h
  + * On Intel CPUs, if a SYSCALL instruction is at the highest canonical
  + * address, then that syscall will enter the kernel with a
  + * non-canonical return address, and SYSRET will explode dangerously.
  + * We avoid this particular problem by preventing anything executable  
  + * from being mapped at the maximum canonical address.
  + *
  + * On AMD CPUs in the Ryzen family, there's a nasty bug in which the
  + * CPUs malfunction if they execute code from the highest canonical page.
  + * They'll speculate right off the end of the canonical space, and
  + * bad things happen.  This is worked around in the same way as the
  + * Intel problem.

  +#ifdef CONFIG_PAGE_TABLE_ISOLATION
  +# define DISABLE_PTI		0
  +#else
  +# define DISABLE_PTI		(1 << (X86_FEATURE_PTI & 31))
  +#endif