x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling

Concentrate it in arch/x86/mm/kaiser.c and use the upstream string "nopti".

Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit dea9aa9ffae11c91285335cc3215b4f0e48e8139)
Orabug: 27333760
CVE: CVE-2017-5754
Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>
Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e44a37b0a2c27aaf0f40f3c00398cbb763dcd998..b3edfcc2947010df4d943bf2c605cd33dabb8742 100644 (file)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2458,7 +2458,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
        nojitter        [IA-64] Disables jitter checking for ITC timers.
 
-       nokaiser        [X86-64] Disable KAISER isolation of kernel from user.
+       nopti           [X86-64] Disable KAISER isolation of kernel from user.
 
        no-kvmclock     [X86,KVM] Disable paravirtualized KVM clock driver
 

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 088eb4e15c5db8a7334f295f378a2f7bb23b762e..0199df88eb532d3709c2c7f6641dba6b66da174c 100644 (file)
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -188,20 +188,6 @@ static int __init x86_pcid_setup(char *s)
        return 1;
 }
 __setup("nopcid", x86_pcid_setup);
-
-static int __init x86_nokaiser_setup(char *s)
-{
-       /* nokaiser doesn't accept parameters */
-       if (s)
-               return -EINVAL;
-#ifdef CONFIG_KAISER
-       kaiser_enabled = 0;
-       setup_clear_cpu_cap(X86_FEATURE_KAISER);
-       pr_info("nokaiser: KAISER feature disabled\n");
-#endif
-       return 0;
-}
-early_param("nokaiser", x86_nokaiser_setup);
 #endif
 
 static int __init x86_noinvpcid_setup(char *s)
@@ -781,10 +767,6 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                c->x86_power = cpuid_edx(0x80000007);
 
        init_scattered_cpuid_features(c);
-#ifdef CONFIG_KAISER
-       if (kaiser_enabled)
-               set_cpu_cap(c, X86_FEATURE_KAISER);
-#endif
 }
 
 static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index bfd48347eaac0020973e22594b0a6a4cb23d4305..a724496a58520af2811b6e09c4b91a19781bca94 100644 (file)
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -275,8 +275,13 @@ void __init kaiser_init(void)
 {
        int cpu;
 
-       if (!kaiser_enabled)
+       if (!kaiser_enabled) {
+               setup_clear_cpu_cap(X86_FEATURE_KAISER);
                return;
+       }
+
+       setup_force_cpu_cap(X86_FEATURE_KAISER);
+
        kaiser_init_all_pgds();
 
        for_each_possible_cpu(cpu) {
@@ -419,3 +424,16 @@ void kaiser_flush_tlb_on_return_to_user(void)
                        X86_CR3_PCID_USER_FLUSH | KAISER_SHADOW_PGD_OFFSET);
 }
 EXPORT_SYMBOL(kaiser_flush_tlb_on_return_to_user);
+
+static int __init x86_nokaiser_setup(char *s)
+{
+       /* nopti doesn't accept parameters */
+       if (s)
+               return -EINVAL;
+
+       kaiser_enabled = 0;
+       pr_info("Kernel/User page tables isolation: disabled\n");
+
+       return 0;
+}
+early_param("nopti", x86_nokaiser_setup);