From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:15
Hi Greg,
Please queue up this series of patches for 4.9 if you have no objections.
The first one is not a backport but a fix for a previous backport.
cheers
Mauricio Faria de Oliveira (4):
powerpc/rfi-flush: Differentiate enabled and patched flush types
powerpc/pseries: Fix clearing of security feature flags
powerpc: Move default security feature flags
powerpc/pseries: Restore default security feature flags on setup
Michael Ellerman (18):
powerpc/rfi-flush: Move out of HARDLOCKUP_DETECTOR #ifdef
powerpc/pseries: Support firmware disable of RFI flush
powerpc/powernv: Support firmware disable of RFI flush
powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs
code
powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
powerpc/rfi-flush: Always enable fallback flush on pseries
powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
powerpc: Add security feature flags for Spectre/Meltdown
powerpc/pseries: Set or clear security feature flags
powerpc/powernv: Set or clear security feature flags
powerpc/64s: Move cpu_show_meltdown()
powerpc/64s: Enhance the information in cpu_show_meltdown()
powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
powerpc/64s: Wire up cpu_show_spectre_v1()
powerpc/64s: Wire up cpu_show_spectre_v2()
powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()
Nicholas Piggin (1):
powerpc/64s: Add support for a store forwarding barrier at kernel
entry/exit
arch/powerpc/include/asm/exception-64s.h | 29 ++++
arch/powerpc/include/asm/feature-fixups.h | 19 +++
arch/powerpc/include/asm/hvcall.h | 3 +
arch/powerpc/include/asm/security_features.h | 85 ++++++++++
arch/powerpc/include/asm/setup.h | 2 +-
arch/powerpc/kernel/Makefile | 2 +-
arch/powerpc/kernel/exceptions-64s.S | 16 +-
arch/powerpc/kernel/security.c | 237 +++++++++++++++++++++++++++
arch/powerpc/kernel/setup_64.c | 37 ++---
arch/powerpc/kernel/vmlinux.lds.S | 14 ++
arch/powerpc/lib/feature-fixups.c | 124 +++++++++++++-
arch/powerpc/platforms/powernv/setup.c | 92 ++++++++---
arch/powerpc/platforms/pseries/mobility.c | 3 +
arch/powerpc/platforms/pseries/pseries.h | 2 +
arch/powerpc/platforms/pseries/setup.c | 81 +++++++--
15 files changed, 679 insertions(+), 67 deletions(-)
create mode 100644 arch/powerpc/include/asm/security_features.h
create mode 100644 arch/powerpc/kernel/security.c
--
2.14.1
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:16
The backport of the RFI flush support, done by me, has a minor bug in
that the code is inside an #ifdef CONFIG_HARDLOCKUP_DETECTOR, which is
incorrect.
This doesn't matter with common configs because we enable
HARDLOCKUP_DETECTOR, but with future patches it will break the build.
So fix it.
Fixes: c3b82ebee6e0 ("powerpc/64s: Add support for RFI flush of L1-D cache")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/setup_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
This is a note to let you know that I've just added the patch titled
powerpc/rfi-flush: Move out of HARDLOCKUP_DETECTOR #ifdef
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:46 +1000
Subject: powerpc/rfi-flush: Move out of HARDLOCKUP_DETECTOR #ifdef
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
The backport of the RFI flush support, done by me, has a minor bug in
that the code is inside an #ifdef CONFIG_HARDLOCKUP_DETECTOR, which is
incorrect.
This doesn't matter with common configs because we enable
HARDLOCKUP_DETECTOR, but with future patches it will break the build.
So fix it.
Fixes: c3b82ebee6e0 ("powerpc/64s: Add support for RFI flush of L1-D cache")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/setup_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:17
commit 582605a429e20ae68fd0b041b2e840af296edd08 upstream.
Some versions of firmware will have a setting that can be configured
to disable the RFI flush, add support for it.
Fixes: 8989d56878a7 ("powerpc/pseries: Query hypervisor for RFI flush settings")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
@@ -473,7 +473,8 @@ static void pseries_setup_rfi_flush(void)if(types==L1D_FLUSH_NONE)types=L1D_FLUSH_FALLBACK;-if(!(result.behaviour&H_CPU_BEHAV_L1D_FLUSH_PR))+if((!(result.behaviour&H_CPU_BEHAV_L1D_FLUSH_PR))||+(!(result.behaviour&H_CPU_BEHAV_FAVOUR_SECURITY)))enable=false;}else{/* Default to fallback if case hcall is not available */
This is a note to let you know that I've just added the patch titled
powerpc/pseries: Support firmware disable of RFI flush
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:47 +1000
Subject: powerpc/pseries: Support firmware disable of RFI flush
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 582605a429e20ae68fd0b041b2e840af296edd08 upstream.
Some versions of firmware will have a setting that can be configured
to disable the RFI flush, add support for it.
Fixes: 8989d56878a7 ("powerpc/pseries: Query hypervisor for RFI flush settings")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
@@ -473,7 +473,8 @@ static void pseries_setup_rfi_flush(voidif(types==L1D_FLUSH_NONE)types=L1D_FLUSH_FALLBACK;-if(!(result.behaviour&H_CPU_BEHAV_L1D_FLUSH_PR))+if((!(result.behaviour&H_CPU_BEHAV_L1D_FLUSH_PR))||+(!(result.behaviour&H_CPU_BEHAV_FAVOUR_SECURITY)))enable=false;}else{/* Default to fallback if case hcall is not available */
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:18
commit eb0a2d2620ae431c543963c8c7f08f597366fc60 upstream.
Some versions of firmware will have a setting that can be configured
to disable the RFI flush, add support for it.
Fixes: 6e032b350cd1 ("powerpc/powernv: Check device-tree for RFI flush settings")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/powernv/setup.c | 4 ++++
1 file changed, 4 insertions(+)
This is a note to let you know that I've just added the patch titled
powerpc/powernv: Support firmware disable of RFI flush
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:48 +1000
Subject: powerpc/powernv: Support firmware disable of RFI flush
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit eb0a2d2620ae431c543963c8c7f08f597366fc60 upstream.
Some versions of firmware will have a setting that can be configured
to disable the RFI flush, add support for it.
Fixes: 6e032b350cd1 ("powerpc/powernv: Check device-tree for RFI flush settings")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/setup.c | 4 ++++
1 file changed, 4 insertions(+)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:19
commit 1e2a9fc7496955faacbbed49461d611b704a7505 upstream.
rfi_flush_enable() includes a check to see if we're already
enabled (or disabled), and in that case does nothing.
But that means calling setup_rfi_flush() a 2nd time doesn't actually
work, which is a bit confusing.
Move that check into the debugfs code, where it really belongs.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/setup_64.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
@@ -773,13 +770,19 @@ void __init setup_rfi_flush(enum l1d_flush_type types, bool enable)#ifdef CONFIG_DEBUG_FSstaticintrfi_flush_set(void*data,u64val){+boolenable;+if(val==1)-rfi_flush_enable(true);+enable=true;elseif(val==0)-rfi_flush_enable(false);+enable=false;elsereturn-EINVAL;+/* Only do anything if we're changing state */+if(enable!=rfi_flush)+rfi_flush_enable(enable);+return0;}
This is a note to let you know that I've just added the patch titled
powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:49 +1000
Subject: powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 1e2a9fc7496955faacbbed49461d611b704a7505 upstream.
rfi_flush_enable() includes a check to see if we're already
enabled (or disabled), and in that case does nothing.
But that means calling setup_rfi_flush() a 2nd time doesn't actually
work, which is a bit confusing.
Move that check into the debugfs code, where it really belongs.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/setup_64.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
@@ -773,13 +770,19 @@ void __init setup_rfi_flush(enum l1d_flu#ifdef CONFIG_DEBUG_FSstaticintrfi_flush_set(void*data,u64val){+boolenable;+if(val==1)-rfi_flush_enable(true);+enable=true;elseif(val==0)-rfi_flush_enable(false);+enable=false;elsereturn-EINVAL;+/* Only do anything if we're changing state */+if(enable!=rfi_flush)+rfi_flush_enable(enable);+return0;}
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:19
commit abf110f3e1cea40f5ea15e85f5d67c39c14568a7 upstream.
For PowerVM migration we want to be able to call setup_rfi_flush()
again after we've migrated the partition.
To support that we need to check that we're not trying to allocate the
fallback flush area after memblock has gone away (i.e., boot-time only).
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/include/asm/setup.h | 2 +-
arch/powerpc/kernel/setup_64.c | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
@@ -731,6 +731,10 @@ static void init_fallback_flush(void)u64l1d_size,limit;intcpu;+/* Only allocate the fallback flush area once (at boot time). */+if(l1d_flush_fallback_area)+return;+l1d_size=ppc64_caches.dsize;limit=min(safe_stack_limit(),ppc64_rma_size);
This is a note to let you know that I've just added the patch titled
powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:50 +1000
Subject: powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit abf110f3e1cea40f5ea15e85f5d67c39c14568a7 upstream.
For PowerVM migration we want to be able to call setup_rfi_flush()
again after we've migrated the partition.
To support that we need to check that we're not trying to allocate the
fallback flush area after memblock has gone away (i.e., boot-time only).
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/setup.h | 2 +-
arch/powerpc/kernel/setup_64.c | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
@@ -731,6 +731,10 @@ static void init_fallback_flush(void)u64l1d_size,limit;intcpu;+/* Only allocate the fallback flush area once (at boot time). */+if(l1d_flush_fallback_area)+return;+l1d_size=ppc64_caches.dsize;limit=min(safe_stack_limit(),ppc64_rma_size);
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:20
commit 84749a58b6e382f109abf1e734bc4dd43c2c25bb upstream.
This ensures the fallback flush area is always allocated on pseries,
so in case a LPAR is migrated from a patched to an unpatched system,
it is possible to enable the fallback flush in the target system.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
@@ -459,26 +459,18 @@ static void pseries_setup_rfi_flush(void)/* Enable by default */enable=true;+types=L1D_FLUSH_FALLBACK;rc=plpar_get_cpu_characteristics(&result);if(rc==H_SUCCESS){-types=L1D_FLUSH_NONE;-if(result.character&H_CPU_CHAR_L1D_FLUSH_TRIG2)types|=L1D_FLUSH_MTTRIG;if(result.character&H_CPU_CHAR_L1D_FLUSH_ORI30)types|=L1D_FLUSH_ORI;-/* Use fallback if nothing set in hcall */-if(types==L1D_FLUSH_NONE)-types=L1D_FLUSH_FALLBACK;-if((!(result.behaviour&H_CPU_BEHAV_L1D_FLUSH_PR))||(!(result.behaviour&H_CPU_BEHAV_FAVOUR_SECURITY)))enable=false;-}else{-/* Default to fallback if case hcall is not available */-types=L1D_FLUSH_FALLBACK;}setup_rfi_flush(types,enable);
This is a note to let you know that I've just added the patch titled
powerpc/rfi-flush: Always enable fallback flush on pseries
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:51 +1000
Subject: powerpc/rfi-flush: Always enable fallback flush on pseries
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 84749a58b6e382f109abf1e734bc4dd43c2c25bb upstream.
This ensures the fallback flush area is always allocated on pseries,
so in case a LPAR is migrated from a patched to an unpatched system,
it is possible to enable the fallback flush in the target system.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
@@ -459,26 +459,18 @@ static void pseries_setup_rfi_flush(void/* Enable by default */enable=true;+types=L1D_FLUSH_FALLBACK;rc=plpar_get_cpu_characteristics(&result);if(rc==H_SUCCESS){-types=L1D_FLUSH_NONE;-if(result.character&H_CPU_CHAR_L1D_FLUSH_TRIG2)types|=L1D_FLUSH_MTTRIG;if(result.character&H_CPU_CHAR_L1D_FLUSH_ORI30)types|=L1D_FLUSH_ORI;-/* Use fallback if nothing set in hcall */-if(types==L1D_FLUSH_NONE)-types=L1D_FLUSH_FALLBACK;-if((!(result.behaviour&H_CPU_BEHAV_L1D_FLUSH_PR))||(!(result.behaviour&H_CPU_BEHAV_FAVOUR_SECURITY)))enable=false;-}else{-/* Default to fallback if case hcall is not available */-types=L1D_FLUSH_FALLBACK;}setup_rfi_flush(types,enable);
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:21
commit 921bc6cf807ceb2ab8005319cf39f33494d6b100 upstream.
We might have migrated to a machine that uses a different flush type,
or doesn't need flushing at all.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/mobility.c | 3 +++
arch/powerpc/platforms/pseries/pseries.h | 2 ++
arch/powerpc/platforms/pseries/setup.c | 2 +-
3 files changed, 6 insertions(+), 1 deletion(-)
@@ -314,6 +314,9 @@ void post_mobility_fixup(void)printk(KERN_ERR"Post-mobility device tree update ""failed: %d\n",rc);+/* Possibly switch to a new RFI flush type */+pseries_setup_rfi_flush();+return;}
This is a note to let you know that I've just added the patch titled
powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:53 +1000
Subject: powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 921bc6cf807ceb2ab8005319cf39f33494d6b100 upstream.
We might have migrated to a machine that uses a different flush type,
or doesn't need flushing at all.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/mobility.c | 3 +++
arch/powerpc/platforms/pseries/pseries.h | 2 ++
arch/powerpc/platforms/pseries/setup.c | 2 +-
3 files changed, 6 insertions(+), 1 deletion(-)
@@ -314,6 +314,9 @@ void post_mobility_fixup(void)printk(KERN_ERR"Post-mobility device tree update ""failed: %d\n",rc);+/* Possibly switch to a new RFI flush type */+pseries_setup_rfi_flush();+return;}---a/arch/powerpc/platforms/pseries/pseries.h+++b/arch/powerpc/platforms/pseries/pseries.h
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:21
From: Mauricio Faria de Oliveira <redacted>
commit 0063d61ccfc011f379a31acaeba6de7c926fed2c upstream.
Currently the rfi-flush messages print 'Using <type> flush' for all
enabled_flush_types, but that is not necessarily true -- as now the
fallback flush is always enabled on pseries, but the fixup function
overwrites its nop/branch slot with other flush types, if available.
So, replace the 'Using <type> flush' messages with '<type> flush is
available'.
Also, print the patched flush types in the fixup function, so users
can know what is (not) being used (e.g., the slower, fallback flush,
or no flush type at all if flush is disabled via the debugfs switch).
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/setup_64.c | 6 +++---
arch/powerpc/lib/feature-fixups.c | 9 ++++++++-
2 files changed, 11 insertions(+), 4 deletions(-)
@@ -755,15 +755,15 @@ static void init_fallback_flush(void)voidsetup_rfi_flush(enuml1d_flush_typetypes,boolenable){if(types&L1D_FLUSH_FALLBACK){-pr_info("rfi-flush: Using fallback displacement flush\n");+pr_info("rfi-flush: fallback displacement flush available\n");init_fallback_flush();}if(types&L1D_FLUSH_ORI)-pr_info("rfi-flush: Using ori type flush\n");+pr_info("rfi-flush: ori type flush available\n");if(types&L1D_FLUSH_MTTRIG)-pr_info("rfi-flush: Using mttrig type flush\n");+pr_info("rfi-flush: mttrig type flush available\n");enabled_flush_types=types;
This is a note to let you know that I've just added the patch titled
powerpc/rfi-flush: Differentiate enabled and patched flush types
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:52 +1000
Subject: powerpc/rfi-flush: Differentiate enabled and patched flush types
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Mauricio Faria de Oliveira <redacted>
commit 0063d61ccfc011f379a31acaeba6de7c926fed2c upstream.
Currently the rfi-flush messages print 'Using <type> flush' for all
enabled_flush_types, but that is not necessarily true -- as now the
fallback flush is always enabled on pseries, but the fixup function
overwrites its nop/branch slot with other flush types, if available.
So, replace the 'Using <type> flush' messages with '<type> flush is
available'.
Also, print the patched flush types in the fixup function, so users
can know what is (not) being used (e.g., the slower, fallback flush,
or no flush type at all if flush is disabled via the debugfs switch).
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/setup_64.c | 6 +++---
arch/powerpc/lib/feature-fixups.c | 9 ++++++++-
2 files changed, 11 insertions(+), 4 deletions(-)
@@ -755,15 +755,15 @@ static void init_fallback_flush(void)voidsetup_rfi_flush(enuml1d_flush_typetypes,boolenable){if(types&L1D_FLUSH_FALLBACK){-pr_info("rfi-flush: Using fallback displacement flush\n");+pr_info("rfi-flush: fallback displacement flush available\n");init_fallback_flush();}if(types&L1D_FLUSH_ORI)-pr_info("rfi-flush: Using ori type flush\n");+pr_info("rfi-flush: ori type flush available\n");if(types&L1D_FLUSH_MTTRIG)-pr_info("rfi-flush: Using mttrig type flush\n");+pr_info("rfi-flush: mttrig type flush available\n");enabled_flush_types=types;---a/arch/powerpc/lib/feature-fixups.c+++b/arch/powerpc/lib/feature-fixups.c
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:22
commit c4bc36628d7f8b664657d8bd6ad1c44c177880b7 upstream.
Add some additional values which have been defined for the
H_GET_CPU_CHARACTERISTICS hypercall.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/include/asm/hvcall.h | 3 +++
1 file changed, 3 insertions(+)
@@ -313,6 +313,9 @@#define H_CPU_CHAR_L1D_FLUSH_ORI30 (1ull << 61) // IBM bit 2#define H_CPU_CHAR_L1D_FLUSH_TRIG2 (1ull << 60) // IBM bit 3#define H_CPU_CHAR_L1D_THREAD_PRIV (1ull << 59) // IBM bit 4+#define H_CPU_CHAR_BRANCH_HINTS_HONORED (1ull << 58) // IBM bit 5+#define H_CPU_CHAR_THREAD_RECONFIG_CTRL (1ull << 57) // IBM bit 6+#define H_CPU_CHAR_COUNT_CACHE_DISABLED (1ull << 56) // IBM bit 7#define H_CPU_BEHAV_FAVOUR_SECURITY (1ull << 63) // IBM bit 0#define H_CPU_BEHAV_L1D_FLUSH_PR (1ull << 62) // IBM bit 1
This is a note to let you know that I've just added the patch titled
powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:54 +1000
Subject: powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit c4bc36628d7f8b664657d8bd6ad1c44c177880b7 upstream.
Add some additional values which have been defined for the
H_GET_CPU_CHARACTERISTICS hypercall.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/hvcall.h | 3 +++
1 file changed, 3 insertions(+)
@@ -313,6 +313,9 @@#define H_CPU_CHAR_L1D_FLUSH_ORI30 (1ull << 61) // IBM bit 2#define H_CPU_CHAR_L1D_FLUSH_TRIG2 (1ull << 60) // IBM bit 3#define H_CPU_CHAR_L1D_THREAD_PRIV (1ull << 59) // IBM bit 4+#define H_CPU_CHAR_BRANCH_HINTS_HONORED (1ull << 58) // IBM bit 5+#define H_CPU_CHAR_THREAD_RECONFIG_CTRL (1ull << 57) // IBM bit 6+#define H_CPU_CHAR_COUNT_CACHE_DISABLED (1ull << 56) // IBM bit 7#define H_CPU_BEHAV_FAVOUR_SECURITY (1ull << 63) // IBM bit 0#define H_CPU_BEHAV_L1D_FLUSH_PR (1ull << 62) // IBM bit 1
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:23
commit 9a868f634349e62922c226834aa23e3d1329ae7f upstream.
This commit adds security feature flags to reflect the settings we
receive from firmware regarding Spectre/Meltdown mitigations.
The feature names reflect the names we are given by firmware on bare
metal machines. See the hostboot source for details.
Arguably these could be firmware features, but that then requires them
to be read early in boot so they're available prior to asm feature
patching, but we don't actually want to use them for patching. We may
also want to dynamically update them in future, which would be
incompatible with the way firmware features work (at the moment at
least). So for now just make them separate flags.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/include/asm/security_features.h | 65 ++++++++++++++++++++++++++++
arch/powerpc/kernel/Makefile | 2 +-
arch/powerpc/kernel/security.c | 15 +++++++
3 files changed, 81 insertions(+), 1 deletion(-)
create mode 100644 arch/powerpc/include/asm/security_features.h
create mode 100644 arch/powerpc/kernel/security.c
@@ -0,0 +1,65 @@+/* SPDX-License-Identifier: GPL-2.0+ */+/*+*Securityrelatedfeaturebitdefinitions.+*+*Copyright2018,MichaelEllerman,IBMCorporation.+*/++#ifndef _ASM_POWERPC_SECURITY_FEATURES_H+#define _ASM_POWERPC_SECURITY_FEATURES_H+++externunsignedlongpowerpc_security_features;++staticinlinevoidsecurity_ftr_set(unsignedlongfeature)+{+powerpc_security_features|=feature;+}++staticinlinevoidsecurity_ftr_clear(unsignedlongfeature)+{+powerpc_security_features&=~feature;+}++staticinlineboolsecurity_ftr_enabled(unsignedlongfeature)+{+return!!(powerpc_security_features&feature);+}+++// Features indicating support for Spectre/Meltdown mitigations++// The L1-D cache can be flushed with ori r30,r30,0+#define SEC_FTR_L1D_FLUSH_ORI30 0x0000000000000001ull++// The L1-D cache can be flushed with mtspr 882,r0 (aka SPRN_TRIG2)+#define SEC_FTR_L1D_FLUSH_TRIG2 0x0000000000000002ull++// ori r31,r31,0 acts as a speculation barrier+#define SEC_FTR_SPEC_BAR_ORI31 0x0000000000000004ull++// Speculation past bctr is disabled+#define SEC_FTR_BCCTRL_SERIALISED 0x0000000000000008ull++// Entries in L1-D are private to a SMT thread+#define SEC_FTR_L1D_THREAD_PRIV 0x0000000000000010ull++// Indirect branch prediction cache disabled+#define SEC_FTR_COUNT_CACHE_DISABLED 0x0000000000000020ull+++// Features indicating need for Spectre/Meltdown mitigations++// The L1-D cache should be flushed on MSR[HV] 1->0 transition (hypervisor to guest)+#define SEC_FTR_L1D_FLUSH_HV 0x0000000000000040ull++// The L1-D cache should be flushed on MSR[PR] 0->1 transition (kernel to userspace)+#define SEC_FTR_L1D_FLUSH_PR 0x0000000000000080ull++// A speculation barrier should be used for bounds checks (Spectre variant 1)+#define SEC_FTR_BNDS_CHK_SPEC_BAR 0x0000000000000100ull++// Firmware configuration indicates user favours security over performance+#define SEC_FTR_FAVOUR_SECURITY 0x0000000000000200ull++#endif /* _ASM_POWERPC_SECURITY_FEATURES_H */
@@ -0,0 +1,15 @@+// SPDX-License-Identifier: GPL-2.0++//+// Security related flags and so on.+//+// Copyright 2018, Michael Ellerman, IBM Corporation.++#include<linux/kernel.h>+#include<asm/security_features.h>+++unsignedlongpowerpc_security_features__read_mostly=\+SEC_FTR_L1D_FLUSH_HV|\+SEC_FTR_L1D_FLUSH_PR|\+SEC_FTR_BNDS_CHK_SPEC_BAR|\+SEC_FTR_FAVOUR_SECURITY;
This is a note to let you know that I've just added the patch titled
powerpc: Add security feature flags for Spectre/Meltdown
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-add-security-feature-flags-for-spectre-meltdown.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:55 +1000
Subject: powerpc: Add security feature flags for Spectre/Meltdown
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 9a868f634349e62922c226834aa23e3d1329ae7f upstream.
This commit adds security feature flags to reflect the settings we
receive from firmware regarding Spectre/Meltdown mitigations.
The feature names reflect the names we are given by firmware on bare
metal machines. See the hostboot source for details.
Arguably these could be firmware features, but that then requires them
to be read early in boot so they're available prior to asm feature
patching, but we don't actually want to use them for patching. We may
also want to dynamically update them in future, which would be
incompatible with the way firmware features work (at the moment at
least). So for now just make them separate flags.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/security_features.h | 65 +++++++++++++++++++++++++++
arch/powerpc/kernel/Makefile | 2
arch/powerpc/kernel/security.c | 15 ++++++
3 files changed, 81 insertions(+), 1 deletion(-)
create mode 100644 arch/powerpc/include/asm/security_features.h
create mode 100644 arch/powerpc/kernel/security.c
@@ -0,0 +1,65 @@+/* SPDX-License-Identifier: GPL-2.0+ */+/*+*Securityrelatedfeaturebitdefinitions.+*+*Copyright2018,MichaelEllerman,IBMCorporation.+*/++#ifndef _ASM_POWERPC_SECURITY_FEATURES_H+#define _ASM_POWERPC_SECURITY_FEATURES_H+++externunsignedlongpowerpc_security_features;++staticinlinevoidsecurity_ftr_set(unsignedlongfeature)+{+powerpc_security_features|=feature;+}++staticinlinevoidsecurity_ftr_clear(unsignedlongfeature)+{+powerpc_security_features&=~feature;+}++staticinlineboolsecurity_ftr_enabled(unsignedlongfeature)+{+return!!(powerpc_security_features&feature);+}+++// Features indicating support for Spectre/Meltdown mitigations++// The L1-D cache can be flushed with ori r30,r30,0+#define SEC_FTR_L1D_FLUSH_ORI30 0x0000000000000001ull++// The L1-D cache can be flushed with mtspr 882,r0 (aka SPRN_TRIG2)+#define SEC_FTR_L1D_FLUSH_TRIG2 0x0000000000000002ull++// ori r31,r31,0 acts as a speculation barrier+#define SEC_FTR_SPEC_BAR_ORI31 0x0000000000000004ull++// Speculation past bctr is disabled+#define SEC_FTR_BCCTRL_SERIALISED 0x0000000000000008ull++// Entries in L1-D are private to a SMT thread+#define SEC_FTR_L1D_THREAD_PRIV 0x0000000000000010ull++// Indirect branch prediction cache disabled+#define SEC_FTR_COUNT_CACHE_DISABLED 0x0000000000000020ull+++// Features indicating need for Spectre/Meltdown mitigations++// The L1-D cache should be flushed on MSR[HV] 1->0 transition (hypervisor to guest)+#define SEC_FTR_L1D_FLUSH_HV 0x0000000000000040ull++// The L1-D cache should be flushed on MSR[PR] 0->1 transition (kernel to userspace)+#define SEC_FTR_L1D_FLUSH_PR 0x0000000000000080ull++// A speculation barrier should be used for bounds checks (Spectre variant 1)+#define SEC_FTR_BNDS_CHK_SPEC_BAR 0x0000000000000100ull++// Firmware configuration indicates user favours security over performance+#define SEC_FTR_FAVOUR_SECURITY 0x0000000000000200ull++#endif /* _ASM_POWERPC_SECURITY_FEATURES_H */---a/arch/powerpc/kernel/Makefile+++b/arch/powerpc/kernel/Makefile
@@ -0,0 +1,15 @@+// SPDX-License-Identifier: GPL-2.0++//+// Security related flags and so on.+//+// Copyright 2018, Michael Ellerman, IBM Corporation.++#include<linux/kernel.h>+#include<asm/security_features.h>+++unsignedlongpowerpc_security_features__read_mostly=\+SEC_FTR_L1D_FLUSH_HV|\+SEC_FTR_L1D_FLUSH_PR|\+SEC_FTR_BNDS_CHK_SPEC_BAR|\+SEC_FTR_FAVOUR_SECURITY;
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:24
commit f636c14790ead6cc22cf62279b1f8d7e11a67116 upstream.
Now that we have feature flags for security related things, set or
clear them based on what we receive from the hypercall.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 43 ++++++++++++++++++++++++++++++++++
1 file changed, 43 insertions(+)
This is a note to let you know that I've just added the patch titled
powerpc/pseries: Set or clear security feature flags
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-pseries-set-or-clear-security-feature-flags.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:56 +1000
Subject: powerpc/pseries: Set or clear security feature flags
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit f636c14790ead6cc22cf62279b1f8d7e11a67116 upstream.
Now that we have feature flags for security related things, set or
clear them based on what we receive from the hypercall.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 43 +++++++++++++++++++++++++++++++++
1 file changed, 43 insertions(+)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:25
commit 77addf6e95c8689e478d607176b399a6242a777e upstream.
Now that we have feature flags for security related things, set or
clear them based on what we see in the device tree provided by
firmware.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/powernv/setup.c | 56 ++++++++++++++++++++++++++++++++++
1 file changed, 56 insertions(+)
This is a note to let you know that I've just added the patch titled
powerpc/powernv: Set or clear security feature flags
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-powernv-set-or-clear-security-feature-flags.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:57 +1000
Subject: powerpc/powernv: Set or clear security feature flags
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 77addf6e95c8689e478d607176b399a6242a777e upstream.
Now that we have feature flags for security related things, set or
clear them based on what we see in the device tree provided by
firmware.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/setup.c | 56 +++++++++++++++++++++++++++++++++
1 file changed, 56 insertions(+)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:26
commit 8ad33041563a10b34988800c682ada14b2612533 upstream.
This landed in setup_64.c for no good reason other than we had nowhere
else to put it. Now that we have a security-related file, that is a
better place for it so move it.
[mpe: Add extern for rfi_flush to fix bisection break]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/include/asm/security_features.h | 1 +
arch/powerpc/kernel/security.c | 11 +++++++++++
arch/powerpc/kernel/setup_64.c | 8 --------
3 files changed, 12 insertions(+), 8 deletions(-)
@@ -5,6 +5,8 @@// Copyright 2018, Michael Ellerman, IBM Corporation.#include<linux/kernel.h>+#include<linux/device.h>+#include<asm/security_features.h>
This is a note to let you know that I've just added the patch titled
powerpc/64s: Move cpu_show_meltdown()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-64s-move-cpu_show_meltdown.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:58 +1000
Subject: powerpc/64s: Move cpu_show_meltdown()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 8ad33041563a10b34988800c682ada14b2612533 upstream.
This landed in setup_64.c for no good reason other than we had nowhere
else to put it. Now that we have a security-related file, that is a
better place for it so move it.
[mpe: Add extern for rfi_flush to fix bisection break]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/security_features.h | 1 +
arch/powerpc/kernel/security.c | 11 +++++++++++
arch/powerpc/kernel/setup_64.c | 8 --------
3 files changed, 12 insertions(+), 8 deletions(-)
@@ -5,6 +5,8 @@// Copyright 2018, Michael Ellerman, IBM Corporation.#include<linux/kernel.h>+#include<linux/device.h>+#include<asm/security_features.h>
@@ -13,3 +15,12 @@ unsigned long powerpc_security_featuresSEC_FTR_L1D_FLUSH_PR|\SEC_FTR_BNDS_CHK_SPEC_BAR|\SEC_FTR_FAVOUR_SECURITY;+++ssize_tcpu_show_meltdown(structdevice*dev,structdevice_attribute*attr,char*buf)+{+if(rfi_flush)+returnsprintf(buf,"Mitigation: RFI Flush\n");++returnsprintf(buf,"Vulnerable\n");+}---a/arch/powerpc/kernel/setup_64.c+++b/arch/powerpc/kernel/setup_64.c
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:27
commit ff348355e9c72493947be337bb4fae4fc1a41eba upstream.
Now that we have the security feature flags we can make the
information displayed in the "meltdown" file more informative.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/security.c | 30 ++++++++++++++++++++++++++++--
1 file changed, 28 insertions(+), 2 deletions(-)
This is a note to let you know that I've just added the patch titled
powerpc/64s: Enhance the information in cpu_show_meltdown()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:08:59 +1000
Subject: powerpc/64s: Enhance the information in cpu_show_meltdown()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit ff348355e9c72493947be337bb4fae4fc1a41eba upstream.
Now that we have the security feature flags we can make the
information displayed in the "meltdown" file more informative.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/security.c | 30 ++++++++++++++++++++++++++++--
1 file changed, 28 insertions(+), 2 deletions(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:28
commit 37c0bdd00d3ae83369ab60a6712c28e11e6458d5 upstream.
Now that we have the security flags we can significantly simplify the
code in pnv_setup_rfi_flush(), because we can use the flags instead of
checking device tree properties and because the security flags have
pessimistic defaults.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/powernv/setup.c | 41 +++++++++-------------------------
1 file changed, 10 insertions(+), 31 deletions(-)
@@ -98,11 +98,10 @@ static void pnv_setup_rfi_flush(void){structdevice_node*np,*fw_features;enuml1d_flush_typetype;-intenable;+boolenable;/* Default to fallback in case fw-features are not available */type=L1D_FLUSH_FALLBACK;-enable=1;np=of_find_node_by_name(NULL,"ibm,opal");fw_features=of_get_child_by_name(np,"fw-features");
@@ -110,40 +109,20 @@ static void pnv_setup_rfi_flush(void)if(fw_features){init_fw_feat_flags(fw_features);+of_node_put(fw_features);-np=of_get_child_by_name(fw_features,"inst-l1d-flush-trig2");-if(np&&of_property_read_bool(np,"enabled"))+if(security_ftr_enabled(SEC_FTR_L1D_FLUSH_TRIG2))type=L1D_FLUSH_MTTRIG;-of_node_put(np);--np=of_get_child_by_name(fw_features,"inst-l1d-flush-ori30,30,0");-if(np&&of_property_read_bool(np,"enabled"))+if(security_ftr_enabled(SEC_FTR_L1D_FLUSH_ORI30))type=L1D_FLUSH_ORI;--of_node_put(np);--/* Enable unless firmware says NOT to */-enable=2;-np=of_get_child_by_name(fw_features,"needs-l1d-flush-msr-hv-1-to-0");-if(np&&of_property_read_bool(np,"disabled"))-enable--;--of_node_put(np);--np=of_get_child_by_name(fw_features,"needs-l1d-flush-msr-pr-0-to-1");-if(np&&of_property_read_bool(np,"disabled"))-enable--;--np=of_get_child_by_name(fw_features,"speculation-policy-favor-security");-if(np&&of_property_read_bool(np,"disabled"))-enable=0;--of_node_put(np);-of_node_put(fw_features);}-setup_rfi_flush(type,enable>0);+enable=security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY)&&\+(security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)||\+security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV));++setup_rfi_flush(type,enable);}staticvoid__initpnv_setup_arch(void)
This is a note to let you know that I've just added the patch titled
powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:00 +1000
Subject: powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 37c0bdd00d3ae83369ab60a6712c28e11e6458d5 upstream.
Now that we have the security flags we can significantly simplify the
code in pnv_setup_rfi_flush(), because we can use the flags instead of
checking device tree properties and because the security flags have
pessimistic defaults.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/setup.c | 41 ++++++++-------------------------
1 file changed, 10 insertions(+), 31 deletions(-)
@@ -98,11 +98,10 @@ static void pnv_setup_rfi_flush(void){structdevice_node*np,*fw_features;enuml1d_flush_typetype;-intenable;+boolenable;/* Default to fallback in case fw-features are not available */type=L1D_FLUSH_FALLBACK;-enable=1;np=of_find_node_by_name(NULL,"ibm,opal");fw_features=of_get_child_by_name(np,"fw-features");
@@ -110,40 +109,20 @@ static void pnv_setup_rfi_flush(void)if(fw_features){init_fw_feat_flags(fw_features);+of_node_put(fw_features);-np=of_get_child_by_name(fw_features,"inst-l1d-flush-trig2");-if(np&&of_property_read_bool(np,"enabled"))+if(security_ftr_enabled(SEC_FTR_L1D_FLUSH_TRIG2))type=L1D_FLUSH_MTTRIG;-of_node_put(np);--np=of_get_child_by_name(fw_features,"inst-l1d-flush-ori30,30,0");-if(np&&of_property_read_bool(np,"enabled"))+if(security_ftr_enabled(SEC_FTR_L1D_FLUSH_ORI30))type=L1D_FLUSH_ORI;--of_node_put(np);--/* Enable unless firmware says NOT to */-enable=2;-np=of_get_child_by_name(fw_features,"needs-l1d-flush-msr-hv-1-to-0");-if(np&&of_property_read_bool(np,"disabled"))-enable--;--of_node_put(np);--np=of_get_child_by_name(fw_features,"needs-l1d-flush-msr-pr-0-to-1");-if(np&&of_property_read_bool(np,"disabled"))-enable--;--np=of_get_child_by_name(fw_features,"speculation-policy-favor-security");-if(np&&of_property_read_bool(np,"disabled"))-enable=0;--of_node_put(np);-of_node_put(fw_features);}-setup_rfi_flush(type,enable>0);+enable=security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY)&&\+(security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)||\+security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV));++setup_rfi_flush(type,enable);}staticvoid__initpnv_setup_arch(void)
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:29
commit 2e4a16161fcd324b1f9bf6cb6856529f7eaf0689 upstream.
Now that we have the security flags we can simplify the code in
pseries_setup_rfi_flush() because the security flags have pessimistic
defaults.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
This is a note to let you know that I've just added the patch titled
powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:01 +1000
Subject: powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 2e4a16161fcd324b1f9bf6cb6856529f7eaf0689 upstream.
Now that we have the security flags we can simplify the code in
pseries_setup_rfi_flush() because the security flags have pessimistic
defaults.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:30
commit 56986016cb8cd9050e601831fe89f332b4e3c46e upstream.
Add a definition for cpu_show_spectre_v1() to override the generic
version. Currently this just prints "Not affected" or "Vulnerable"
based on the firmware flag.
Although the kernel does have array_index_nospec() in a few places, we
haven't yet audited all the powerpc code to see where it's necessary,
so for now we don't list that as a mitigation.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/security.c | 8 ++++++++
1 file changed, 8 insertions(+)
This is a note to let you know that I've just added the patch titled
powerpc/64s: Wire up cpu_show_spectre_v1()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-64s-wire-up-cpu_show_spectre_v1.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:02 +1000
Subject: powerpc/64s: Wire up cpu_show_spectre_v1()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 56986016cb8cd9050e601831fe89f332b4e3c46e upstream.
Add a definition for cpu_show_spectre_v1() to override the generic
version. Currently this just prints "Not affected" or "Vulnerable"
based on the firmware flag.
Although the kernel does have array_index_nospec() in a few places, we
haven't yet audited all the powerpc code to see where it's necessary,
so for now we don't list that as a mitigation.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/security.c | 8 ++++++++
1 file changed, 8 insertions(+)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:31
commit d6fbe1c55c55c6937cbea3531af7da84ab7473c3 upstream.
Add a definition for cpu_show_spectre_v2() to override the generic
version. This has several permuations, though in practice some may not
occur we cater for any combination.
The most verbose is:
Mitigation: Indirect branch serialisation (kernel only), Indirect
branch cache disabled, ori31 speculation barrier enabled
We don't treat the ori31 speculation barrier as a mitigation on its
own, because it has to be *used* by code in order to be a mitigation
and we don't know if userspace is doing that. So if that's all we see
we say:
Vulnerable, ori31 speculation barrier enabled
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/security.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
This is a note to let you know that I've just added the patch titled
powerpc/64s: Wire up cpu_show_spectre_v2()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-64s-wire-up-cpu_show_spectre_v2.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:03 +1000
Subject: powerpc/64s: Wire up cpu_show_spectre_v2()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit d6fbe1c55c55c6937cbea3531af7da84ab7473c3 upstream.
Add a definition for cpu_show_spectre_v2() to override the generic
version. This has several permuations, though in practice some may not
occur we cater for any combination.
The most verbose is:
Mitigation: Indirect branch serialisation (kernel only), Indirect
branch cache disabled, ori31 speculation barrier enabled
We don't treat the ori31 speculation barrier as a mitigation on its
own, because it has to be *used* by code in order to be a mitigation
and we don't know if userspace is doing that. So if that's all we see
we say:
Vulnerable, ori31 speculation barrier enabled
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/security.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:32
From: Mauricio Faria de Oliveira <redacted>
commit 0f9bdfe3c77091e8704d2e510eb7c2c2c6cde524 upstream.
The H_CPU_BEHAV_* flags should be checked for in the 'behaviour' field
of 'struct h_cpu_char_result' -- 'character' is for H_CPU_CHAR_*
flags.
Found by playing around with QEMU's implementation of the hypercall:
H_CPU_CHAR=0xf000000000000000
H_CPU_BEHAV=0x0000000000000000
This clears H_CPU_BEHAV_FAVOUR_SECURITY and H_CPU_BEHAV_L1D_FLUSH_PR
so pseries_setup_rfi_flush() disables 'rfi_flush'; and it also
clears H_CPU_CHAR_L1D_THREAD_PRIV flag. So there is no RFI flush
mitigation at all for cpu_show_meltdown() to report; but currently
it does:
Original kernel:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown
Mitigation: RFI Flush
Patched kernel:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown
Not affected
H_CPU_CHAR=0x0000000000000000
H_CPU_BEHAV=0xf000000000000000
This sets H_CPU_BEHAV_BNDS_CHK_SPEC_BAR so cpu_show_spectre_v1() should
report vulnerable; but currently it doesn't:
Original kernel:
# cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Not affected
Patched kernel:
# cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Vulnerable
Brown-paper-bag-by: Michael Ellerman [off-list ref]
Fixes: f636c14790ea ("powerpc/pseries: Set or clear security feature flags")
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
This is a note to let you know that I've just added the patch titled
powerpc/pseries: Fix clearing of security feature flags
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-pseries-fix-clearing-of-security-feature-flags.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:04 +1000
Subject: powerpc/pseries: Fix clearing of security feature flags
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Mauricio Faria de Oliveira <redacted>
commit 0f9bdfe3c77091e8704d2e510eb7c2c2c6cde524 upstream.
The H_CPU_BEHAV_* flags should be checked for in the 'behaviour' field
of 'struct h_cpu_char_result' -- 'character' is for H_CPU_CHAR_*
flags.
Found by playing around with QEMU's implementation of the hypercall:
H_CPU_CHAR=0xf000000000000000
H_CPU_BEHAV=0x0000000000000000
This clears H_CPU_BEHAV_FAVOUR_SECURITY and H_CPU_BEHAV_L1D_FLUSH_PR
so pseries_setup_rfi_flush() disables 'rfi_flush'; and it also
clears H_CPU_CHAR_L1D_THREAD_PRIV flag. So there is no RFI flush
mitigation at all for cpu_show_meltdown() to report; but currently
it does:
Original kernel:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown
Mitigation: RFI Flush
Patched kernel:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown
Not affected
H_CPU_CHAR=0x0000000000000000
H_CPU_BEHAV=0xf000000000000000
This sets H_CPU_BEHAV_BNDS_CHK_SPEC_BAR so cpu_show_spectre_v1() should
report vulnerable; but currently it doesn't:
Original kernel:
# cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Not affected
Patched kernel:
# cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Vulnerable
Brown-paper-bag-by: Michael Ellerman [off-list ref]
Fixes: f636c14790ea ("powerpc/pseries: Set or clear security feature flags")
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:33
From: Mauricio Faria de Oliveira <redacted>
commit e7347a86830f38dc3e40c8f7e28c04412b12a2e7 upstream.
This moves the definition of the default security feature flags
(i.e., enabled by default) closer to the security feature flags.
This can be used to restore current flags to the default flags.
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/include/asm/security_features.h | 8 ++++++++
arch/powerpc/kernel/security.c | 7 +------
2 files changed, 9 insertions(+), 6 deletions(-)
This is a note to let you know that I've just added the patch titled
powerpc: Move default security feature flags
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-move-default-security-feature-flags.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:05 +1000
Subject: powerpc: Move default security feature flags
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Mauricio Faria de Oliveira <redacted>
commit e7347a86830f38dc3e40c8f7e28c04412b12a2e7 upstream.
This moves the definition of the default security feature flags
(i.e., enabled by default) closer to the security feature flags.
This can be used to restore current flags to the default flags.
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/security_features.h | 8 ++++++++
arch/powerpc/kernel/security.c | 7 +------
2 files changed, 9 insertions(+), 6 deletions(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:34
commit 501a78cbc17c329fabf8e9750a1e9ab810c88a0e upstream.
The recent LPM changes to setup_rfi_flush() are causing some section
mismatch warnings because we removed the __init annotation on
setup_rfi_flush():
The function setup_rfi_flush() references
the function __init ppc64_bolted_size().
the function __init memblock_alloc_base().
The references are actually in init_fallback_flush(), but that is
inlined into setup_rfi_flush().
These references are safe because:
- only pseries calls setup_rfi_flush() at runtime
- pseries always passes L1D_FLUSH_FALLBACK at boot
- so the fallback flush area will always be allocated
- so the check in init_fallback_flush() will always return early:
/* Only allocate the fallback flush area once (at boot time). */
if (l1d_flush_fallback_area)
return;
- and therefore we won't actually call the freed init routines.
We should rework the code to make it safer by default rather than
relying on the above, but for now as a quick-fix just add a __ref
annotation to squash the warning.
Fixes: abf110f3e1ce ("powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/kernel/setup_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
This is a note to let you know that I've just added the patch titled
powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:07 +1000
Subject: powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Michael Ellerman <mpe@ellerman.id.au>
commit 501a78cbc17c329fabf8e9750a1e9ab810c88a0e upstream.
The recent LPM changes to setup_rfi_flush() are causing some section
mismatch warnings because we removed the __init annotation on
setup_rfi_flush():
The function setup_rfi_flush() references
the function __init ppc64_bolted_size().
the function __init memblock_alloc_base().
The references are actually in init_fallback_flush(), but that is
inlined into setup_rfi_flush().
These references are safe because:
- only pseries calls setup_rfi_flush() at runtime
- pseries always passes L1D_FLUSH_FALLBACK at boot
- so the fallback flush area will always be allocated
- so the check in init_fallback_flush() will always return early:
/* Only allocate the fallback flush area once (at boot time). */
if (l1d_flush_fallback_area)
return;
- and therefore we won't actually call the freed init routines.
We should rework the code to make it safer by default rather than
relying on the above, but for now as a quick-fix just add a __ref
annotation to squash the warning.
Fixes: abf110f3e1ce ("powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/setup_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:34
From: Mauricio Faria de Oliveira <redacted>
commit 6232774f1599028a15418179d17f7df47ede770a upstream.
After migration the security feature flags might have changed (e.g.,
destination system with unpatched firmware), but some flags are not
set/clear again in init_cpu_char_feature_flags() because it assumes
the security flags to be the defaults.
Additionally, if the H_GET_CPU_CHARACTERISTICS hypercall fails then
init_cpu_char_feature_flags() does not run again, which potentially
might leave the system in an insecure or sub-optimal configuration.
So, just restore the security feature flags to the defaults assumed
by init_cpu_char_feature_flags() so it can set/clear them correctly,
and to ensure safe settings are in place in case the hypercall fail.
Fixes: f636c14790ea ("powerpc/pseries: Set or clear security feature flags")
Depends-on: 19887d6a28e2 ("powerpc: Move default security feature flags")
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 11 +++++++++++
1 file changed, 11 insertions(+)
This is a note to let you know that I've just added the patch titled
powerpc/pseries: Restore default security feature flags on setup
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:06 +1000
Subject: powerpc/pseries: Restore default security feature flags on setup
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Mauricio Faria de Oliveira <redacted>
commit 6232774f1599028a15418179d17f7df47ede770a upstream.
After migration the security feature flags might have changed (e.g.,
destination system with unpatched firmware), but some flags are not
set/clear again in init_cpu_char_feature_flags() because it assumes
the security flags to be the defaults.
Additionally, if the H_GET_CPU_CHARACTERISTICS hypercall fails then
init_cpu_char_feature_flags() does not run again, which potentially
might leave the system in an insecure or sub-optimal configuration.
So, just restore the security feature flags to the defaults assumed
by init_cpu_char_feature_flags() so it can set/clear them correctly,
and to ensure safe settings are in place in case the hypercall fail.
Fixes: f636c14790ea ("powerpc/pseries: Set or clear security feature flags")
Depends-on: 19887d6a28e2 ("powerpc: Move default security feature flags")
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/setup.c | 11 +++++++++++
1 file changed, 11 insertions(+)
From: Michael Ellerman <mpe@ellerman.id.au> Date: 2018-06-02 11:09:36
From: Nicholas Piggin <npiggin@gmail.com>
commit a048a07d7f4535baa4cbad6bc024f175317ab938 upstream.
On some CPUs we can prevent a vulnerability related to store-to-load
forwarding by preventing store forwarding between privilege domains,
by inserting a barrier in kernel entry and exit paths.
This is known to be the case on at least Power7, Power8 and Power9
powerpc CPUs.
Barriers must be inserted generally before the first load after moving
to a higher privilege, and after the last store before moving to a
lower privilege, HV and PR privilege transitions must be protected.
Barriers are added as patch sections, with all kernel/hypervisor entry
points patched, and the exit points to lower privilge levels patched
similarly to the RFI flush patching.
Firmware advertisement is not implemented yet, so CPU flush types
are hard coded.
Thanks to Michal Suchánek for bug fixes and review.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Neuling <redacted>
Signed-off-by: Michal Suchánek <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
arch/powerpc/include/asm/exception-64s.h | 29 ++++++
arch/powerpc/include/asm/feature-fixups.h | 19 ++++
arch/powerpc/include/asm/security_features.h | 11 ++
arch/powerpc/kernel/exceptions-64s.S | 16 ++-
arch/powerpc/kernel/security.c | 149 +++++++++++++++++++++++++++
arch/powerpc/kernel/vmlinux.lds.S | 14 +++
arch/powerpc/lib/feature-fixups.c | 115 +++++++++++++++++++++
arch/powerpc/platforms/powernv/setup.c | 1 +
arch/powerpc/platforms/pseries/setup.c | 1 +
9 files changed, 354 insertions(+), 1 deletion(-)
@@ -12,6 +12,17 @@externunsignedlongpowerpc_security_features;externboolrfi_flush;+/* These are bit flags */+enumstf_barrier_type{+STF_BARRIER_NONE=0x1,+STF_BARRIER_FALLBACK=0x2,+STF_BARRIER_EIEIO=0x4,+STF_BARRIER_SYNC_ORI=0x8,+};++voidsetup_stf_barrier(void);+voiddo_stf_barrier_fixups(enumstf_barrier_typetypes);+staticinlinevoidsecurity_ftr_set(unsignedlongfeature){powerpc_security_features|=feature;
@@ -5,6 +5,7 @@// Copyright 2018, Michael Ellerman, IBM Corporation.#include<linux/kernel.h>+#include<linux/debugfs.h>#include<linux/device.h>#include<linux/seq_buf.h>
@@ -86,3 +87,151 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, creturns.len;}++/*+*Store-forwardingbarriersupport.+*/++staticenumstf_barrier_typestf_enabled_flush_types;+staticboolno_stf_barrier;+boolstf_barrier;++staticint__inithandle_no_stf_barrier(char*p)+{+pr_info("stf-barrier: disabled on command line.");+no_stf_barrier=true;+return0;+}++early_param("no_stf_barrier",handle_no_stf_barrier);++/* This is the generic flag used by other architectures */+staticint__inithandle_ssbd(char*p)+{+if(!p||strncmp(p,"auto",5)==0||strncmp(p,"on",2)==0){+/* Until firmware tells us, we have the barrier with auto */+return0;+}elseif(strncmp(p,"off",3)==0){+handle_no_stf_barrier(NULL);+return0;+}else+return1;++return0;+}+early_param("spec_store_bypass_disable",handle_ssbd);++/* This is the generic flag used by other architectures */+staticint__inithandle_no_ssbd(char*p)+{+handle_no_stf_barrier(NULL);+return0;+}+early_param("nospec_store_bypass_disable",handle_no_ssbd);++staticvoidstf_barrier_enable(boolenable)+{+if(enable)+do_stf_barrier_fixups(stf_enabled_flush_types);+else+do_stf_barrier_fixups(STF_BARRIER_NONE);++stf_barrier=enable;+}++voidsetup_stf_barrier(void)+{+enumstf_barrier_typetype;+boolenable,hv;++hv=cpu_has_feature(CPU_FTR_HVMODE);++/* Default to fallback in case fw-features are not available */+if(cpu_has_feature(CPU_FTR_ARCH_300))+type=STF_BARRIER_EIEIO;+elseif(cpu_has_feature(CPU_FTR_ARCH_207S))+type=STF_BARRIER_SYNC_ORI;+elseif(cpu_has_feature(CPU_FTR_ARCH_206))+type=STF_BARRIER_FALLBACK;+else+type=STF_BARRIER_NONE;++enable=security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY)&&+(security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)||+(security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)&&hv));++if(type==STF_BARRIER_FALLBACK){+pr_info("stf-barrier: fallback barrier available\n");+}elseif(type==STF_BARRIER_SYNC_ORI){+pr_info("stf-barrier: hwsync barrier available\n");+}elseif(type==STF_BARRIER_EIEIO){+pr_info("stf-barrier: eieio barrier available\n");+}++stf_enabled_flush_types=type;++if(!no_stf_barrier)+stf_barrier_enable(enable);+}++ssize_tcpu_show_spec_store_bypass(structdevice*dev,structdevice_attribute*attr,char*buf)+{+if(stf_barrier&&stf_enabled_flush_types!=STF_BARRIER_NONE){+constchar*type;+switch(stf_enabled_flush_types){+caseSTF_BARRIER_EIEIO:+type="eieio";+break;+caseSTF_BARRIER_SYNC_ORI:+type="hwsync";+break;+caseSTF_BARRIER_FALLBACK:+type="fallback";+break;+default:+type="unknown";+}+returnsprintf(buf,"Mitigation: Kernel entry/exit barrier (%s)\n",type);+}++if(!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)&&+!security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR))+returnsprintf(buf,"Not affected\n");++returnsprintf(buf,"Vulnerable\n");+}++#ifdef CONFIG_DEBUG_FS+staticintstf_barrier_set(void*data,u64val)+{+boolenable;++if(val==1)+enable=true;+elseif(val==0)+enable=false;+else+return-EINVAL;++/* Only do anything if we're changing state */+if(enable!=stf_barrier)+stf_barrier_enable(enable);++return0;+}++staticintstf_barrier_get(void*data,u64*val)+{+*val=stf_barrier?1:0;+return0;+}++DEFINE_SIMPLE_ATTRIBUTE(fops_stf_barrier,stf_barrier_get,stf_barrier_set,"%llu\n");++static__initintstf_barrier_debugfs_init(void)+{+debugfs_create_file("stf_barrier",0600,powerpc_debugfs_root,NULL,&fops_stf_barrier);+return0;+}+device_initcall(stf_barrier_debugfs_init);+#endif /* CONFIG_DEBUG_FS */
@@ -545,6 +545,7 @@ static void __init pSeries_setup_arch(void)fwnmi_init();pseries_setup_rfi_flush();+setup_stf_barrier();/* By default, only probe PCI (can be overridden by rtas_pci) */pci_add_flags(PCI_PROBE_ONLY);
This is a note to let you know that I've just added the patch titled
powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.
From foo@baz Sat Jun 2 15:29:05 CEST 2018
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Sat, 2 Jun 2018 21:09:08 +1000
Subject: powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Message-ID: [off-list ref]
From: Nicholas Piggin <npiggin@gmail.com>
commit a048a07d7f4535baa4cbad6bc024f175317ab938 upstream.
On some CPUs we can prevent a vulnerability related to store-to-load
forwarding by preventing store forwarding between privilege domains,
by inserting a barrier in kernel entry and exit paths.
This is known to be the case on at least Power7, Power8 and Power9
powerpc CPUs.
Barriers must be inserted generally before the first load after moving
to a higher privilege, and after the last store before moving to a
lower privilege, HV and PR privilege transitions must be protected.
Barriers are added as patch sections, with all kernel/hypervisor entry
points patched, and the exit points to lower privilge levels patched
similarly to the RFI flush patching.
Firmware advertisement is not implemented yet, so CPU flush types
are hard coded.
Thanks to Michal Suchánek for bug fixes and review.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Mauricio Faria de Oliveira <redacted>
Signed-off-by: Michael Neuling <redacted>
Signed-off-by: Michal Suchánek <redacted>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/exception-64s.h | 29 +++++
arch/powerpc/include/asm/feature-fixups.h | 19 +++
arch/powerpc/include/asm/security_features.h | 11 +
arch/powerpc/kernel/exceptions-64s.S | 16 ++
arch/powerpc/kernel/security.c | 149 +++++++++++++++++++++++++++
arch/powerpc/kernel/vmlinux.lds.S | 14 ++
arch/powerpc/lib/feature-fixups.c | 115 ++++++++++++++++++++
arch/powerpc/platforms/powernv/setup.c | 1
arch/powerpc/platforms/pseries/setup.c | 1
9 files changed, 354 insertions(+), 1 deletion(-)
@@ -12,6 +12,17 @@externunsignedlongpowerpc_security_features;externboolrfi_flush;+/* These are bit flags */+enumstf_barrier_type{+STF_BARRIER_NONE=0x1,+STF_BARRIER_FALLBACK=0x2,+STF_BARRIER_EIEIO=0x4,+STF_BARRIER_SYNC_ORI=0x8,+};++voidsetup_stf_barrier(void);+voiddo_stf_barrier_fixups(enumstf_barrier_typetypes);+staticinlinevoidsecurity_ftr_set(unsignedlongfeature){powerpc_security_features|=feature;---a/arch/powerpc/kernel/exceptions-64s.S+++b/arch/powerpc/kernel/exceptions-64s.S
@@ -5,6 +5,7 @@// Copyright 2018, Michael Ellerman, IBM Corporation.#include<linux/kernel.h>+#include<linux/debugfs.h>#include<linux/device.h>#include<linux/seq_buf.h>
@@ -86,3 +87,151 @@ ssize_t cpu_show_spectre_v2(struct devicreturns.len;}++/*+*Store-forwardingbarriersupport.+*/++staticenumstf_barrier_typestf_enabled_flush_types;+staticboolno_stf_barrier;+boolstf_barrier;++staticint__inithandle_no_stf_barrier(char*p)+{+pr_info("stf-barrier: disabled on command line.");+no_stf_barrier=true;+return0;+}++early_param("no_stf_barrier",handle_no_stf_barrier);++/* This is the generic flag used by other architectures */+staticint__inithandle_ssbd(char*p)+{+if(!p||strncmp(p,"auto",5)==0||strncmp(p,"on",2)==0){+/* Until firmware tells us, we have the barrier with auto */+return0;+}elseif(strncmp(p,"off",3)==0){+handle_no_stf_barrier(NULL);+return0;+}else+return1;++return0;+}+early_param("spec_store_bypass_disable",handle_ssbd);++/* This is the generic flag used by other architectures */+staticint__inithandle_no_ssbd(char*p)+{+handle_no_stf_barrier(NULL);+return0;+}+early_param("nospec_store_bypass_disable",handle_no_ssbd);++staticvoidstf_barrier_enable(boolenable)+{+if(enable)+do_stf_barrier_fixups(stf_enabled_flush_types);+else+do_stf_barrier_fixups(STF_BARRIER_NONE);++stf_barrier=enable;+}++voidsetup_stf_barrier(void)+{+enumstf_barrier_typetype;+boolenable,hv;++hv=cpu_has_feature(CPU_FTR_HVMODE);++/* Default to fallback in case fw-features are not available */+if(cpu_has_feature(CPU_FTR_ARCH_300))+type=STF_BARRIER_EIEIO;+elseif(cpu_has_feature(CPU_FTR_ARCH_207S))+type=STF_BARRIER_SYNC_ORI;+elseif(cpu_has_feature(CPU_FTR_ARCH_206))+type=STF_BARRIER_FALLBACK;+else+type=STF_BARRIER_NONE;++enable=security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY)&&+(security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)||+(security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)&&hv));++if(type==STF_BARRIER_FALLBACK){+pr_info("stf-barrier: fallback barrier available\n");+}elseif(type==STF_BARRIER_SYNC_ORI){+pr_info("stf-barrier: hwsync barrier available\n");+}elseif(type==STF_BARRIER_EIEIO){+pr_info("stf-barrier: eieio barrier available\n");+}++stf_enabled_flush_types=type;++if(!no_stf_barrier)+stf_barrier_enable(enable);+}++ssize_tcpu_show_spec_store_bypass(structdevice*dev,structdevice_attribute*attr,char*buf)+{+if(stf_barrier&&stf_enabled_flush_types!=STF_BARRIER_NONE){+constchar*type;+switch(stf_enabled_flush_types){+caseSTF_BARRIER_EIEIO:+type="eieio";+break;+caseSTF_BARRIER_SYNC_ORI:+type="hwsync";+break;+caseSTF_BARRIER_FALLBACK:+type="fallback";+break;+default:+type="unknown";+}+returnsprintf(buf,"Mitigation: Kernel entry/exit barrier (%s)\n",type);+}++if(!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)&&+!security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR))+returnsprintf(buf,"Not affected\n");++returnsprintf(buf,"Vulnerable\n");+}++#ifdef CONFIG_DEBUG_FS+staticintstf_barrier_set(void*data,u64val)+{+boolenable;++if(val==1)+enable=true;+elseif(val==0)+enable=false;+else+return-EINVAL;++/* Only do anything if we're changing state */+if(enable!=stf_barrier)+stf_barrier_enable(enable);++return0;+}++staticintstf_barrier_get(void*data,u64*val)+{+*val=stf_barrier?1:0;+return0;+}++DEFINE_SIMPLE_ATTRIBUTE(fops_stf_barrier,stf_barrier_get,stf_barrier_set,"%llu\n");++static__initintstf_barrier_debugfs_init(void)+{+debugfs_create_file("stf_barrier",0600,powerpc_debugfs_root,NULL,&fops_stf_barrier);+return0;+}+device_initcall(stf_barrier_debugfs_init);+#endif /* CONFIG_DEBUG_FS */---a/arch/powerpc/kernel/vmlinux.lds.S+++b/arch/powerpc/kernel/vmlinux.lds.S
@@ -545,6 +545,7 @@ static void __init pSeries_setup_arch(vofwnmi_init();pseries_setup_rfi_flush();+setup_stf_barrier();/* By default, only probe PCI (can be overridden by rtas_pci) */pci_add_flags(PCI_PROBE_ONLY);
Patches currently in stable-queue which might be from mpe@ellerman.id.au are
queue-4.9/powerpc-64s-clear-pcr-on-boot.patch
queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch
queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch
queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch
queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch
queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch
queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch
queue-4.9/powerpc-move-default-security-feature-flags.patch
queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch
queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch
queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch
queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch
queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch
queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch
queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch
queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch
queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch
queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch
queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch
queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch