| From foo@baz Fri Mar 29 15:53:50 CET 2019 |
| From: Michael Ellerman <mpe@ellerman.id.au> |
| Date: Fri, 29 Mar 2019 22:25:51 +1100 |
| Subject: powerpc/64s: Enable barrier_nospec based on firmware settings |
| To: stable@vger.kernel.org, gregkh@linuxfoundation.org |
| Cc: linuxppc-dev@ozlabs.org, diana.craciun@nxp.com, msuchanek@suse.de, christophe.leroy@c-s.fr |
| Message-ID: <20190329112620.14489-4-mpe@ellerman.id.au> |
| |
| From: Michal Suchanek <msuchanek@suse.de> |
| |
| commit cb3d6759a93c6d0aea1c10deb6d00e111c29c19c upstream. |
| |
| Check what firmware told us and enable/disable the barrier_nospec as |
| appropriate. |
| |
| We err on the side of enabling the barrier, as it's no-op on older |
| systems, see the comment for more detail. |
| |
| Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/powerpc/include/asm/setup.h | 1 |
| arch/powerpc/kernel/security.c | 59 +++++++++++++++++++++++++++++++++ |
| arch/powerpc/platforms/powernv/setup.c | 1 |
| arch/powerpc/platforms/pseries/setup.c | 1 |
| 4 files changed, 62 insertions(+) |
| |
| --- a/arch/powerpc/include/asm/setup.h |
| +++ b/arch/powerpc/include/asm/setup.h |
| @@ -52,6 +52,7 @@ enum l1d_flush_type { |
| |
| void setup_rfi_flush(enum l1d_flush_type, bool enable); |
| void do_rfi_flush_fixups(enum l1d_flush_type types); |
| +void setup_barrier_nospec(void); |
| void do_barrier_nospec_fixups(bool enable); |
| extern bool barrier_nospec_enabled; |
| |
| --- a/arch/powerpc/kernel/security.c |
| +++ b/arch/powerpc/kernel/security.c |
| @@ -23,6 +23,65 @@ static void enable_barrier_nospec(bool e |
| do_barrier_nospec_fixups(enable); |
| } |
| |
| +void setup_barrier_nospec(void) |
| +{ |
| + bool enable; |
| + |
| + /* |
| + * It would make sense to check SEC_FTR_SPEC_BAR_ORI31 below as well. |
| + * But there's a good reason not to. The two flags we check below are |
| + * both are enabled by default in the kernel, so if the hcall is not |
| + * functional they will be enabled. |
| + * On a system where the host firmware has been updated (so the ori |
| + * functions as a barrier), but on which the hypervisor (KVM/Qemu) has |
| + * not been updated, we would like to enable the barrier. Dropping the |
| + * check for SEC_FTR_SPEC_BAR_ORI31 achieves that. The only downside is |
| + * we potentially enable the barrier on systems where the host firmware |
| + * is not updated, but that's harmless as it's a no-op. |
| + */ |
| + enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && |
| + security_ftr_enabled(SEC_FTR_BNDS_CHK_SPEC_BAR); |
| + |
| + enable_barrier_nospec(enable); |
| +} |
| + |
| +#ifdef CONFIG_DEBUG_FS |
| +static int barrier_nospec_set(void *data, u64 val) |
| +{ |
| + switch (val) { |
| + case 0: |
| + case 1: |
| + break; |
| + default: |
| + return -EINVAL; |
| + } |
| + |
| + if (!!val == !!barrier_nospec_enabled) |
| + return 0; |
| + |
| + enable_barrier_nospec(!!val); |
| + |
| + return 0; |
| +} |
| + |
| +static int barrier_nospec_get(void *data, u64 *val) |
| +{ |
| + *val = barrier_nospec_enabled ? 1 : 0; |
| + return 0; |
| +} |
| + |
| +DEFINE_SIMPLE_ATTRIBUTE(fops_barrier_nospec, |
| + barrier_nospec_get, barrier_nospec_set, "%llu\n"); |
| + |
| +static __init int barrier_nospec_debugfs_init(void) |
| +{ |
| + debugfs_create_file("barrier_nospec", 0600, powerpc_debugfs_root, NULL, |
| + &fops_barrier_nospec); |
| + return 0; |
| +} |
| +device_initcall(barrier_nospec_debugfs_init); |
| +#endif /* CONFIG_DEBUG_FS */ |
| + |
| ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) |
| { |
| bool thread_priv; |
| --- a/arch/powerpc/platforms/powernv/setup.c |
| +++ b/arch/powerpc/platforms/powernv/setup.c |
| @@ -123,6 +123,7 @@ static void pnv_setup_rfi_flush(void) |
| security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)); |
| |
| setup_rfi_flush(type, enable); |
| + setup_barrier_nospec(); |
| } |
| |
| static void __init pnv_setup_arch(void) |
| --- a/arch/powerpc/platforms/pseries/setup.c |
| +++ b/arch/powerpc/platforms/pseries/setup.c |
| @@ -534,6 +534,7 @@ void pseries_setup_rfi_flush(void) |
| security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR); |
| |
| setup_rfi_flush(types, enable); |
| + setup_barrier_nospec(); |
| } |
| |
| static void __init pSeries_setup_arch(void) |