From: Michael Ellerman <mpe@ellerman.id.au>
To: gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org
Subject: [PATCH stable 4.9 19/23] powerpc/pseries: Fix clearing of security feature flags
Date: Sat, 2 Jun 2018 21:09:04 +1000 [thread overview]
Message-ID: <20180602110908.29773-20-mpe@ellerman.id.au> (raw)
In-Reply-To: <20180602110908.29773-1-mpe@ellerman.id.au>
From: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
commit 0f9bdfe3c77091e8704d2e510eb7c2c2c6cde524 upstream.
The H_CPU_BEHAV_* flags should be checked for in the 'behaviour' field
of 'struct h_cpu_char_result' -- 'character' is for H_CPU_CHAR_*
flags.
Found by playing around with QEMU's implementation of the hypercall:
H_CPU_CHAR=0xf000000000000000
H_CPU_BEHAV=0x0000000000000000
This clears H_CPU_BEHAV_FAVOUR_SECURITY and H_CPU_BEHAV_L1D_FLUSH_PR
so pseries_setup_rfi_flush() disables 'rfi_flush'; and it also
clears H_CPU_CHAR_L1D_THREAD_PRIV flag. So there is no RFI flush
mitigation at all for cpu_show_meltdown() to report; but currently
it does:
Original kernel:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown
Mitigation: RFI Flush
Patched kernel:
# cat /sys/devices/system/cpu/vulnerabilities/meltdown
Not affected
H_CPU_CHAR=0x0000000000000000
H_CPU_BEHAV=0xf000000000000000
This sets H_CPU_BEHAV_BNDS_CHK_SPEC_BAR so cpu_show_spectre_v1() should
report vulnerable; but currently it doesn't:
Original kernel:
# cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Not affected
Patched kernel:
# cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Vulnerable
Brown-paper-bag-by: Michael Ellerman <mpe@ellerman.id.au>
Fixes: f636c14790ea ("powerpc/pseries: Set or clear security feature flags")
Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/platforms/pseries/setup.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 28d7cd2001cc..8d9f591e7950 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -475,13 +475,13 @@ static void init_cpu_char_feature_flags(struct h_cpu_char_result *result)
* The features below are enabled by default, so we instead look to see
* if firmware has *disabled* them, and clear them if so.
*/
- if (!(result->character & H_CPU_BEHAV_FAVOUR_SECURITY))
+ if (!(result->behaviour & H_CPU_BEHAV_FAVOUR_SECURITY))
security_ftr_clear(SEC_FTR_FAVOUR_SECURITY);
- if (!(result->character & H_CPU_BEHAV_L1D_FLUSH_PR))
+ if (!(result->behaviour & H_CPU_BEHAV_L1D_FLUSH_PR))
security_ftr_clear(SEC_FTR_L1D_FLUSH_PR);
- if (!(result->character & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR))
+ if (!(result->behaviour & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR))
security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR);
}
--
2.14.1
next prev parent reply other threads:[~2018-06-02 11:09 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-02 11:08 [PATCH stable 4.9 00/23] powerpc backports for 4.9 Michael Ellerman
2018-06-02 11:08 ` [PATCH stable 4.9 01/23] powerpc/rfi-flush: Move out of HARDLOCKUP_DETECTOR #ifdef Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/rfi-flush: Move out of HARDLOCKUP_DETECTOR #ifdef" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 02/23] powerpc/pseries: Support firmware disable of RFI flush Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/pseries: Support firmware disable of RFI flush" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 03/23] powerpc/powernv: Support firmware disable of RFI flush Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/powernv: Support firmware disable of RFI flush" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 04/23] powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 05/23] powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 06/23] powerpc/rfi-flush: Always enable fallback flush on pseries Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/rfi-flush: Always enable fallback flush on pseries" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 07/23] powerpc/rfi-flush: Differentiate enabled and patched flush types Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/rfi-flush: Differentiate enabled and patched flush types" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 08/23] powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 09/23] powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 10/23] powerpc: Add security feature flags for Spectre/Meltdown Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc: Add security feature flags for Spectre/Meltdown" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 11/23] powerpc/pseries: Set or clear security feature flags Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/pseries: Set or clear security feature flags" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 12/23] powerpc/powernv: Set or clear security feature flags Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/powernv: Set or clear security feature flags" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 13/23] powerpc/64s: Move cpu_show_meltdown() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/64s: Move cpu_show_meltdown()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:08 ` [PATCH stable 4.9 14/23] powerpc/64s: Enhance the information in cpu_show_meltdown() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/64s: Enhance the information in cpu_show_meltdown()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 15/23] powerpc/powernv: Use the security flags in pnv_setup_rfi_flush() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 16/23] powerpc/pseries: Use the security flags in pseries_setup_rfi_flush() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 17/23] powerpc/64s: Wire up cpu_show_spectre_v1() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/64s: Wire up cpu_show_spectre_v1()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 18/23] powerpc/64s: Wire up cpu_show_spectre_v2() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/64s: Wire up cpu_show_spectre_v2()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` Michael Ellerman [this message]
2018-06-02 13:35 ` Patch "powerpc/pseries: Fix clearing of security feature flags" " gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 20/23] powerpc: Move default security feature flags Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc: Move default security feature flags" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 21/23] powerpc/pseries: Restore default security feature flags on setup Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/pseries: Restore default security feature flags on setup" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 22/23] powerpc/64s: Fix section mismatch warnings from setup_rfi_flush() Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()" has been added to the 4.9-stable tree gregkh
2018-06-02 11:09 ` [PATCH stable 4.9 23/23] powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit Michael Ellerman
2018-06-02 13:35 ` Patch "powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit" has been added to the 4.9-stable tree gregkh
2018-06-02 13:30 ` [PATCH stable 4.9 00/23] powerpc backports for 4.9 Greg KH
2018-06-03 10:22 ` Michael Ellerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180602110908.29773-20-mpe@ellerman.id.au \
--to=mpe@ellerman.id.au \
--cc=gregkh@linuxfoundation.org \
--cc=linuxppc-dev@ozlabs.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).