From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1732752-1527156034-2-5648083639086487415 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, RCVD_IN_DNSWL_HI -5, SPF_PASS -0.001, LANGUAGES roen, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='198.145.29.99', Host='mail.kernel.org', Country='US', FromHeader='org', MailFrom='org' X-Spam-charsets: plain='UTF-8' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: SRS0=We5Z=IL=linuxfoundation.org=gregkh@kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=fm2; t= 1527156032; b=g2go2xsrZwsRb0Pun4HpkqRH2B9xSRNLPbomnIFoRdfTORFDWi 9jH1snTbGV2wBKpoNRe5nBIhNKqpJneFd8U/q7Ua06sDkpPGJB6IfpKrLVk+svKd IE9Fcv48ADBNmu5QoIiBWPeMn2jQ63K+WU69fbT5b0ZNTC+0fT7gIENu1IqEt18J b4Ex/3Q3qhDQ3FNoqF50/ezBwU8R+dXINmqAWPgeA01HTxT9LjWSZgXsQP3siyAH oWaq7H6YqAimIMmoVNj0EYGUNybxRvjUg626jLtboASMoTB0nJHh4tvrWRMjkFAg Hj7KktKAY76RDZUeSuolFNTU0k7Axf8MfNVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-type; s=fm2; t= 1527156032; bh=p/9uPJ8G+eVqhRUuJ7UNiO2QvDs4Xenfw8HNF0TBkAo=; b=i a819zh1OppCodW4piBC7B6/ERXdfLy9C/5yYRzG4BWv4+g1HsWOFgj1uMnw30Izb dcbW1ZuM5GnG47++rSDYvKlTj5bsXU6uTLsBIM+J+8B+1Sb16Z0dsAHmagbLm+JV JkQfpIGO0MSOXEJJTDs4acomO6Hg4rW4orOYfI+qtN4Vwv71PCi7I+cZoDcC8bHa 9h4LjjDyxBkhZGrX/UFTQrTxbHYJx2zQR2X6/26sCWnddVPi9qnqsz5njEg0Cbcp aA6WwPxYjwHKjf+A9vpIubE77HqbETp0KH9rLyJzYHJo4VZQEzI0enDyHnWHsxzd JtfgW5nrmGG34Qx6KGkRA== ARC-Authentication-Results: i=1; mx6.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=kernel.org header.i=@kernel.org header.b=B8YAKO4u x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=default; dmarc=none (p=none,d=none) header.from=linuxfoundation.org; iprev=pass policy.iprev=198.145.29.99 (mail.kernel.org); spf=pass smtp.mailfrom="SRS0=We5Z=IL=linuxfoundation.org=gregkh@kernel.org" smtp.helo=mail.kernel.org; x-aligned-from=fail; x-cm=none score=0; x-ptr=pass x-ptr-helo=mail.kernel.org x-ptr-lookup=mail.kernel.org; x-return-mx=pass smtp.domain=kernel.org smtp.result=pass smtp_is_org_domain=yes header.domain=linuxfoundation.org header.result=pass header_is_org_domain=yes; x-tls=pass version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128; x-vs=clean score=0 state=0 Authentication-Results: mx6.messagingengine.com; arc=none (no signatures found); dkim=pass (1024-bit rsa key sha256) header.d=kernel.org header.i=@kernel.org header.b=B8YAKO4u x-bits=1024 x-keytype=rsa x-algorithm=sha256 x-selector=default; dmarc=none (p=none,d=none) header.from=linuxfoundation.org; iprev=pass policy.iprev=198.145.29.99 (mail.kernel.org); spf=pass smtp.mailfrom="SRS0=We5Z=IL=linuxfoundation.org=gregkh@kernel.org" smtp.helo=mail.kernel.org; x-aligned-from=fail; x-cm=none score=0; x-ptr=pass x-ptr-helo=mail.kernel.org x-ptr-lookup=mail.kernel.org; x-return-mx=pass smtp.domain=kernel.org smtp.result=pass smtp_is_org_domain=yes header.domain=linuxfoundation.org header.result=pass header_is_org_domain=yes; x-tls=pass version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128; x-vs=clean score=0 state=0 X-ME-VSCategory: clean X-CM-Envelope: MS4wfBDoHygS6qYcI9Bq8Q7rjIG+q10zXHtKZW+rUO6eq6j/daayNqfy3jPo7fp0010DGac5vk28BMSVkRm0myTxZwd4KE28Ph5DQMuWrHoWZOtp53SUkcbp zonrPPeViYxzOuviVRaoZL37+O4cLiY4OtAgE3V9k/HDxIgZfXKR/BV3TA9RWaDJF5I5AL9E+f5pX3H0Lim3H0HPyyuz8AgGny2DWiE/Su9FlODtOE0+9RfV X-CM-Analysis: v=2.3 cv=FKU1Odgs c=1 sm=1 tr=0 a=czNdAM+YcK12vDHDihaDnQ==:117 a=czNdAM+YcK12vDHDihaDnQ==:17 a=IkcTkHD0fZMA:10 a=VUJBJC2UJ8kA:10 a=ag1SF4gXAAAA:8 a=VhcyEQLdSo_uL0p4Ug8A:9 a=QEXdDO2ut3YA:10 a=Yupwre4RP9_Eg_Bd0iYG:22 X-ME-CMScore: 0 X-ME-CMCategory: none From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, greg@kroah.com Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Ellerman Subject: [PATCH 4.16 039/161] powerpc/powernv: Set or clear security feature flags Date: Thu, 24 May 2018 11:37:44 +0200 Message-Id: <20180524093023.020854442@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180524093018.331893860@linuxfoundation.org> References: <20180524093018.331893860@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.16-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Ellerman commit 77addf6e95c8689e478d607176b399a6242a777e upstream. Now that we have feature flags for security related things, set or clear them based on what we see in the device tree provided by firmware. Signed-off-by: Michael Ellerman Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/platforms/powernv/setup.c | 56 +++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) --- a/arch/powerpc/platforms/powernv/setup.c +++ b/arch/powerpc/platforms/powernv/setup.c @@ -38,9 +38,63 @@ #include #include #include +#include #include "powernv.h" + +static bool fw_feature_is(const char *state, const char *name, + struct device_node *fw_features) +{ + struct device_node *np; + bool rc = false; + + np = of_get_child_by_name(fw_features, name); + if (np) { + rc = of_property_read_bool(np, state); + of_node_put(np); + } + + return rc; +} + +static void init_fw_feat_flags(struct device_node *np) +{ + if (fw_feature_is("enabled", "inst-spec-barrier-ori31,31,0", np)) + security_ftr_set(SEC_FTR_SPEC_BAR_ORI31); + + if (fw_feature_is("enabled", "fw-bcctrl-serialized", np)) + security_ftr_set(SEC_FTR_BCCTRL_SERIALISED); + + if (fw_feature_is("enabled", "inst-spec-barrier-ori31,31,0", np)) + security_ftr_set(SEC_FTR_L1D_FLUSH_ORI30); + + if (fw_feature_is("enabled", "inst-l1d-flush-trig2", np)) + security_ftr_set(SEC_FTR_L1D_FLUSH_TRIG2); + + if (fw_feature_is("enabled", "fw-l1d-thread-split", np)) + security_ftr_set(SEC_FTR_L1D_THREAD_PRIV); + + if (fw_feature_is("enabled", "fw-count-cache-disabled", np)) + security_ftr_set(SEC_FTR_COUNT_CACHE_DISABLED); + + /* + * The features below are enabled by default, so we instead look to see + * if firmware has *disabled* them, and clear them if so. + */ + if (fw_feature_is("disabled", "speculation-policy-favor-security", np)) + security_ftr_clear(SEC_FTR_FAVOUR_SECURITY); + + if (fw_feature_is("disabled", "needs-l1d-flush-msr-pr-0-to-1", np)) + security_ftr_clear(SEC_FTR_L1D_FLUSH_PR); + + if (fw_feature_is("disabled", "needs-l1d-flush-msr-hv-1-to-0", np)) + security_ftr_clear(SEC_FTR_L1D_FLUSH_HV); + + if (fw_feature_is("disabled", "needs-spec-barrier-for-bound-checks", np)) + security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR); +} + static void pnv_setup_rfi_flush(void) { struct device_node *np, *fw_features; @@ -56,6 +110,8 @@ static void pnv_setup_rfi_flush(void) of_node_put(np); if (fw_features) { + init_fw_feat_flags(fw_features); + np = of_get_child_by_name(fw_features, "inst-l1d-flush-trig2"); if (np && of_property_read_bool(np, "enabled")) type = L1D_FLUSH_MTTRIG;