From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 40yj0x0ygkzF19d for ; Sat, 2 Jun 2018 23:37:05 +1000 (AEST) Received: from ozlabs.org (ozlabs.org [IPv6:2401:3900:2:1::2]) by bilbo.ozlabs.org (Postfix) with ESMTP id 40yj0w5r39z8tGk for ; Sat, 2 Jun 2018 23:37:04 +1000 (AEST) Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40yj0v3l4Qz9s0x for ; Sat, 2 Jun 2018 23:37:03 +1000 (AEST) Subject: Patch "powerpc/powernv: Set or clear security feature flags" has been added to the 4.9-stable tree To: gregkh@linuxfoundation.org,linuxppc-dev@ozlabs.org,mpe@ellerman.id.au Cc: From: Date: Sat, 02 Jun 2018 15:35:40 +0200 In-Reply-To: <20180602110908.29773-13-mpe@ellerman.id.au> Message-ID: <15279465409276@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , This is a note to let you know that I've just added the patch titled powerpc/powernv: Set or clear security feature flags to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: powerpc-powernv-set-or-clear-security-feature-flags.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Sat Jun 2 15:29:05 CEST 2018 From: Michael Ellerman Date: Sat, 2 Jun 2018 21:08:57 +1000 Subject: powerpc/powernv: Set or clear security feature flags To: gregkh@linuxfoundation.org Cc: stable@vger.kernel.org, linuxppc-dev@ozlabs.org Message-ID: <20180602110908.29773-13-mpe@ellerman.id.au> From: Michael Ellerman commit 77addf6e95c8689e478d607176b399a6242a777e upstream. Now that we have feature flags for security related things, set or clear them based on what we see in the device tree provided by firmware. Signed-off-by: Michael Ellerman Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/platforms/powernv/setup.c | 56 +++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) --- a/arch/powerpc/platforms/powernv/setup.c +++ b/arch/powerpc/platforms/powernv/setup.c @@ -37,9 +37,63 @@ #include #include #include +#include #include "powernv.h" + +static bool fw_feature_is(const char *state, const char *name, + struct device_node *fw_features) +{ + struct device_node *np; + bool rc = false; + + np = of_get_child_by_name(fw_features, name); + if (np) { + rc = of_property_read_bool(np, state); + of_node_put(np); + } + + return rc; +} + +static void init_fw_feat_flags(struct device_node *np) +{ + if (fw_feature_is("enabled", "inst-spec-barrier-ori31,31,0", np)) + security_ftr_set(SEC_FTR_SPEC_BAR_ORI31); + + if (fw_feature_is("enabled", "fw-bcctrl-serialized", np)) + security_ftr_set(SEC_FTR_BCCTRL_SERIALISED); + + if (fw_feature_is("enabled", "inst-spec-barrier-ori31,31,0", np)) + security_ftr_set(SEC_FTR_L1D_FLUSH_ORI30); + + if (fw_feature_is("enabled", "inst-l1d-flush-trig2", np)) + security_ftr_set(SEC_FTR_L1D_FLUSH_TRIG2); + + if (fw_feature_is("enabled", "fw-l1d-thread-split", np)) + security_ftr_set(SEC_FTR_L1D_THREAD_PRIV); + + if (fw_feature_is("enabled", "fw-count-cache-disabled", np)) + security_ftr_set(SEC_FTR_COUNT_CACHE_DISABLED); + + /* + * The features below are enabled by default, so we instead look to see + * if firmware has *disabled* them, and clear them if so. + */ + if (fw_feature_is("disabled", "speculation-policy-favor-security", np)) + security_ftr_clear(SEC_FTR_FAVOUR_SECURITY); + + if (fw_feature_is("disabled", "needs-l1d-flush-msr-pr-0-to-1", np)) + security_ftr_clear(SEC_FTR_L1D_FLUSH_PR); + + if (fw_feature_is("disabled", "needs-l1d-flush-msr-hv-1-to-0", np)) + security_ftr_clear(SEC_FTR_L1D_FLUSH_HV); + + if (fw_feature_is("disabled", "needs-spec-barrier-for-bound-checks", np)) + security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR); +} + static void pnv_setup_rfi_flush(void) { struct device_node *np, *fw_features; @@ -55,6 +109,8 @@ static void pnv_setup_rfi_flush(void) of_node_put(np); if (fw_features) { + init_fw_feat_flags(fw_features); + np = of_get_child_by_name(fw_features, "inst-l1d-flush-trig2"); if (np && of_property_read_bool(np, "enabled")) type = L1D_FLUSH_MTTRIG; Patches currently in stable-queue which might be from mpe@ellerman.id.au are queue-4.9/powerpc-64s-clear-pcr-on-boot.patch queue-4.9/powerpc-rfi-flush-differentiate-enabled-and-patched-flush-types.patch queue-4.9/powerpc-64s-fix-section-mismatch-warnings-from-setup_rfi_flush.patch queue-4.9/powerpc-pseries-fix-clearing-of-security-feature-flags.patch queue-4.9/powerpc-powernv-set-or-clear-security-feature-flags.patch queue-4.9/powerpc-64s-move-cpu_show_meltdown.patch queue-4.9/powerpc-rfi-flush-call-setup_rfi_flush-after-lpm-migration.patch queue-4.9/powerpc-pseries-set-or-clear-security-feature-flags.patch queue-4.9/powerpc-rfi-flush-make-it-possible-to-call-setup_rfi_flush-again.patch queue-4.9/powerpc-move-default-security-feature-flags.patch queue-4.9/powerpc-powernv-use-the-security-flags-in-pnv_setup_rfi_flush.patch queue-4.9/powerpc-add-security-feature-flags-for-spectre-meltdown.patch queue-4.9/powerpc-pseries-use-the-security-flags-in-pseries_setup_rfi_flush.patch queue-4.9/powerpc-64s-enhance-the-information-in-cpu_show_meltdown.patch queue-4.9/powerpc-rfi-flush-move-out-of-hardlockup_detector-ifdef.patch queue-4.9/powerpc-rfi-flush-always-enable-fallback-flush-on-pseries.patch queue-4.9/powerpc-rfi-flush-move-the-logic-to-avoid-a-redo-into-the-debugfs-code.patch queue-4.9/powerpc-pseries-restore-default-security-feature-flags-on-setup.patch queue-4.9/powerpc-pseries-add-new-h_get_cpu_characteristics-flags.patch queue-4.9/powerpc-64s-add-support-for-a-store-forwarding-barrier-at-kernel-entry-exit.patch queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v1.patch queue-4.9/powerpc-powernv-support-firmware-disable-of-rfi-flush.patch queue-4.9/powerpc-pseries-support-firmware-disable-of-rfi-flush.patch queue-4.9/powerpc-64s-wire-up-cpu_show_spectre_v2.patch