lkml.org 
[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 052/496] powerpc/pseries: Fix clearing of security feature flags
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>

    commit 0f9bdfe3c77091e8704d2e510eb7c2c2c6cde524 upstream.

    The H_CPU_BEHAV_* flags should be checked for in the 'behaviour' field
    of 'struct h_cpu_char_result' -- 'character' is for H_CPU_CHAR_*
    flags.

    Found by playing around with QEMU's implementation of the hypercall:

    H_CPU_CHAR=0xf000000000000000
    H_CPU_BEHAV=0x0000000000000000

    This clears H_CPU_BEHAV_FAVOUR_SECURITY and H_CPU_BEHAV_L1D_FLUSH_PR
    so pseries_setup_rfi_flush() disables 'rfi_flush'; and it also
    clears H_CPU_CHAR_L1D_THREAD_PRIV flag. So there is no RFI flush
    mitigation at all for cpu_show_meltdown() to report; but currently
    it does:

    Original kernel:

    # cat /sys/devices/system/cpu/vulnerabilities/meltdown
    Mitigation: RFI Flush

    Patched kernel:

    # cat /sys/devices/system/cpu/vulnerabilities/meltdown
    Not affected

    H_CPU_CHAR=0x0000000000000000
    H_CPU_BEHAV=0xf000000000000000

    This sets H_CPU_BEHAV_BNDS_CHK_SPEC_BAR so cpu_show_spectre_v1() should
    report vulnerable; but currently it doesn't:

    Original kernel:

    # cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
    Not affected

    Patched kernel:

    # cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
    Vulnerable

    Brown-paper-bag-by: Michael Ellerman <mpe@ellerman.id.au>
    Fixes: f636c14790ea ("powerpc/pseries: Set or clear security feature flags")
    Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/powerpc/platforms/pseries/setup.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/arch/powerpc/platforms/pseries/setup.c
    +++ b/arch/powerpc/platforms/pseries/setup.c
    @@ -484,13 +484,13 @@ static void init_cpu_char_feature_flags(
    * The features below are enabled by default, so we instead look to see
    * if firmware has *disabled* them, and clear them if so.
    */
    - if (!(result->character & H_CPU_BEHAV_FAVOUR_SECURITY))
    + if (!(result->behaviour & H_CPU_BEHAV_FAVOUR_SECURITY))
    security_ftr_clear(SEC_FTR_FAVOUR_SECURITY);

    - if (!(result->character & H_CPU_BEHAV_L1D_FLUSH_PR))
    + if (!(result->behaviour & H_CPU_BEHAV_L1D_FLUSH_PR))
    security_ftr_clear(SEC_FTR_L1D_FLUSH_PR);

    - if (!(result->character & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR))
    + if (!(result->behaviour & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR))
    security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR);
    }


    \
     
     \ /
      Last update: 2018-05-28 12:44    [W:4.032 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site