Commit 84ed26fd authored by Nicholas Piggin's avatar Nicholas Piggin Committed by Michael Ellerman
Browse files

powerpc/security: Add a security feature for STF barrier 



Rather than tying this mitigation to RFI L1D flush requirement, add a
new bit for it.

Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210503130243.891868-3-npiggin@gmail.com
parent 65c7d070

arch/powerpc/include/asm/security_features.h

+4 −0
Original line number Original line Diff line number Diff line
@@ -92,6 +92,9 @@ static inline bool security_ftr_enabled(u64 feature) 
// The L1-D cache should be flushed after user accesses from the kernel

// The L1-D cache should be flushed after user accesses from the kernel

#define SEC_FTR_L1D_FLUSH_UACCESS	0x0000000000008000ull

#define SEC_FTR_L1D_FLUSH_UACCESS	0x0000000000008000ull





// The STF flush should be executed on privilege state switch

#define SEC_FTR_STF_BARRIER		0x0000000000010000ull



// Features enabled by default

// Features enabled by default

#define SEC_FTR_DEFAULT \

#define SEC_FTR_DEFAULT \

	(SEC_FTR_L1D_FLUSH_HV | \

	(SEC_FTR_L1D_FLUSH_HV | \
@@ -99,6 +102,7 @@ static inline bool security_ftr_enabled(u64 feature) 
	 SEC_FTR_BNDS_CHK_SPEC_BAR | \

	 SEC_FTR_BNDS_CHK_SPEC_BAR | \

	 SEC_FTR_L1D_FLUSH_ENTRY | \

	 SEC_FTR_L1D_FLUSH_ENTRY | \

	 SEC_FTR_L1D_FLUSH_UACCESS | \

	 SEC_FTR_L1D_FLUSH_UACCESS | \

	 SEC_FTR_STF_BARRIER | \

	 SEC_FTR_FAVOUR_SECURITY)

	 SEC_FTR_FAVOUR_SECURITY)





#endif /* _ASM_POWERPC_SECURITY_FEATURES_H */
 
#endif /* _ASM_POWERPC_SECURITY_FEATURES_H */

arch/powerpc/kernel/security.c

+2 −5
Original line number Original line Diff line number Diff line
@@ -300,9 +300,7 @@ static void stf_barrier_enable(bool enable) 
void setup_stf_barrier(void)

void setup_stf_barrier(void)

{

{

	enum stf_barrier_type type;

	enum stf_barrier_type type;

	bool enable, hv;

	bool enable;



	hv = cpu_has_feature(CPU_FTR_HVMODE);





	/* Default to fallback in case fw-features are not available */

	/* Default to fallback in case fw-features are not available */

	if (cpu_has_feature(CPU_FTR_ARCH_300))

	if (cpu_has_feature(CPU_FTR_ARCH_300))
@@ -315,8 +313,7 @@ void setup_stf_barrier(void) 
		type = STF_BARRIER_NONE;

		type = STF_BARRIER_NONE;





	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&

	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&

		(security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) ||

		 security_ftr_enabled(SEC_FTR_STF_BARRIER);

		 (security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && hv));





	if (type == STF_BARRIER_FALLBACK) {

	if (type == STF_BARRIER_FALLBACK) {

		pr_info("stf-barrier: fallback barrier available\n");

		pr_info("stf-barrier: fallback barrier available\n");