Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-27 14:41:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

powerpc/security: Add a security feature for STF barrier

Browse Source 
Rather than tying this mitigation to RFI L1D flush requirement, add a
new bit for it.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210503130243.891868-3-npiggin@gmail.com
This commit is contained in:
Nicholas Piggin 2021-05-03 23:02:41 +10:00 committed by Michael Ellerman
parent 65c7d07085
commit 84ed26fd00
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/powerpc/include/asm/security_features.h
View File

@ -92,6 +92,9 @@ static inline bool security_ftr_enabled(u64 feature)
// The L1-D cache should be flushed after user accesses from the kernel // The L1-D cache should be flushed after user accesses from the kernel
#define SEC_FTR_L1D_FLUSH_UACCESS 0x0000000000008000ull #define SEC_FTR_L1D_FLUSH_UACCESS 0x0000000000008000ull
// The STF flush should be executed on privilege state switch
#define SEC_FTR_STF_BARRIER 0x0000000000010000ull
// Features enabled by default // Features enabled by default
#define SEC_FTR_DEFAULT \ #define SEC_FTR_DEFAULT \
(SEC_FTR_L1D_FLUSH_HV | \ (SEC_FTR_L1D_FLUSH_HV | \
@ -99,6 +102,7 @@ static inline bool security_ftr_enabled(u64 feature)
SEC_FTR_BNDS_CHK_SPEC_BAR | \ SEC_FTR_BNDS_CHK_SPEC_BAR | \
SEC_FTR_L1D_FLUSH_ENTRY | \ SEC_FTR_L1D_FLUSH_ENTRY | \
SEC_FTR_L1D_FLUSH_UACCESS | \ SEC_FTR_L1D_FLUSH_UACCESS | \
SEC_FTR_STF_BARRIER | \
SEC_FTR_FAVOUR_SECURITY) SEC_FTR_FAVOUR_SECURITY)
#endif /* _ASM_POWERPC_SECURITY_FEATURES_H */ #endif /* _ASM_POWERPC_SECURITY_FEATURES_H */

7
arch/powerpc/kernel/security.c
View File

@ -300,9 +300,7 @@ static void stf_barrier_enable(bool enable)
void setup_stf_barrier(void) void setup_stf_barrier(void)
{ {
enum stf_barrier_type type; enum stf_barrier_type type;
bool enable, hv; bool enable;
hv = cpu_has_feature(CPU_FTR_HVMODE);
/* Default to fallback in case fw-features are not available */ /* Default to fallback in case fw-features are not available */
if (cpu_has_feature(CPU_FTR_ARCH_300)) if (cpu_has_feature(CPU_FTR_ARCH_300))
@ -315,8 +313,7 @@ void setup_stf_barrier(void)
type = STF_BARRIER_NONE; type = STF_BARRIER_NONE;
enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
(security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) || security_ftr_enabled(SEC_FTR_STF_BARRIER);
(security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && hv));
if (type == STF_BARRIER_FALLBACK) { if (type == STF_BARRIER_FALLBACK) {
pr_info("stf-barrier: fallback barrier available\n"); pr_info("stf-barrier: fallback barrier available\n");