Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-29 23:51:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

powerpc/pseries: Set or clear security feature flags

Browse Source 
Now that we have feature flags for security related things, set or
clear them based on what we receive from the hypercall.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
This commit is contained in:
Michael Ellerman 2018-03-27 23:01:46 +11:00
parent 9a868f6343
commit f636c14790
1 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
arch/powerpc/platforms/pseries/setup.c
View File

@ -68,6 +68,7 @@
#include <asm/plpar_wrappers.h> #include <asm/plpar_wrappers.h>
#include <asm/kexec.h> #include <asm/kexec.h>
#include <asm/isa-bridge.h> #include <asm/isa-bridge.h>
#include <asm/security_features.h>
#include "pseries.h" #include "pseries.h"
@ -459,6 +460,40 @@ static void __init find_and_init_phbs(void)
of_pci_check_probe_only(); of_pci_check_probe_only();
} }
static void init_cpu_char_feature_flags(struct h_cpu_char_result *result)
{
if (result->character & H_CPU_CHAR_SPEC_BAR_ORI31)
security_ftr_set(SEC_FTR_SPEC_BAR_ORI31);
if (result->character & H_CPU_CHAR_BCCTRL_SERIALISED)
security_ftr_set(SEC_FTR_BCCTRL_SERIALISED);
if (result->character & H_CPU_CHAR_L1D_FLUSH_ORI30)
security_ftr_set(SEC_FTR_L1D_FLUSH_ORI30);
if (result->character & H_CPU_CHAR_L1D_FLUSH_TRIG2)
security_ftr_set(SEC_FTR_L1D_FLUSH_TRIG2);
if (result->character & H_CPU_CHAR_L1D_THREAD_PRIV)
security_ftr_set(SEC_FTR_L1D_THREAD_PRIV);
if (result->character & H_CPU_CHAR_COUNT_CACHE_DISABLED)
security_ftr_set(SEC_FTR_COUNT_CACHE_DISABLED);
/*
* The features below are enabled by default, so we instead look to see
* if firmware has *disabled* them, and clear them if so.
*/
if (!(result->character & H_CPU_BEHAV_FAVOUR_SECURITY))
security_ftr_clear(SEC_FTR_FAVOUR_SECURITY);
if (!(result->character & H_CPU_BEHAV_L1D_FLUSH_PR))
security_ftr_clear(SEC_FTR_L1D_FLUSH_PR);
if (!(result->character & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR))
security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR);
}
void pseries_setup_rfi_flush(void) void pseries_setup_rfi_flush(void)
{ {
struct h_cpu_char_result result; struct h_cpu_char_result result;
@ -472,6 +507,8 @@ void pseries_setup_rfi_flush(void)
rc = plpar_get_cpu_characteristics(&result); rc = plpar_get_cpu_characteristics(&result);
if (rc == H_SUCCESS) { if (rc == H_SUCCESS) {
init_cpu_char_feature_flags(&result);
if (result.character & H_CPU_CHAR_L1D_FLUSH_TRIG2) if (result.character & H_CPU_CHAR_L1D_FLUSH_TRIG2)
types |= L1D_FLUSH_MTTRIG; types |= L1D_FLUSH_MTTRIG;
if (result.character & H_CPU_CHAR_L1D_FLUSH_ORI30) if (result.character & H_CPU_CHAR_L1D_FLUSH_ORI30)
@ -482,6 +519,12 @@ void pseries_setup_rfi_flush(void)
enable = false; enable = false;
} }
/*
* We're the guest so this doesn't apply to us, clear it to simplify
* handling of it elsewhere.
*/
security_ftr_clear(SEC_FTR_L1D_FLUSH_HV);
setup_rfi_flush(types, enable); setup_rfi_flush(types, enable);
} }