powerpc/64s: Enable barrier_nospec based on firmware settings

commit cb3d6759a93c6d0aea1c10deb6d00e111c29c19c upstream.

Check what firmware told us and enable/disable the barrier_nospec as
appropriate.

We err on the side of enabling the barrier, as it's no-op on older
systems, see the comment for more detail.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
index a225b5c42e767802369467dcc7e0219be5fc3b00..84ae150ce6a67e8e66d9508992b6ffcfc9799127 100644 (file)
--- a/arch/powerpc/include/asm/setup.h
+++ b/arch/powerpc/include/asm/setup.h
@@ -51,6 +51,7 @@ enum l1d_flush_type {
 
 void setup_rfi_flush(enum l1d_flush_type, bool enable);
 void do_rfi_flush_fixups(enum l1d_flush_type types);
+void setup_barrier_nospec(void);
 void do_barrier_nospec_fixups(bool enable);
 extern bool barrier_nospec_enabled;
 

diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
index 34d436fe2498743d83496e103e0e6200c2b3f949..d0e974da49182b41c27eaff7d6534dd85d977c9a 100644 (file)
--- a/arch/powerpc/kernel/security.c
+++ b/arch/powerpc/kernel/security.c
@@ -9,6 +9,7 @@
 #include <linux/device.h>
 #include <linux/seq_buf.h>
 
+#include <asm/debug.h>
 #include <asm/security_features.h>
 #include <asm/setup.h>
 
@@ -23,6 +24,65 @@ static void enable_barrier_nospec(bool enable)
        do_barrier_nospec_fixups(enable);
 }
 
+void setup_barrier_nospec(void)
+{
+       bool enable;
+
+       /*
+        * It would make sense to check SEC_FTR_SPEC_BAR_ORI31 below as well.
+        * But there's a good reason not to. The two flags we check below are
+        * both are enabled by default in the kernel, so if the hcall is not
+        * functional they will be enabled.
+        * On a system where the host firmware has been updated (so the ori
+        * functions as a barrier), but on which the hypervisor (KVM/Qemu) has
+        * not been updated, we would like to enable the barrier. Dropping the
+        * check for SEC_FTR_SPEC_BAR_ORI31 achieves that. The only downside is
+        * we potentially enable the barrier on systems where the host firmware
+        * is not updated, but that's harmless as it's a no-op.
+        */
+       enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
+                security_ftr_enabled(SEC_FTR_BNDS_CHK_SPEC_BAR);
+
+       enable_barrier_nospec(enable);
+}
+
+#ifdef CONFIG_DEBUG_FS
+static int barrier_nospec_set(void *data, u64 val)
+{
+       switch (val) {
+       case 0:
+       case 1:
+               break;
+       default:
+               return -EINVAL;
+       }
+
+       if (!!val == !!barrier_nospec_enabled)
+               return 0;
+
+       enable_barrier_nospec(!!val);
+
+       return 0;
+}
+
+static int barrier_nospec_get(void *data, u64 *val)
+{
+       *val = barrier_nospec_enabled ? 1 : 0;
+       return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_barrier_nospec,
+                       barrier_nospec_get, barrier_nospec_set, "%llu\n");
+
+static __init int barrier_nospec_debugfs_init(void)
+{
+       debugfs_create_file("barrier_nospec", 0600, powerpc_debugfs_root, NULL,
+                           &fops_barrier_nospec);
+       return 0;
+}
+device_initcall(barrier_nospec_debugfs_init);
+#endif /* CONFIG_DEBUG_FS */
+
 ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
 {
        bool thread_priv;

diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 17203abf38e85b8840a6fbd4d2e4b6500ae00f80..eb5464648810ebcc431233b0a74072b73a56059e 100644 (file)
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -123,6 +123,7 @@ static void pnv_setup_rfi_flush(void)
                  security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV));
 
        setup_rfi_flush(type, enable);
+       setup_barrier_nospec();
 }
 
 static void __init pnv_setup_arch(void)

diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 91ade77558239e119b9e3d545ebf702eefb66c98..2b2759c98c7ed2156b3b2f98c85ef59adbc184a9 100644 (file)
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -525,6 +525,7 @@ void pseries_setup_rfi_flush(void)
                 security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR);
 
        setup_rfi_flush(types, enable);
+       setup_barrier_nospec();
 }
 
 static void __init pSeries_setup_arch(void)