Skip to content
Snippets Groups Projects
  1. Jul 09, 2023
    • Michael Ellerman's avatar
      powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 · 5bcedc59
      Michael Ellerman authored
      
      Nageswara reported that /proc/self/status was showing "vulnerable" for
      the Speculation_Store_Bypass feature on Power10, eg:
      
        $ grep Speculation_Store_Bypass: /proc/self/status
        Speculation_Store_Bypass:       vulnerable
      
      But at the same time the sysfs files, and lscpu, were showing "Not
      affected".
      
      This turns out to simply be a bug in the reporting of the
      Speculation_Store_Bypass, aka. PR_SPEC_STORE_BYPASS, case.
      
      When SEC_FTR_STF_BARRIER was added, so that firmware could communicate
      the vulnerability was not present, the code in ssb_prctl_get() was not
      updated to check the new flag.
      
      So add the check for SEC_FTR_STF_BARRIER being disabled. Rather than
      adding the new check to the existing if block and expanding the comment
      to cover both cases, rewrite the three cases to be separate so they can
      be commented separately for clarity.
      
      Fixes: 84ed26fd ("powerpc/security: Add a security feature for STF barrier")
      Cc: stable@vger.kernel.org # v5.14+
      Reported-by: default avatarNageswara R Sastry <rnsastry@linux.ibm.com>
      Tested-by: default avatarNageswara R Sastry <rnsastry@linux.ibm.com>
      Reviewed-by: default avatarRussell Currey <ruscur@russell.cc>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://msgid.link/20230517074945.53188-1-mpe@ellerman.id.au
      5bcedc59
    • Michael Ellerman's avatar
      powerpc/64s: Fix native_hpte_remove() to be irq-safe · 8bbe9fee
      Michael Ellerman authored
      
      Lockdep warns that the use of the hpte_lock in native_hpte_remove() is
      not safe against an IRQ coming in:
      
        ================================
        WARNING: inconsistent lock state
        6.4.0-rc2-g0c54f4d30ecc #1 Not tainted
        --------------------------------
        inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
        qemu-system-ppc/93865 [HC0[0]:SC0[0]:HE1:SE1] takes:
        c0000000021f5180 (hpte_lock){+.?.}-{0:0}, at: native_lock_hpte+0x8/0xd0
        {IN-SOFTIRQ-W} state was registered at:
          lock_acquire+0x134/0x3f0
          native_lock_hpte+0x44/0xd0
          native_hpte_insert+0xd4/0x2a0
          __hash_page_64K+0x218/0x4f0
          hash_page_mm+0x464/0x840
          do_hash_fault+0x11c/0x260
          data_access_common_virt+0x210/0x220
          __ip_select_ident+0x140/0x150
          ...
          net_rx_action+0x3bc/0x440
          __do_softirq+0x180/0x534
          ...
          sys_sendmmsg+0x34/0x50
          system_call_exception+0x128/0x320
          system_call_common+0x160/0x2e4
        ...
         Possible unsafe locking scenario:
      
               CPU0
               ----
          lock(hpte_lock);
          <Interrupt>
            lock(hpte_lock);
      
         *** DEADLOCK ***
        ...
        Call Trace:
          dump_stack_lvl+0x98/0xe0 (unreliable)
          print_usage_bug.part.0+0x250/0x278
          mark_lock+0xc9c/0xd30
          __lock_acquire+0x440/0x1ca0
          lock_acquire+0x134/0x3f0
          native_lock_hpte+0x44/0xd0
          native_hpte_remove+0xb0/0x190
          kvmppc_mmu_map_page+0x650/0x698 [kvm_pr]
          kvmppc_handle_pagefault+0x534/0x6e8 [kvm_pr]
          kvmppc_handle_exit_pr+0x6d8/0xe90 [kvm_pr]
          after_sprg3_load+0x80/0x90 [kvm_pr]
          kvmppc_vcpu_run_pr+0x108/0x270 [kvm_pr]
          kvmppc_vcpu_run+0x34/0x48 [kvm]
          kvm_arch_vcpu_ioctl_run+0x340/0x470 [kvm]
          kvm_vcpu_ioctl+0x338/0x8b8 [kvm]
          sys_ioctl+0x7c4/0x13e0
          system_call_exception+0x128/0x320
          system_call_common+0x160/0x2e4
      
      I suspect kvm_pr is the only caller that doesn't already have IRQs
      disabled, which is why this hasn't been reported previously.
      
      Fix it by disabling IRQs in native_hpte_remove().
      
      Fixes: 35159b57 ("powerpc/64s: make HPTE lock and native_tlbie_lock irq-safe")
      Cc: stable@vger.kernel.org # v6.1+
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://msgid.link/20230517123033.18430-1-mpe@ellerman.id.au
      8bbe9fee
  2. Jul 07, 2023
  3. Jul 06, 2023
  4. Jul 05, 2023
  5. Jul 04, 2023
  6. Jul 03, 2023
Loading