This is a note to let you know that I've just added the patch titled
[PATCH stable v4.14 26/32] powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit) to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: powerpc-fsl-flush-the-branch-predictor-at-each-kernel-entry-32-bit.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <sta...@vger.kernel.org> know about it. >From foo@baz Fri Mar 29 15:53:50 CET 2019 From: Michael Ellerman <m...@ellerman.id.au> Date: Fri, 29 Mar 2019 22:26:14 +1100 Subject: [PATCH stable v4.14 26/32] powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit) To: sta...@vger.kernel.org, gre...@linuxfoundation.org Cc: linuxppc-...@ozlabs.org, diana.crac...@nxp.com, msucha...@suse.de, christophe.le...@c-s.fr Message-ID: <20190329112620.14489-27-...@ellerman.id.au> From: Michael Ellerman <m...@ellerman.id.au> From: Diana Craciun <diana.crac...@nxp.com> commit 7fef436295bf6c05effe682c8797dfcb0deb112a upstream. In order to protect against speculation attacks on indirect branches, the branch predictor is flushed at kernel entry to protect for the following situations: - userspace process attacking another userspace process - userspace process attacking the kernel Basically when the privillege level change (i.e.the kernel is entered), the branch predictor state is flushed. Signed-off-by: Diana Craciun <diana.crac...@nxp.com> Signed-off-by: Michael Ellerman <m...@ellerman.id.au> Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> --- arch/powerpc/kernel/head_booke.h | 6 ++++++ arch/powerpc/kernel/head_fsl_booke.S | 15 +++++++++++++++ 2 files changed, 21 insertions(+) --- a/arch/powerpc/kernel/head_booke.h +++ b/arch/powerpc/kernel/head_booke.h @@ -43,6 +43,9 @@ andi. r11, r11, MSR_PR; /* check whether user or kernel */\ mr r11, r1; \ beq 1f; \ +START_BTB_FLUSH_SECTION \ + BTB_FLUSH(r11) \ +END_BTB_FLUSH_SECTION \ /* if from user, start at top of this thread's kernel stack */ \ lwz r11, THREAD_INFO-THREAD(r10); \ ALLOC_STACK_FRAME(r11, THREAD_SIZE); \ @@ -128,6 +131,9 @@ stw r9,_CCR(r8); /* save CR on stack */\ mfspr r11,exc_level_srr1; /* check whether user or kernel */\ DO_KVM BOOKE_INTERRUPT_##intno exc_level_srr1; \ +START_BTB_FLUSH_SECTION \ + BTB_FLUSH(r10) \ +END_BTB_FLUSH_SECTION \ andi. r11,r11,MSR_PR; \ mfspr r11,SPRN_SPRG_THREAD; /* if from user, start at top of */\ lwz r11,THREAD_INFO-THREAD(r11); /* this thread's kernel stack */\ --- a/arch/powerpc/kernel/head_fsl_booke.S +++ b/arch/powerpc/kernel/head_fsl_booke.S @@ -452,6 +452,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV) mfcr r13 stw r13, THREAD_NORMSAVE(3)(r10) DO_KVM BOOKE_INTERRUPT_DTLB_MISS SPRN_SRR1 +START_BTB_FLUSH_SECTION + mfspr r11, SPRN_SRR1 + andi. r10,r11,MSR_PR + beq 1f + BTB_FLUSH(r10) +1: +END_BTB_FLUSH_SECTION mfspr r10, SPRN_DEAR /* Get faulting address */ /* If we are faulting a kernel address, we have to use the @@ -546,6 +553,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV) mfcr r13 stw r13, THREAD_NORMSAVE(3)(r10) DO_KVM BOOKE_INTERRUPT_ITLB_MISS SPRN_SRR1 +START_BTB_FLUSH_SECTION + mfspr r11, SPRN_SRR1 + andi. r10,r11,MSR_PR + beq 1f + BTB_FLUSH(r10) +1: +END_BTB_FLUSH_SECTION + mfspr r10, SPRN_SRR0 /* Get faulting address */ /* If we are faulting a kernel address, we have to use the Patches currently in stable-queue which might be from m...@ellerman.id.au are queue-4.14/powerpc-fsl-emulate-sprn_bucsr-register.patch queue-4.14/powerpc-64-make-stf-barrier-ppc_book3s_64-specific.patch queue-4.14/powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch queue-4.14/powerpc-64s-patch-barrier_nospec-in-modules.patch queue-4.14/powerpc-pseries-query-hypervisor-for-count-cache-flush-settings.patch queue-4.14/powerpc-64s-add-support-for-software-count-cache-flush.patch queue-4.14/powerpc64s-show-ori31-availability-in-spectre_v1-sysfs-file-not-v2.patch queue-4.14/powerpc-fsl-flush-the-branch-predictor-at-each-kernel-entry-64bit.patch queue-4.14/powerpc-fsl-update-spectre-v2-reporting.patch queue-4.14/powerpc-64-make-meltdown-reporting-book3s-64-specific.patch queue-4.14/powerpc-64s-add-support-for-ori-barrier_nospec-patching.patch queue-4.14/powerpc-use-barrier_nospec-in-copy_from_user.patch queue-4.14/powerpc-fsl-sanitize-the-syscall-table-for-nxp-powerpc-32-bit-platforms.patch queue-4.14/powerpc-fsl-add-macro-to-flush-the-branch-predictor.patch queue-4.14/powerpc-fsl-add-barrier_nospec-implementation-for-nxp-powerpc-book3e.patch queue-4.14/powerpc-security-fix-spectre_v2-reporting.patch queue-4.14/powerpc-64-disable-the-speculation-barrier-from-the-command-line.patch queue-4.14/powerpc-fsl-fix-the-flush-of-branch-predictor.patch queue-4.14/powerpc-64-add-config_ppc_barrier_nospec.patch queue-4.14/powerpc-fsl-enable-runtime-patching-if-nospectre_v2-boot-arg-is-used.patch queue-4.14/powerpc-64-use-barrier_nospec-in-syscall-entry.patch queue-4.14/powerpc-fsl-fixed-warning-orphan-section-__btb_flush_fixup.patch queue-4.14/powerpc-fsl-add-nospectre_v2-command-line-argument.patch queue-4.14/powerpc-64s-add-new-security-feature-flags-for-count-cache-flush.patch queue-4.14/powerpc-fsl-add-infrastructure-to-fixup-branch-predictor-flush.patch queue-4.14/powerpc-64s-enhance-the-information-in-cpu_show_spectre_v1.patch queue-4.14/powerpc-64-call-setup_barrier_nospec-from-setup_arch.patch queue-4.14/powerpc-asm-add-a-patch_site-macro-helpers-for-patching-instructions.patch queue-4.14/powerpc-fsl-flush-the-branch-predictor-at-each-kernel-entry-32-bit.patch queue-4.14/powerpc-64s-enable-barrier_nospec-based-on-firmware-settings.patch queue-4.14/powerpc-fsl-flush-branch-predictor-when-entering-kvm.patch queue-4.14/powerpc-powernv-query-firmware-for-count-cache-flush-settings.patch