• Gustavo L. F. Walbon's avatar
    powerpc/security: Fix wrong message when RFI Flush is disable · 4e706af3
    Gustavo L. F. Walbon authored
    The issue was showing "Mitigation" message via sysfs whatever the
    state of "RFI Flush", but it should show "Vulnerable" when it is
    disabled.
    
    If you have "L1D private" feature enabled and not "RFI Flush" you are
    vulnerable to meltdown attacks.
    
    "RFI Flush" is the key feature to mitigate the meltdown whatever the
    "L1D private" state.
    
    SEC_FTR_L1D_THREAD_PRIV is a feature for Power9 only.
    
    So the message should be as the truth table shows:
    
      CPU | L1D private | RFI Flush |                sysfs
      ----|-------------|-----------|-------------------------------------
       P9 |    False    |   False   | Vulnerable
       P9 |    False    |   True    | Mitigation: RFI Flush
       P9 |    True     |   False   | Vulnerable: L1D private per thread
       P9 |    True     |   True    | Mitigation: RFI Flush, L1D private per thread
       P8 |    False    |   False   | Vulnerable
       P8 |    False    |   True    | Mitigation: RFI Flush
    
    Output before this fix:
      # cat /sys/devices/system/cpu/vulnerabilities/meltdown
      Mitigation: RFI Flush, L1D private per thread
      # echo 0 > /sys/kernel/debug/powerpc/rfi_flush
      # cat /sys/devices/system/cpu/vulnerabilities/meltdown
      Mitigation: L1D private per thread
    
    Output after fix:
      # cat /sys/devices/system/cpu/vulnerabilities/meltdown
      Mitigation: RFI Flush, L1D private per thread
      # echo 0 > /sys/kernel/debug/powerpc/rfi_flush
      # cat /sys/devices/system/cpu/vulnerabilities/meltdown
      Vulnerable: L1D private per thread
    Signed-off-by: default avatarGustavo L. F. Walbon <gwalbon@linux.ibm.com>
    Signed-off-by: default avatarMauro S. M. Rodrigues <maurosr@linux.vnet.ibm.com>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20190502210907.42375-1-gwalbon@linux.ibm.com
    4e706af3
security.c 11.1 KB