powerpc/security/mitigation-patching.sh

0001 #!/usr/bin/env bash
0002
0003 set -euo pipefail
0004
0005 TIMEOUT=10
0006
0007 function do_one
0008 {
0009     local mitigation="$1"
0010     local orig
0011     local start
0012     local now
0013
0014     orig=$(cat "$mitigation")
0015
0016     start=$(date +%s)
0017     now=$start
0018
0019     while [[ $((now-start)) -lt "$TIMEOUT" ]]
0020     do
0021         echo 0 > "$mitigation"
0022         echo 1 > "$mitigation"
0023
0024         now=$(date +%s)
0025     done
0026
0027     echo "$orig" > "$mitigation"
0028 }
0029
0030 rc=0
0031 cd /sys/kernel/debug/powerpc || rc=1
0032 if [[ "$rc" -ne 0 ]]; then
0033     echo "Error: couldn't cd to /sys/kernel/debug/powerpc" >&2
0034     exit 1
0035 fi
0036
0037 tainted=$(cat /proc/sys/kernel/tainted)
0038 if [[ "$tainted" -ne 0 ]]; then
0039     echo "Error: kernel already tainted!" >&2
0040     exit 1
0041 fi
0042
0043 mitigations="barrier_nospec stf_barrier count_cache_flush rfi_flush entry_flush uaccess_flush"
0044
0045 for m in $mitigations
0046 do
0047     if [[ -f /sys/kernel/debug/powerpc/$m ]]
0048     then
0049         do_one "$m" &
0050     fi
0051 done
0052
0053 echo "Spawned threads enabling/disabling mitigations ..."
0054
0055 if stress-ng > /dev/null 2>&1; then
0056     stress="stress-ng"
0057 elif stress > /dev/null 2>&1; then
0058     stress="stress"
0059 else
0060     stress=""
0061 fi
0062
0063 if [[ -n "$stress" ]]; then
0064     "$stress" -m "$(nproc)" -t "$TIMEOUT" &
0065     echo "Spawned VM stressors ..."
0066 fi
0067
0068 echo "Waiting for timeout ..."
0069 wait
0070
0071 tainted=$(cat /proc/sys/kernel/tainted)
0072 if [[ "$tainted" -ne 0 ]]; then
0073     echo "Error: kernel became tainted!" >&2
0074     exit 1
0075 fi
0076
0077 echo "OK"
0078 exit 0