Revert "UBUNTU: SAUCE: rfi-flush: Add speculation barrier before ori 30,30,0 flush"

This reverts commit d585250a.

CVE-2017-5754

BugLink: http://bugs.launchpad.net/bugs/1756121

The functionality of this commit is provided by the following upstream
patch series:
  * powerpc/64s: Allow control of RFI flush via debugfs
  * powerpc/64s: Wire up cpu_show_meltdown()
  * powerpc/powernv: Check device-tree for RFI flush settings
  * powerpc/pseries: Query hypervisor for RFI flush settings
  * powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti
  * powerpc/64s: Add support for RFI flush of L1-D cache
  * powerpc/64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL
  * powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL
  * powerpc/64: Convert fast_exception_return to use RFI_TO_USER/KERNEL
  * powerpc/64s: Simple RFI macro conversions
  * powerpc/64: Add macros for annotating the destination of rfid/hrfid
  * powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper
Signed-off-by: Juerg Haefliger <juergh@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

arch/powerpc/include/asm/exception-64s.h

@@ -59,13 +59,11 @@
 #define PREPARE_RFI_TO_USER						\
 	RFI_FLUSH_FIXUP_SECTION;					\
 	nop;								\
-	nop;								\
 	nop
 
 #define PREPARE_RFI_TO_GUEST						\
 	RFI_FLUSH_FIXUP_SECTION;					\
 	nop;								\
-	nop;								\
 	nop
 
 #ifdef CONFIG_PPC_DEBUG_RFI

arch/powerpc/lib/feature-fixups.c

@@ -116,7 +116,7 @@ void do_feature_fixups(unsigned long value, void *fixup_start, void *fixup_end)
 #ifdef CONFIG_PPC_BOOK3S_64
 void do_rfi_flush_fixups(enum l1d_flush_type types)
 {
-	unsigned int instrs[3], *dest;
+	unsigned int instrs[2], *dest;
 	long *start, *end;
 	int i;
 
@@ -125,17 +125,14 @@ void do_rfi_flush_fixups(enum l1d_flush_type types)
 
 	instrs[0] = 0x60000000; /* nop */
 	instrs[1] = 0x60000000; /* nop */
-	instrs[2] = 0x60000000; /* nop */
 
 	if (types & L1D_FLUSH_FALLBACK)
 		/* b .+8 to fallback flush */
 		instrs[1] = 0x48000008;
 
 	i = 0;
-	if (types & L1D_FLUSH_ORI) {
-		instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */
-		instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/
-	}
+	if (types & L1D_FLUSH_ORI)
+		instrs[i++] = 0x63de0000; /* ori 30,30,0 */
 
 	if (types & L1D_FLUSH_MTTRIG)
 		instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
@@ -147,7 +144,6 @@ void do_rfi_flush_fixups(enum l1d_flush_type types)
 
 		patch_instruction(dest, instrs[0]);
 		patch_instruction(dest + 1, instrs[1]);
-		patch_instruction(dest + 2, instrs[2]);
 	}
 
 	printk(KERN_DEBUG "rfi-fixups: patched %d locations\n", i);