From patchwork Fri Jun 14 03:08:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Viresh Kumar X-Patchwork-Id: 166775 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp1506343ilk; Thu, 13 Jun 2019 20:13:33 -0700 (PDT) X-Google-Smtp-Source: APXvYqyDPaNx4x5SgdpDkl8VBD7aui64+UkNVfUpxwlmVwqcE2ZL46Ctfd1nqOpWGXN8Y84hE8L4 X-Received: by 2002:a63:3008:: with SMTP id w8mr34030643pgw.11.1560482012819; Thu, 13 Jun 2019 20:13:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1560482012; cv=none; d=google.com; s=arc-20160816; b=p/ns6MxtqAcbH/LNoQkeBOzhYEFRRpQ2Eryu8nEWJBsiDoDP8WLJgsUZ3nNGQU7Z4B mAvEHXXKJF7EVcC2iKBtca36pTKUBLyHHhNsztWcB3OpR+clRHZsjO4Tei6n7bodMQCK IWXFlybrIsId2qQXXysklw2tvsEIYGrwqR1o5otOzXjl9azCFNcnPoqyfcuIU901eOOv ksJdLEdvxm6M77Af2h55Kxk0eeun4f37CTCvI/xp3qxjRoFTO8mCTtl7aNa8IJzRDPSs YJeuRp9XiiZLG0eRroaKMBvpKcGgjPxrXf71BjnCda0c+7UOiGXOWXhrNRpOAQr7XqKE n24A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=pEvDH0l3Ogb+ETQluMoz8xjNqG/my4E0M8F+Bzkpfu4=; b=Nk9Gufoka09OzN3Y6VWYOH1vsrgCQAMl566x+IXfkCM5dFGpn/eLqk/w0BPyJSISjN SE4qEPQ/+q+/Ruuj2Bksbf7yMrEJXOFRyO6yX5qGriGGdMUlZzdfRaCrOEVfO66MXFkd 5akDtGEMeZMrmD6jlOpsV+av8BOGx52hDUTB6R7puZ9eOanf8p8C60Ss8zWLyK2hG/6l LSCIdVJDCaCinlA/BXNJG2v/JMgchoaoFgdR305mKnTUlYpWzuDCI75RwKYWXei1ffo+ NaGezyH0cVyFJ/DjkesEnVT1Q6NfMR4Sll5AovYsfQVQVyo52+OT509569Ut8ml/cGIU 7m/g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WlxYLpJq; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e8si1073936plb.420.2019.06.13.20.13.32; Thu, 13 Jun 2019 20:13:32 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WlxYLpJq; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726742AbfFNDNc (ORCPT + 14 others); Thu, 13 Jun 2019 23:13:32 -0400 Received: from mail-pl1-f194.google.com ([209.85.214.194]:44971 "EHLO mail-pl1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726705AbfFNDNb (ORCPT ); Thu, 13 Jun 2019 23:13:31 -0400 Received: by mail-pl1-f194.google.com with SMTP id t7so366561plr.11 for ; Thu, 13 Jun 2019 20:13:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=pEvDH0l3Ogb+ETQluMoz8xjNqG/my4E0M8F+Bzkpfu4=; b=WlxYLpJqqc1s7ub+NyoMG89aE24FhTuR1DAGYoyRKrh58s1SM+98OItieICpHHaYKz j2XOKW5FhK/BqeAceNAYaH9h0teSC/B9bVUzCHj9RJpo4BWpcOm90NdrPPczDsQzxdpz MLP6MnCgpO3fGdk4dtky8QiWa1xxD7FZaLq3M03BgAmDwsK+TzThlwggyJpbYd09+wLA f3rJOyNYWL2YEr+nkMmP3eYjQ7SqG+0PAWrQAbIbVYtDa65LiPe0EGfr9oaz8X+P29DU ocYxamwYeiQ8R/uyXovL8UosqdJ83KPD5Lmwg57O62ycbsMsKqTE6FISGcyBwvTfKPqu jNnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=pEvDH0l3Ogb+ETQluMoz8xjNqG/my4E0M8F+Bzkpfu4=; b=cpN95f1MN27T6/L/24zxuNj9L1WB8+MpeYQl7ZiMW5QX7nLIq5FsR3u1AKsVkjHKc/ l3MaVxBEK+DDfvEBBxC0FcNkZzloJBtkssDToiaDxGlHQdPHvIZOmkdl9moYnpniY/qg p/nfaP15AXLmcfAYH9fEMf8zTB67sV0npK7/6zn9DsALV+uLdm1y+jEeRkLyamqJCagc yrAeUEW+7we2AM+29eu48ERkdqZ95PDtByAJRErIsxqiR78nyLS+ovhJbEC/Pce+GYX4 ydV5jhrsk4vFiHvfr+Z9A7jEA3+YYSK0Gvi0ykfisLjy+0qwWSPvUARbyh/VXnSo4Eg0 nIbg== X-Gm-Message-State: APjAAAUkvcKhwGRU3gBWupl4/UMWo1lzPEAF7iB5EiiYDqfOWQmdnol1 lskbK8u5Nbem+kNo7v5lnNilbQ== X-Received: by 2002:a17:902:29a7:: with SMTP id h36mr39298958plb.158.1560482011111; Thu, 13 Jun 2019 20:13:31 -0700 (PDT) Received: from localhost ([122.172.66.84]) by smtp.gmail.com with ESMTPSA id x7sm1024288pfm.82.2019.06.13.20.13.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 13 Jun 2019 20:13:30 -0700 (PDT) From: Viresh Kumar To: linux-arm-kernel@lists.infradead.org, Julien Thierry Cc: Viresh Kumar , stable@vger.kernel.org, Catalin Marinas , Marc Zyngier , Mark Rutland , Will Deacon , Russell King , Vincent Guittot , mark.brown@arm.com Subject: [PATCH v4.4 37/45] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Date: Fri, 14 Jun 2019 08:38:20 +0530 Message-Id: X-Mailer: git-send-email 2.21.0.rc0.269.g1a574e7a288b In-Reply-To: References: MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Rutland commit 6167ec5c9145cdf493722dfd80a5d48bafc4a18a upstream. A new feature of SMCCC 1.1 is that it offers firmware-based CPU workarounds. In particular, SMCCC_ARCH_WORKAROUND_1 provides BP hardening for CVE-2017-5715. If the host has some mitigation for this issue, report that we deal with it using SMCCC_ARCH_WORKAROUND_1, as we apply the host workaround on every guest exit. Tested-by: Ard Biesheuvel Reviewed-by: Christoffer Dall Signed-off-by: Marc Zyngier Signed-off-by: Catalin Marinas [ v4.4: account for files moved to virt/ upstream ] Signed-off-by: Viresh Kumar --- arch/arm/include/asm/kvm_host.h | 6 ++++++ arch/arm/kvm/psci.c | 9 ++++++++- arch/arm64/include/asm/kvm_host.h | 5 +++++ include/linux/arm-smccc.h | 5 +++++ 4 files changed, 24 insertions(+), 1 deletion(-) -- 2.21.0.rc0.269.g1a574e7a288b diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h index 6692982c9b57..2009894d9a8a 100644 --- a/arch/arm/include/asm/kvm_host.h +++ b/arch/arm/include/asm/kvm_host.h @@ -237,4 +237,10 @@ static inline void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) {} static inline void kvm_arm_clear_debug(struct kvm_vcpu *vcpu) {} static inline void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) {} +static inline bool kvm_arm_harden_branch_predictor(void) +{ + /* No way to detect it yet, pretend it is not there. */ + return false; +} + #endif /* __ARM_KVM_HOST_H__ */ diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c index 9abf40734723..747319490268 100644 --- a/arch/arm/kvm/psci.c +++ b/arch/arm/kvm/psci.c @@ -403,13 +403,20 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) { u32 func_id = smccc_get_function(vcpu); u32 val = PSCI_RET_NOT_SUPPORTED; + u32 feature; switch (func_id) { case ARM_SMCCC_VERSION_FUNC_ID: val = ARM_SMCCC_VERSION_1_1; break; case ARM_SMCCC_ARCH_FEATURES_FUNC_ID: - /* Nothing supported yet */ + feature = smccc_get_arg1(vcpu); + switch(feature) { + case ARM_SMCCC_ARCH_WORKAROUND_1: + if (kvm_arm_harden_branch_predictor()) + val = 0; + break; + } break; default: return kvm_psci_call(vcpu); diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index a35ce7266aac..aca3a7e28777 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -258,4 +258,9 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu); void kvm_arm_clear_debug(struct kvm_vcpu *vcpu); void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu); +static inline bool kvm_arm_harden_branch_predictor(void) +{ + return cpus_have_cap(ARM64_HARDEN_BRANCH_PREDICTOR); +} + #endif /* __ARM64_KVM_HOST_H__ */ diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h index da9f3916f9a9..1f02e4045a9e 100644 --- a/include/linux/arm-smccc.h +++ b/include/linux/arm-smccc.h @@ -73,6 +73,11 @@ ARM_SMCCC_SMC_32, \ 0, 1) +#define ARM_SMCCC_ARCH_WORKAROUND_1 \ + ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ + ARM_SMCCC_SMC_32, \ + 0, 0x8000) + #ifndef __ASSEMBLY__ /**