arm64: KVM: Add ARCH_WORKAROUND_2 discovery through ARCH_FEATURES_FUNC_ID

BugLink: https://bugs.launchpad.net/bugs/1787993
CVE-2018-3639 (arm64)

commit 5d81f7dc9bca4f4963092433e27b508cbe524a32 upstream.

Now that all our infrastructure is in place, let's expose the
availability of ARCH_WORKAROUND_2 to guests. We take this opportunity
to tidy up a couple of SMCCC constants.

Acked-by: Christoffer Dall <christoffer.dall@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 96fd60c8160c16dd16542efe4491f0d096d5c1b4
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git /
linux-4.14.y)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 6c05e3b1308107d14abd74096b552c53de8cb21d..ef1492e15811646ce7d942644661718301f62ddb 100644 (file)
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -316,4 +316,16 @@ static inline bool kvm_arm_harden_branch_predictor(void)
        return false;
 }
 
+#define KVM_SSBD_UNKNOWN               -1
+#define KVM_SSBD_FORCE_DISABLE         0
+#define KVM_SSBD_KERNEL                1
+#define KVM_SSBD_FORCE_ENABLE          2
+#define KVM_SSBD_MITIGATED             3
+
+static inline int kvm_arm_have_ssbd(void)
+{
+       /* No way to detect it yet, pretend it is not there. */
+       return KVM_SSBD_UNKNOWN;
+}
+
 #endif /* __ARM_KVM_HOST_H__ */

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 6f18142642bf5f4ef4d241cd748114c785d7cfd0..b6bec6d51393a6fc84d657e7f90a0bd3afc6352f 100644 (file)
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -442,4 +442,27 @@ static inline bool kvm_arm_harden_branch_predictor(void)
        return cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR);
 }
 
+#define KVM_SSBD_UNKNOWN               -1
+#define KVM_SSBD_FORCE_DISABLE         0
+#define KVM_SSBD_KERNEL                1
+#define KVM_SSBD_FORCE_ENABLE          2
+#define KVM_SSBD_MITIGATED             3
+
+static inline int kvm_arm_have_ssbd(void)
+{
+       switch (arm64_get_ssbd_state()) {
+       case ARM64_SSBD_FORCE_DISABLE:
+               return KVM_SSBD_FORCE_DISABLE;
+       case ARM64_SSBD_KERNEL:
+               return KVM_SSBD_KERNEL;
+       case ARM64_SSBD_FORCE_ENABLE:
+               return KVM_SSBD_FORCE_ENABLE;
+       case ARM64_SSBD_MITIGATED:
+               return KVM_SSBD_MITIGATED;
+       case ARM64_SSBD_UNKNOWN:
+       default:
+               return KVM_SSBD_UNKNOWN;
+       }
+}
+
 #endif /* __ARM64_KVM_HOST_H__ */

diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index 3256b9228e75801a7d91ad9c95235bd7c420d779..a74311beda35d9f54a15e5c9cb1230367f70865f 100644 (file)
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -122,6 +122,10 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
        /* Reset PMU */
        kvm_pmu_vcpu_reset(vcpu);
 
+       /* Default workaround setup is enabled (if supported) */
+       if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL)
+               vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG;
+
        /* Reset timer */
        return kvm_timer_vcpu_reset(vcpu);
 }

diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
index c4762bef13c6d389ff0c1e4f656322d66bb167b0..c95ab4c5a47516067737b1612d7545fa9543b3b1 100644 (file)
--- a/virt/kvm/arm/psci.c
+++ b/virt/kvm/arm/psci.c
@@ -405,7 +405,7 @@ static int kvm_psci_call(struct kvm_vcpu *vcpu)
 int kvm_hvc_call_handler(struct kvm_vcpu *vcpu)
 {
        u32 func_id = smccc_get_function(vcpu);
-       u32 val = PSCI_RET_NOT_SUPPORTED;
+       u32 val = SMCCC_RET_NOT_SUPPORTED;
        u32 feature;
 
        switch (func_id) {
@@ -417,7 +417,21 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu)
                switch(feature) {
                case ARM_SMCCC_ARCH_WORKAROUND_1:
                        if (kvm_arm_harden_branch_predictor())
-                               val = 0;
+                               val = SMCCC_RET_SUCCESS;
+                       break;
+               case ARM_SMCCC_ARCH_WORKAROUND_2:
+                       switch (kvm_arm_have_ssbd()) {
+                       case KVM_SSBD_FORCE_DISABLE:
+                       case KVM_SSBD_UNKNOWN:
+                               break;
+                       case KVM_SSBD_KERNEL:
+                               val = SMCCC_RET_SUCCESS;
+                               break;
+                       case KVM_SSBD_FORCE_ENABLE:
+                       case KVM_SSBD_MITIGATED:
+                               val = SMCCC_RET_NOT_REQUIRED;
+                               break;
+                       }
                        break;
                }
                break;