From: Marc Zyngier <marc.zyngier@arm.com> To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu Cc: Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will.deacon@arm.com>, Peter Maydell <peter.maydell@linaro.org>, Christoffer Dall <christoffer.dall@linaro.org>, Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>, Mark Rutland <mark.rutland@arm.com>, Robin Murphy <robin.murphy@arm.com>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, Jon Masters <jcm@redhat.com> Subject: [PATCH v2 00/16] arm64: Add SMCCC v1.1 support and CVE-2017-5715 (Spectre variant 2) mitigation Date: Mon, 29 Jan 2018 17:45:43 +0000 [thread overview] Message-ID: <20180129174559.1866-1-marc.zyngier@arm.com> (raw) ARM has recently published a SMC Calling Convention (SMCCC) specification update[1] that provides an optimised calling convention and optional, discoverable support for mitigating CVE-2017-5715. ARM Trusted Firmware (ATF) has already gained such an implementation[2]. This series addresses a few things: - It provides a KVM implementation of PSCI v1.0, which is a prerequisite for being able to discover SMCCC v1.1, together with a new userspace API to control the PSCI revision number that the guest sees. - It allows KVM to advertise SMCCC v1.1, which is de-facto supported already (it never corrupts any of the guest registers). - It implements KVM support for the ARCH_WORKAROUND_1 function that is used to mitigate CVE-2017-5715 in a guest (if such mitigation is available on the host). - It implements SMCCC v1.1 and ARCH_WORKAROUND_1 discovery support in the kernel itself. - It finally provides firmware callbacks for CVE-2017-5715 for both kernel and KVM. This method is intended to fully replace the initial PSCI_GET_VERSION approach. Although PSCI_GET_VERSION still works, it has an obvious overhead and is called on some of the hottest paths. We expect ARCH_WORKAROUND_1 to be much faster. Patch 1 is already merged, and included here for reference. Patches on top of arm64/for-next/core. Tested on Seattle and Juno, the latter with ATF implementing SMCCC v1.1. [1]: https://developer.arm.com/-/media/developer/pdf/ARM%20DEN%200070A%20Firmware%20interfaces%20for%20mitigating%20CVE-2017-5715_V1.0.pdf Hopefully this link is a persistent one. It is otherwise linked to from [3], which is persistent. [2]: https://github.com/ARM-software/arm-trusted-firmware/pull/1240 [3]: https://developer.arm.com/support/security-update/frequently-asked-questions * From v1: - Fixed 32bit build - Fix function number sign extension (Ard) - Inline SMCCC v1.1 primitives (cpp soup) - Prevent SMCCC spamming on feature probing - Random fixes and tidying up Marc Zyngier (16): arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls arm/arm64: KVM: Consolidate the PSCI include files arm/arm64: KVM: Add PSCI_VERSION helper arm/arm64: KVM: Add smccc accessors to PSCI code arm/arm64: KVM: Implement PSCI 1.0 support arm/arm64: KVM: Add PSCI version selection API arm/arm64: KVM: Advertise SMCCC v1.1 arm/arm64: KVM: Turn kvm_psci_version into a static inline arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling firmware/psci: Expose PSCI conduit firmware/psci: Expose SMCCC version through psci_ops arm/arm64: smccc: Make function identifiers an unsigned quantity arm/arm64: smccc: Implement SMCCC v1.1 inline primitive arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Documentation/virtual/kvm/api.txt | 3 +- Documentation/virtual/kvm/arm/psci.txt | 30 +++++ arch/arm/include/asm/kvm_host.h | 3 + arch/arm/include/asm/kvm_psci.h | 27 ----- arch/arm/include/uapi/asm/kvm.h | 6 + arch/arm/kvm/guest.c | 13 +++ arch/arm/kvm/handle_exit.c | 8 +- arch/arm64/include/asm/kvm_host.h | 3 + arch/arm64/include/asm/kvm_psci.h | 44 ++++++- arch/arm64/include/uapi/asm/kvm.h | 6 + arch/arm64/kernel/bpi.S | 20 ++++ arch/arm64/kernel/cpu_errata.c | 68 ++++++++++- arch/arm64/kvm/guest.c | 14 ++- arch/arm64/kvm/handle_exit.c | 9 +- arch/arm64/kvm/hyp/hyp-entry.S | 20 +++- arch/arm64/kvm/hyp/switch.c | 20 ++-- drivers/firmware/psci.c | 49 +++++++- include/kvm/arm_psci.h | 63 ++++++++++ include/linux/arm-smccc.h | 181 ++++++++++++++++++++++++++++- include/linux/psci.h | 13 +++ virt/kvm/arm/arm.c | 2 +- virt/kvm/arm/psci.c | 202 +++++++++++++++++++++++++++++---- 22 files changed, 721 insertions(+), 83 deletions(-) create mode 100644 Documentation/virtual/kvm/arm/psci.txt delete mode 100644 arch/arm/include/asm/kvm_psci.h create mode 100644 include/kvm/arm_psci.h -- 2.14.2
WARNING: multiple messages have this Message-ID (diff)
From: marc.zyngier@arm.com (Marc Zyngier) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v2 00/16] arm64: Add SMCCC v1.1 support and CVE-2017-5715 (Spectre variant 2) mitigation Date: Mon, 29 Jan 2018 17:45:43 +0000 [thread overview] Message-ID: <20180129174559.1866-1-marc.zyngier@arm.com> (raw) ARM has recently published a SMC Calling Convention (SMCCC) specification update[1] that provides an optimised calling convention and optional, discoverable support for mitigating CVE-2017-5715. ARM Trusted Firmware (ATF) has already gained such an implementation[2]. This series addresses a few things: - It provides a KVM implementation of PSCI v1.0, which is a prerequisite for being able to discover SMCCC v1.1, together with a new userspace API to control the PSCI revision number that the guest sees. - It allows KVM to advertise SMCCC v1.1, which is de-facto supported already (it never corrupts any of the guest registers). - It implements KVM support for the ARCH_WORKAROUND_1 function that is used to mitigate CVE-2017-5715 in a guest (if such mitigation is available on the host). - It implements SMCCC v1.1 and ARCH_WORKAROUND_1 discovery support in the kernel itself. - It finally provides firmware callbacks for CVE-2017-5715 for both kernel and KVM. This method is intended to fully replace the initial PSCI_GET_VERSION approach. Although PSCI_GET_VERSION still works, it has an obvious overhead and is called on some of the hottest paths. We expect ARCH_WORKAROUND_1 to be much faster. Patch 1 is already merged, and included here for reference. Patches on top of arm64/for-next/core. Tested on Seattle and Juno, the latter with ATF implementing SMCCC v1.1. [1]: https://developer.arm.com/-/media/developer/pdf/ARM%20DEN%200070A%20Firmware%20interfaces%20for%20mitigating%20CVE-2017-5715_V1.0.pdf Hopefully this link is a persistent one. It is otherwise linked to from [3], which is persistent. [2]: https://github.com/ARM-software/arm-trusted-firmware/pull/1240 [3]: https://developer.arm.com/support/security-update/frequently-asked-questions * From v1: - Fixed 32bit build - Fix function number sign extension (Ard) - Inline SMCCC v1.1 primitives (cpp soup) - Prevent SMCCC spamming on feature probing - Random fixes and tidying up Marc Zyngier (16): arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls arm/arm64: KVM: Consolidate the PSCI include files arm/arm64: KVM: Add PSCI_VERSION helper arm/arm64: KVM: Add smccc accessors to PSCI code arm/arm64: KVM: Implement PSCI 1.0 support arm/arm64: KVM: Add PSCI version selection API arm/arm64: KVM: Advertise SMCCC v1.1 arm/arm64: KVM: Turn kvm_psci_version into a static inline arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling firmware/psci: Expose PSCI conduit firmware/psci: Expose SMCCC version through psci_ops arm/arm64: smccc: Make function identifiers an unsigned quantity arm/arm64: smccc: Implement SMCCC v1.1 inline primitive arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Documentation/virtual/kvm/api.txt | 3 +- Documentation/virtual/kvm/arm/psci.txt | 30 +++++ arch/arm/include/asm/kvm_host.h | 3 + arch/arm/include/asm/kvm_psci.h | 27 ----- arch/arm/include/uapi/asm/kvm.h | 6 + arch/arm/kvm/guest.c | 13 +++ arch/arm/kvm/handle_exit.c | 8 +- arch/arm64/include/asm/kvm_host.h | 3 + arch/arm64/include/asm/kvm_psci.h | 44 ++++++- arch/arm64/include/uapi/asm/kvm.h | 6 + arch/arm64/kernel/bpi.S | 20 ++++ arch/arm64/kernel/cpu_errata.c | 68 ++++++++++- arch/arm64/kvm/guest.c | 14 ++- arch/arm64/kvm/handle_exit.c | 9 +- arch/arm64/kvm/hyp/hyp-entry.S | 20 +++- arch/arm64/kvm/hyp/switch.c | 20 ++-- drivers/firmware/psci.c | 49 +++++++- include/kvm/arm_psci.h | 63 ++++++++++ include/linux/arm-smccc.h | 181 ++++++++++++++++++++++++++++- include/linux/psci.h | 13 +++ virt/kvm/arm/arm.c | 2 +- virt/kvm/arm/psci.c | 202 +++++++++++++++++++++++++++++---- 22 files changed, 721 insertions(+), 83 deletions(-) create mode 100644 Documentation/virtual/kvm/arm/psci.txt delete mode 100644 arch/arm/include/asm/kvm_psci.h create mode 100644 include/kvm/arm_psci.h -- 2.14.2
next reply other threads:[~2018-01-29 17:46 UTC|newest] Thread overview: 116+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-01-29 17:45 Marc Zyngier [this message] 2018-01-29 17:45 ` [PATCH v2 00/16] arm64: Add SMCCC v1.1 support and CVE-2017-5715 (Spectre variant 2) mitigation Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 01/16] arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 02/16] arm: " Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 03/16] arm/arm64: KVM: Consolidate the PSCI include files Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 04/16] arm/arm64: KVM: Add PSCI_VERSION helper Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-30 13:15 ` Robin Murphy 2018-01-30 13:15 ` Robin Murphy 2018-01-30 14:52 ` Marc Zyngier 2018-01-30 14:52 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 05/16] arm/arm64: KVM: Add smccc accessors to PSCI code Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 06/16] arm/arm64: KVM: Implement PSCI 1.0 support Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 07/16] arm/arm64: KVM: Add PSCI version selection API Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-31 17:38 ` Andrew Jones 2018-01-31 17:38 ` Andrew Jones 2018-01-31 17:45 ` Marc Zyngier 2018-01-31 17:45 ` Marc Zyngier 2018-01-31 18:03 ` Andrew Jones 2018-01-31 18:03 ` Andrew Jones 2018-01-31 18:03 ` Andrew Jones 2018-01-31 18:36 ` Marc Zyngier 2018-01-31 18:36 ` Marc Zyngier 2018-01-31 19:15 ` Andrew Jones 2018-01-31 19:15 ` Andrew Jones 2018-01-31 18:11 ` kbuild test robot 2018-01-31 18:11 ` kbuild test robot 2018-01-29 17:45 ` [PATCH v2 08/16] arm/arm64: KVM: Advertise SMCCC v1.1 Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-30 0:23 ` Russell King - ARM Linux 2018-01-30 0:23 ` Russell King - ARM Linux 2018-01-30 12:28 ` Marc Zyngier 2018-01-30 12:28 ` Marc Zyngier 2018-01-30 12:28 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 09/16] arm/arm64: KVM: Turn kvm_psci_version into a static inline Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 10/16] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-30 12:38 ` Robin Murphy 2018-01-30 12:38 ` Robin Murphy 2018-01-29 17:45 ` [PATCH v2 11/16] arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 12/16] firmware/psci: Expose PSCI conduit Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:55 ` Lorenzo Pieralisi 2018-01-29 17:55 ` Lorenzo Pieralisi 2018-01-29 17:45 ` [PATCH v2 13/16] firmware/psci: Expose SMCCC version through psci_ops Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 18:39 ` Lorenzo Pieralisi 2018-01-29 18:39 ` Lorenzo Pieralisi 2018-01-30 12:09 ` Marc Zyngier 2018-01-30 12:09 ` Marc Zyngier 2018-01-30 12:55 ` Robin Murphy 2018-01-30 12:55 ` Robin Murphy 2018-01-30 13:51 ` Marc Zyngier 2018-01-30 13:51 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 14/16] arm/arm64: smccc: Make function identifiers an unsigned quantity Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` [PATCH v2 15/16] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 19:07 ` Robin Murphy 2018-01-29 19:07 ` Robin Murphy 2018-01-30 8:54 ` Marc Zyngier 2018-01-30 8:54 ` Marc Zyngier 2018-01-29 21:45 ` Ard Biesheuvel 2018-01-29 21:45 ` Ard Biesheuvel 2018-01-30 12:27 ` Marc Zyngier 2018-01-30 12:27 ` Marc Zyngier 2018-01-30 12:29 ` Ard Biesheuvel 2018-01-30 12:29 ` Ard Biesheuvel 2018-01-30 12:29 ` Ard Biesheuvel 2018-01-29 17:45 ` [PATCH v2 16/16] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 17:45 ` Marc Zyngier 2018-01-29 19:41 ` Ard Biesheuvel 2018-01-29 19:41 ` Ard Biesheuvel 2018-01-30 12:10 ` Marc Zyngier 2018-01-30 12:10 ` Marc Zyngier 2018-01-31 13:56 ` Hanjun Guo 2018-01-31 13:56 ` Hanjun Guo 2018-01-31 13:56 ` Hanjun Guo 2018-01-31 14:11 ` Marc Zyngier 2018-01-31 14:11 ` Marc Zyngier 2018-01-31 14:35 ` Ard Biesheuvel 2018-01-31 14:35 ` Ard Biesheuvel 2018-01-31 14:38 ` Ard Biesheuvel 2018-01-31 14:38 ` Ard Biesheuvel 2018-01-31 15:05 ` Marc Zyngier 2018-01-31 15:05 ` Marc Zyngier 2018-02-01 2:40 ` Hanjun Guo 2018-02-01 2:40 ` Hanjun Guo 2018-02-01 6:52 ` Hanjun Guo 2018-02-01 6:52 ` Hanjun Guo 2018-02-01 6:52 ` Hanjun Guo 2018-02-01 8:53 ` Marc Zyngier 2018-02-01 8:53 ` Marc Zyngier 2018-02-02 3:43 ` Hanjun Guo 2018-02-02 3:43 ` Hanjun Guo 2018-06-09 13:22 ` [PATCH v2 00/16] arm64: Add SMCCC v1.1 support and CVE-2017-5715 (Spectre variant 2) mitigation Jon Masters 2018-06-09 13:22 ` Jon Masters 2018-06-09 14:06 ` Marc Zyngier 2018-06-09 14:06 ` Marc Zyngier 2018-06-09 14:06 ` Marc Zyngier
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180129174559.1866-1-marc.zyngier@arm.com \ --to=marc.zyngier@arm.com \ --cc=ard.biesheuvel@linaro.org \ --cc=catalin.marinas@arm.com \ --cc=christoffer.dall@linaro.org \ --cc=jcm@redhat.com \ --cc=kvmarm@lists.cs.columbia.edu \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=lorenzo.pieralisi@arm.com \ --cc=mark.rutland@arm.com \ --cc=peter.maydell@linaro.org \ --cc=robin.murphy@arm.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.