From mboxrd@z Thu Jan 1 00:00:00 1970 From: Auger Eric Subject: Re: [PATCH v4 1/2] KVM: arm/arm64: Add save/restore support for firmware workaround state Date: Thu, 21 Mar 2019 13:54:07 +0100 Message-ID: <6f155e8b-b679-d868-865c-6fd6f4ee611a@redhat.com> References: <20190228234334.20456-1-andre.przywara@arm.com> <20190228234334.20456-2-andre.przywara@arm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, Dave Martin , linux-arm-kernel@lists.infradead.org, Steven Price To: Andre Przywara , Marc Zyngier , Christoffer Dall Return-path: In-Reply-To: <20190228234334.20456-2-andre.przywara@arm.com> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu List-Id: kvm.vger.kernel.org Hi Andre, On 3/1/19 12:43 AM, Andre Przywara wrote: > KVM implements the firmware interface for mitigating cache speculation > vulnerabilities. Guests may use this interface to ensure mitigation is > active. > If we want to migrate such a guest to a host with a different support > level for those workarounds, migration might need to fail, to ensure that > critical guests don't loose their protection. > > Introduce a way for userland to save and restore the workarounds state. > On restoring we do checks that make sure we don't downgrade our > mitigation level. > > Signed-off-by: Andre Przywara > --- > arch/arm/include/asm/kvm_emulate.h | 10 +++ > arch/arm/include/uapi/asm/kvm.h | 10 +++ > arch/arm64/include/asm/kvm_emulate.h | 14 +++ > arch/arm64/include/uapi/asm/kvm.h | 9 ++ > virt/kvm/arm/psci.c | 128 +++++++++++++++++++++++---- > 5 files changed, 155 insertions(+), 16 deletions(-) > > diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h > index 8927cae7c966..663a02d7e6f4 100644 > --- a/arch/arm/include/asm/kvm_emulate.h > +++ b/arch/arm/include/asm/kvm_emulate.h > @@ -283,6 +283,16 @@ static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu) > return vcpu_cp15(vcpu, c0_MPIDR) & MPIDR_HWID_BITMASK; > } > > +static inline bool kvm_arm_get_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu) > +{ > + return false; > +} > + > +static inline void kvm_arm_set_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu, > + bool flag) > +{ > +} > + > static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu) > { > *vcpu_cpsr(vcpu) |= PSR_E_BIT; > diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h > index 4602464ebdfb..ba4d2afe65e3 100644 > --- a/arch/arm/include/uapi/asm/kvm.h > +++ b/arch/arm/include/uapi/asm/kvm.h > @@ -214,6 +214,16 @@ struct kvm_vcpu_events { > #define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM | KVM_REG_SIZE_U64 | \ > KVM_REG_ARM_FW | ((r) & 0xffff)) > #define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1 KVM_REG_ARM_FW_REG(1) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL 1 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_UNAFFECTED 2 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2 KVM_REG_ARM_FW_REG(2) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN 1 Would be worth adding a comment saying that values are chosen so that higher values mean better protection. Otherwise it looks strange NOT_AVAIL/AVAIL/UNAFFECTED values are not the same for both workarounds. > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL 2 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED 3 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) > > /* Device Control API: ARM VGIC */ > #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 > diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h > index d3842791e1c4..c00c17c9adb6 100644 > --- a/arch/arm64/include/asm/kvm_emulate.h > +++ b/arch/arm64/include/asm/kvm_emulate.h > @@ -348,6 +348,20 @@ static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu) > return vcpu_read_sys_reg(vcpu, MPIDR_EL1) & MPIDR_HWID_BITMASK; > } > > +static inline bool kvm_arm_get_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu) > +{ > + return vcpu->arch.workaround_flags & VCPU_WORKAROUND_2_FLAG; > +} > + > +static inline void kvm_arm_set_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu, > + bool flag) > +{ > + if (flag) > + vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG; > + else > + vcpu->arch.workaround_flags &= ~VCPU_WORKAROUND_2_FLAG; > +} > + > static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu) > { > if (vcpu_mode_is_32bit(vcpu)) { > diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h > index 97c3478ee6e7..367e96fe654e 100644 > --- a/arch/arm64/include/uapi/asm/kvm.h > +++ b/arch/arm64/include/uapi/asm/kvm.h > @@ -225,6 +225,15 @@ struct kvm_vcpu_events { > #define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \ > KVM_REG_ARM_FW | ((r) & 0xffff)) > #define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1 KVM_REG_ARM_FW_REG(1) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL 1 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2 KVM_REG_ARM_FW_REG(2) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN 1 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL 2 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED 3 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) > > /* Device Control API: ARM VGIC */ > #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 > diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c > index 9b73d3ad918a..e65664c09b12 100644 > --- a/virt/kvm/arm/psci.c > +++ b/virt/kvm/arm/psci.c > @@ -445,42 +445,97 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) > > int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu) > { > - return 1; /* PSCI version */ > + return 3; /* PSCI version and two workaround registers */ > } > > int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) > { > - if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices)) > + if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices++)) > + return -EFAULT; > + > + if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1, uindices++)) > + return -EFAULT; > + > + if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2, uindices++)) > return -EFAULT; Wouldn't it make sense to have a const array somewhere listing the FW regs and putting KVM_REG_ARM_FW_REG[i]? Also kvm_arm_get_fw_num_regs could return the ARRAY_SIZE. vcpu arg is never used actually (not related to this patch). > > return 0; > } > > +#define KVM_REG_FEATURE_LEVEL_WIDTH 4 > +#define KVM_REG_FEATURE_LEVEL_MASK (BIT(KVM_REG_FEATURE_LEVEL_WIDTH) - 1) > + > +/* > + * Convert the workaround level into an easy-to-compare number, where higher > + * values mean better protection. > + */ > +static int get_kernel_wa_level(u64 regid) > +{ > + switch (regid) { > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: > + if (kvm_arm_harden_branch_predictor()) > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL; > + else > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: > + switch (kvm_arm_have_ssbd()) { > + case KVM_SSBD_FORCE_DISABLE: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL; > + case KVM_SSBD_KERNEL: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL; > + case KVM_SSBD_FORCE_ENABLE: > + case KVM_SSBD_MITIGATED: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED; > + case KVM_SSBD_UNKNOWN: > + default: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN; > + } > + } > + > + return 0; I would rather return -EINVAL although the function is not called for any invalid reg. > +} > + > int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > { > - if (reg->id == KVM_REG_ARM_PSCI_VERSION) { > - void __user *uaddr = (void __user *)(long)reg->addr; > - u64 val; > + void __user *uaddr = (void __user *)(long)reg->addr; > + u64 val; > > + switch (reg->id) { > + case KVM_REG_ARM_PSCI_VERSION: > val = kvm_psci_version(vcpu, vcpu->kvm); > - if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id))) > - return -EFAULT; > - > - return 0; > + break; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: > + val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK; Can get_kernel_wa_level return something outside of KVM_REG_FEATURE_LEVEL_MASK? > + break; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: > + val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK; same here > + if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL &&> + kvm_arm_get_vcpu_workaround_2_flag(vcpu)) nit: if (val == KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL && kvm_arm_get_vcpu_workaround_2_flag(vcpu)). > + val |= KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED; > + break; > + default: > + return -ENOENT; > } > > - return -EINVAL; > + if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id))) > + return -EFAULT; > + > + return 0; > } > > int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > { > - if (reg->id == KVM_REG_ARM_PSCI_VERSION) { > - void __user *uaddr = (void __user *)(long)reg->addr; > - bool wants_02; > - u64 val; > + void __user *uaddr = (void __user *)(long)reg->addr; > + u64 val; > + int wa_level; > + > + if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id))) > + return -EFAULT; > > - if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id))) > - return -EFAULT; > + switch (reg->id) { > + case KVM_REG_ARM_PSCI_VERSION: > + { > + bool wants_02; > > wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features); > > @@ -497,6 +552,47 @@ int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > vcpu->kvm->arch.psci_version = val; > return 0; > } > + break; > + } > + > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: > + if (val & ~KVM_REG_FEATURE_LEVEL_MASK) > + return -EINVAL; > + > + wa_level = val & KVM_REG_FEATURE_LEVEL_MASK; not needed > + > + /* For now we only accept the very same workaround level. */ > + if (get_kernel_wa_level(reg->id) != wa_level) > + return -EINVAL; > + > + return 0; > + > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: > + if (val & ~(KVM_REG_FEATURE_LEVEL_MASK | > + KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED))> + return -EINVAL; > + > + wa_level = val & KVM_REG_FEATURE_LEVEL_MASK; > + > + if (get_kernel_wa_level(reg->id) < wa_level) > + return -EINVAL; > + worth a comment? > + if (kvm_arm_have_ssbd() != KVM_SSBD_KERNEL) > + return 0; > + > + switch (wa_level) { > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL: > + kvm_arm_set_vcpu_workaround_2_flag(vcpu, > + val & KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED); > + break; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED: > + kvm_arm_set_vcpu_workaround_2_flag(vcpu, true); Looks strange to me we enable the flag when unaffected. > + break; > + } > + > + return 0; > + default: > + return -ENOENT; > } > > return -EINVAL; > Thanks Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B34E3C43381 for ; Thu, 21 Mar 2019 12:54:27 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8549E218A1 for ; Thu, 21 Mar 2019 12:54:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="mTl1bQPO" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8549E218A1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date: Message-ID:From:References:To:Subject:Reply-To:Content-ID:Content-Description :Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=ftIt6WSGMeRzIyOBPSzOLjKSg/iwRFDTFTmBm+QKhIw=; b=mTl1bQPOKoojxw b+Sw8WS1I6wcYOTuuUTwt+wDJkTYvPgiy74MGTeRsMEkCFKmRaRyJGUoyDDAq8cyTQDMLF0BzqEsV 4QL4rxaYjNA1SjCQyIaw0mGVv6QLZ2BR+YBH2i0XsimXopNgM2rWIUMRgbhzX1EtAINhk5SZ7h6+D dNupv1BDJMdAr7/5GP0wfOznoVzMJ67rxffwvRaGI27iP4nofjw6HzRODjKypMiyLyaV+FYOQdj6f 6fXJA2QndgPylCuzjU6MlkEXot5m63u6ShxuvQnUVPglvNnE9nhMSkyLjblJwDYSWs1e3cYgDUk9x Ou5stZcp4wXfxzuBpvtQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h6xDB-0007eM-Dn; Thu, 21 Mar 2019 12:54:21 +0000 Received: from mx1.redhat.com ([209.132.183.28]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h6xD7-0007dg-3t for linux-arm-kernel@lists.infradead.org; Thu, 21 Mar 2019 12:54:19 +0000 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 545FE307D942; Thu, 21 Mar 2019 12:54:16 +0000 (UTC) Received: from [10.36.116.167] (ovpn-116-167.ams2.redhat.com [10.36.116.167]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2815B5D9CC; Thu, 21 Mar 2019 12:54:13 +0000 (UTC) Subject: Re: [PATCH v4 1/2] KVM: arm/arm64: Add save/restore support for firmware workaround state To: Andre Przywara , Marc Zyngier , Christoffer Dall References: <20190228234334.20456-1-andre.przywara@arm.com> <20190228234334.20456-2-andre.przywara@arm.com> From: Auger Eric Message-ID: <6f155e8b-b679-d868-865c-6fd6f4ee611a@redhat.com> Date: Thu, 21 Mar 2019 13:54:07 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: <20190228234334.20456-2-andre.przywara@arm.com> Content-Language: en-US X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.48]); Thu, 21 Mar 2019 12:54:16 +0000 (UTC) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190321_055417_200949_0A133023 X-CRM114-Status: GOOD ( 29.28 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, Dave Martin , linux-arm-kernel@lists.infradead.org, Steven Price Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Andre, On 3/1/19 12:43 AM, Andre Przywara wrote: > KVM implements the firmware interface for mitigating cache speculation > vulnerabilities. Guests may use this interface to ensure mitigation is > active. > If we want to migrate such a guest to a host with a different support > level for those workarounds, migration might need to fail, to ensure that > critical guests don't loose their protection. > > Introduce a way for userland to save and restore the workarounds state. > On restoring we do checks that make sure we don't downgrade our > mitigation level. > > Signed-off-by: Andre Przywara > --- > arch/arm/include/asm/kvm_emulate.h | 10 +++ > arch/arm/include/uapi/asm/kvm.h | 10 +++ > arch/arm64/include/asm/kvm_emulate.h | 14 +++ > arch/arm64/include/uapi/asm/kvm.h | 9 ++ > virt/kvm/arm/psci.c | 128 +++++++++++++++++++++++---- > 5 files changed, 155 insertions(+), 16 deletions(-) > > diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h > index 8927cae7c966..663a02d7e6f4 100644 > --- a/arch/arm/include/asm/kvm_emulate.h > +++ b/arch/arm/include/asm/kvm_emulate.h > @@ -283,6 +283,16 @@ static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu) > return vcpu_cp15(vcpu, c0_MPIDR) & MPIDR_HWID_BITMASK; > } > > +static inline bool kvm_arm_get_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu) > +{ > + return false; > +} > + > +static inline void kvm_arm_set_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu, > + bool flag) > +{ > +} > + > static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu) > { > *vcpu_cpsr(vcpu) |= PSR_E_BIT; > diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h > index 4602464ebdfb..ba4d2afe65e3 100644 > --- a/arch/arm/include/uapi/asm/kvm.h > +++ b/arch/arm/include/uapi/asm/kvm.h > @@ -214,6 +214,16 @@ struct kvm_vcpu_events { > #define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM | KVM_REG_SIZE_U64 | \ > KVM_REG_ARM_FW | ((r) & 0xffff)) > #define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1 KVM_REG_ARM_FW_REG(1) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL 1 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_UNAFFECTED 2 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2 KVM_REG_ARM_FW_REG(2) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN 1 Would be worth adding a comment saying that values are chosen so that higher values mean better protection. Otherwise it looks strange NOT_AVAIL/AVAIL/UNAFFECTED values are not the same for both workarounds. > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL 2 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED 3 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) > > /* Device Control API: ARM VGIC */ > #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 > diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h > index d3842791e1c4..c00c17c9adb6 100644 > --- a/arch/arm64/include/asm/kvm_emulate.h > +++ b/arch/arm64/include/asm/kvm_emulate.h > @@ -348,6 +348,20 @@ static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu) > return vcpu_read_sys_reg(vcpu, MPIDR_EL1) & MPIDR_HWID_BITMASK; > } > > +static inline bool kvm_arm_get_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu) > +{ > + return vcpu->arch.workaround_flags & VCPU_WORKAROUND_2_FLAG; > +} > + > +static inline void kvm_arm_set_vcpu_workaround_2_flag(struct kvm_vcpu *vcpu, > + bool flag) > +{ > + if (flag) > + vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG; > + else > + vcpu->arch.workaround_flags &= ~VCPU_WORKAROUND_2_FLAG; > +} > + > static inline void kvm_vcpu_set_be(struct kvm_vcpu *vcpu) > { > if (vcpu_mode_is_32bit(vcpu)) { > diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h > index 97c3478ee6e7..367e96fe654e 100644 > --- a/arch/arm64/include/uapi/asm/kvm.h > +++ b/arch/arm64/include/uapi/asm/kvm.h > @@ -225,6 +225,15 @@ struct kvm_vcpu_events { > #define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \ > KVM_REG_ARM_FW | ((r) & 0xffff)) > #define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1 KVM_REG_ARM_FW_REG(1) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL 1 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2 KVM_REG_ARM_FW_REG(2) > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL 0 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN 1 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL 2 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED 3 > +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) > > /* Device Control API: ARM VGIC */ > #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 > diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c > index 9b73d3ad918a..e65664c09b12 100644 > --- a/virt/kvm/arm/psci.c > +++ b/virt/kvm/arm/psci.c > @@ -445,42 +445,97 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) > > int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu) > { > - return 1; /* PSCI version */ > + return 3; /* PSCI version and two workaround registers */ > } > > int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) > { > - if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices)) > + if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices++)) > + return -EFAULT; > + > + if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1, uindices++)) > + return -EFAULT; > + > + if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2, uindices++)) > return -EFAULT; Wouldn't it make sense to have a const array somewhere listing the FW regs and putting KVM_REG_ARM_FW_REG[i]? Also kvm_arm_get_fw_num_regs could return the ARRAY_SIZE. vcpu arg is never used actually (not related to this patch). > > return 0; > } > > +#define KVM_REG_FEATURE_LEVEL_WIDTH 4 > +#define KVM_REG_FEATURE_LEVEL_MASK (BIT(KVM_REG_FEATURE_LEVEL_WIDTH) - 1) > + > +/* > + * Convert the workaround level into an easy-to-compare number, where higher > + * values mean better protection. > + */ > +static int get_kernel_wa_level(u64 regid) > +{ > + switch (regid) { > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: > + if (kvm_arm_harden_branch_predictor()) > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL; > + else > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: > + switch (kvm_arm_have_ssbd()) { > + case KVM_SSBD_FORCE_DISABLE: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL; > + case KVM_SSBD_KERNEL: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL; > + case KVM_SSBD_FORCE_ENABLE: > + case KVM_SSBD_MITIGATED: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED; > + case KVM_SSBD_UNKNOWN: > + default: > + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN; > + } > + } > + > + return 0; I would rather return -EINVAL although the function is not called for any invalid reg. > +} > + > int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > { > - if (reg->id == KVM_REG_ARM_PSCI_VERSION) { > - void __user *uaddr = (void __user *)(long)reg->addr; > - u64 val; > + void __user *uaddr = (void __user *)(long)reg->addr; > + u64 val; > > + switch (reg->id) { > + case KVM_REG_ARM_PSCI_VERSION: > val = kvm_psci_version(vcpu, vcpu->kvm); > - if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id))) > - return -EFAULT; > - > - return 0; > + break; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: > + val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK; Can get_kernel_wa_level return something outside of KVM_REG_FEATURE_LEVEL_MASK? > + break; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: > + val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK; same here > + if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL &&> + kvm_arm_get_vcpu_workaround_2_flag(vcpu)) nit: if (val == KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL && kvm_arm_get_vcpu_workaround_2_flag(vcpu)). > + val |= KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED; > + break; > + default: > + return -ENOENT; > } > > - return -EINVAL; > + if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id))) > + return -EFAULT; > + > + return 0; > } > > int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > { > - if (reg->id == KVM_REG_ARM_PSCI_VERSION) { > - void __user *uaddr = (void __user *)(long)reg->addr; > - bool wants_02; > - u64 val; > + void __user *uaddr = (void __user *)(long)reg->addr; > + u64 val; > + int wa_level; > + > + if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id))) > + return -EFAULT; > > - if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id))) > - return -EFAULT; > + switch (reg->id) { > + case KVM_REG_ARM_PSCI_VERSION: > + { > + bool wants_02; > > wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features); > > @@ -497,6 +552,47 @@ int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > vcpu->kvm->arch.psci_version = val; > return 0; > } > + break; > + } > + > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: > + if (val & ~KVM_REG_FEATURE_LEVEL_MASK) > + return -EINVAL; > + > + wa_level = val & KVM_REG_FEATURE_LEVEL_MASK; not needed > + > + /* For now we only accept the very same workaround level. */ > + if (get_kernel_wa_level(reg->id) != wa_level) > + return -EINVAL; > + > + return 0; > + > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: > + if (val & ~(KVM_REG_FEATURE_LEVEL_MASK | > + KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED))> + return -EINVAL; > + > + wa_level = val & KVM_REG_FEATURE_LEVEL_MASK; > + > + if (get_kernel_wa_level(reg->id) < wa_level) > + return -EINVAL; > + worth a comment? > + if (kvm_arm_have_ssbd() != KVM_SSBD_KERNEL) > + return 0; > + > + switch (wa_level) { > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL: > + kvm_arm_set_vcpu_workaround_2_flag(vcpu, > + val & KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED); > + break; > + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNAFFECTED: > + kvm_arm_set_vcpu_workaround_2_flag(vcpu, true); Looks strange to me we enable the flag when unaffected. > + break; > + } > + > + return 0; > + default: > + return -ENOENT; > } > > return -EINVAL; > Thanks Eric _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel