From: James Morse <james.morse@xxxxxxx>
commit 5bdf3437603d4af87f9c7f424b0c8aeed2420745 upstream.
CPUs vulnerable to Spectre-BHB either need to make an SMC-CC firmware
call from the vectors, or run a sequence of branches. This gets added
to the hyp vectors. If there is no support for arch-workaround-1 in
firmware, the indirect vector will be used.
kvm_init_vector_slots() only initialises the two indirect slots if
the platform is vulnerable to Spectre-v3a. pKVM's hyp_map_vectors()
only initialises __hyp_bp_vect_base if the platform is vulnerable to
Spectre-v3a.
As there are about to more users of the indirect vectors, ensure
their entries in hyp_spectre_vector_selector[] are always initialised,
and __hyp_bp_vect_base defaults to the regular VA mapping.
The Spectre-v3a check is moved to a helper
kvm_system_needs_idmapped_vectors(), and merged with the code
that creates the hyp mappings.
Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>
Signed-off-by: James Morse <james.morse@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/arm64/include/asm/kvm_host.h | 5 +++++
arch/arm64/kvm/arm.c | 5 +----
arch/arm64/kvm/hyp/nvhe/mm.c | 4 +++-
3 files changed, 9 insertions(+), 5 deletions(-)
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -712,6 +712,11 @@ static inline void kvm_init_host_cpu_con
ctxt_sys_reg(cpu_ctxt, MPIDR_EL1) = read_cpuid_mpidr();
}
+static inline bool kvm_system_needs_idmapped_vectors(void)
+{
+ return cpus_have_const_cap(ARM64_SPECTRE_V3A);
+}
+
void kvm_arm_vcpu_ptrauth_trap(struct kvm_vcpu *vcpu);
static inline void kvm_arch_hardware_unsetup(void) {}
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1464,10 +1464,7 @@ static int kvm_init_vector_slots(void)
base = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs));
kvm_init_vector_slot(base, HYP_VECTOR_SPECTRE_DIRECT);
- if (!cpus_have_const_cap(ARM64_SPECTRE_V3A))
- return 0;
-
- if (!has_vhe()) {
+ if (kvm_system_needs_idmapped_vectors() && !has_vhe()) {
err = create_hyp_exec_mappings(__pa_symbol(__bp_harden_hyp_vecs),
__BP_HARDEN_HYP_VECS_SZ, &base);
if (err)
--- a/arch/arm64/kvm/hyp/nvhe/mm.c
+++ b/arch/arm64/kvm/hyp/nvhe/mm.c
@@ -146,8 +146,10 @@ int hyp_map_vectors(void)
phys_addr_t phys;
void *bp_base;
- if (!cpus_have_const_cap(ARM64_SPECTRE_V3A))
+ if (!kvm_system_needs_idmapped_vectors()) {
+ __hyp_bp_vect_base = __bp_harden_hyp_vecs;
return 0;
+ }
phys = __hyp_pa(__bp_harden_hyp_vecs);
bp_base = (void *)__pkvm_create_private_mapping(phys,
Patches currently in stable-queue which might be from james.morse@xxxxxxx are
queue-5.16/arm64-entry-add-macro-for-reading-symbol-addresses-from-the-trampoline.patch
queue-5.16/arm64-use-the-clearbhb-instruction-in-mitigations.patch
queue-5.16/arm64-add-percpu-vectors-for-el1.patch
queue-5.16/arm64-entry-free-up-another-register-on-kpti-s-tramp_exit-path.patch
queue-5.16/arm64-entry-don-t-assume-tramp_vectors-is-the-start-of-the-vectors.patch
queue-5.16/arm64-entry-make-the-trampoline-cleanup-optional.patch
queue-5.16/arm64-proton-pack-include-unprivileged-ebpf-status-in-spectre-v2-mitigation-reporting.patch
queue-5.16/arm64-entry-add-non-kpti-__bp_harden_el1_vectors-for-mitigations.patch
queue-5.16/arm64-add-id_aa64isar2_el1-sys-register.patch
queue-5.16/kvm-arm64-allow-smccc_arch_workaround_3-to-be-discovered-and-migrated.patch
queue-5.16/arm64-spectre-rename-spectre_v4_patch_fw_mitigation_conduit.patch
queue-5.16/arm64-entry-move-trampoline-macros-out-of-ifdef-d-section.patch
queue-5.16/arm64-entry-allow-tramp_alias-to-access-symbols-after-the-4k-boundary.patch
queue-5.16/arm64-entry-move-the-trampoline-data-page-before-the-text-page.patch
queue-5.16/arm64-entry.s-add-ventry-overflow-sanity-checks.patch
queue-5.16/arm64-entry-add-vectors-that-have-the-bhb-mitigation-sequences.patch
queue-5.16/arm64-mitigate-spectre-style-branch-history-side-channels.patch
queue-5.16/arm64-entry-allow-the-trampoline-text-to-occupy-multiple-pages.patch
queue-5.16/arm64-proton-pack-report-spectre-bhb-vulnerabilities-as-part-of-spectre-v2.patch
queue-5.16/kvm-arm64-allow-indirect-vectors-to-be-used-without-spectre_v3a.patch
queue-5.16/arm64-entry-make-the-kpti-trampoline-s-kpti-sequence-optional.patch
