25 Aug, 2019

1 commit

  • At the moment we use 2 IO devices per GICv3 redistributor: one
    one for the RD_base frame and one for the SGI_base frame.

    Instead we can use a single IO device per redistributor (the 2
    frames are contiguous). This saves slots on the KVM_MMIO_BUS
    which is currently limited to NR_IOBUS_DEVS (1000).

    This change allows to instantiate up to 512 redistributors and may
    speed the guest boot with a large number of VCPUs.

    Signed-off-by: Eric Auger
    Signed-off-by: Marc Zyngier

    Eric Auger
     

19 Aug, 2019

1 commit


05 Aug, 2019

1 commit

  • Since commit commit 328e56647944 ("KVM: arm/arm64: vgic: Defer
    touching GICH_VMCR to vcpu_load/put"), we leave ICH_VMCR_EL2 (or
    its GICv2 equivalent) loaded as long as we can, only syncing it
    back when we're scheduled out.

    There is a small snag with that though: kvm_vgic_vcpu_pending_irq(),
    which is indirectly called from kvm_vcpu_check_block(), needs to
    evaluate the guest's view of ICC_PMR_EL1. At the point were we
    call kvm_vcpu_check_block(), the vcpu is still loaded, and whatever
    changes to PMR is not visible in memory until we do a vcpu_put().

    Things go really south if the guest does the following:

    mov x0, #0 // or any small value masking interrupts
    msr ICC_PMR_EL1, x0

    [vcpu preempted, then rescheduled, VMCR sampled]

    mov x0, #ff // allow all interrupts
    msr ICC_PMR_EL1, x0
    wfi // traps to EL2, so samping of VMCR

    [interrupt arrives just after WFI]

    Here, the hypervisor's view of PMR is zero, while the guest has enabled
    its interrupts. kvm_vgic_vcpu_pending_irq() will then say that no
    interrupts are pending (despite an interrupt being received) and we'll
    block for no reason. If the guest doesn't have a periodic interrupt
    firing once it has blocked, it will stay there forever.

    To avoid this unfortuante situation, let's resync VMCR from
    kvm_arch_vcpu_blocking(), ensuring that a following kvm_vcpu_check_block()
    will observe the latest value of PMR.

    This has been found by booting an arm64 Linux guest with the pseudo NMI
    feature, and thus using interrupt priorities to mask interrupts instead
    of the usual PSTATE masking.

    Cc: stable@vger.kernel.org # 4.12
    Fixes: 328e56647944 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put")
    Signed-off-by: Marc Zyngier

    Marc Zyngier
     

23 Jul, 2019

1 commit

  • We use "pmc->idx" and the "chained" bitmap to determine if the pmc is
    chained, in kvm_pmu_pmc_is_chained(). But idx might be uninitialized
    (and random) when we doing this decision, through a KVM_ARM_VCPU_INIT
    ioctl -> kvm_pmu_vcpu_reset(). And the test_bit() against this random
    idx will potentially hit a KASAN BUG [1].

    In general, idx is the static property of a PMU counter that is not
    expected to be modified across resets, as suggested by Julien. It
    looks more reasonable if we can setup the PMU counter idx for a vcpu
    in its creation time. Introduce a new function - kvm_pmu_vcpu_init()
    for this basic setup. Oh, and the KASAN BUG will get fixed this way.

    [1] https://www.spinics.net/lists/kvm-arm/msg36700.html

    Fixes: 80f393a23be6 ("KVM: arm/arm64: Support chained PMU counters")
    Suggested-by: Andrew Murray
    Suggested-by: Julien Thierry
    Acked-by: Julien Thierry
    Signed-off-by: Zenghui Yu
    Signed-off-by: Marc Zyngier

    Zenghui Yu
     

05 Jul, 2019

3 commits

  • ARMv8 provides support for chained PMU counters, where an event type
    of 0x001E is set for odd-numbered counters, the event counter will
    increment by one for each overflow of the preceding even-numbered
    counter. Let's emulate this in KVM by creating a 64 bit perf counter
    when a user chains two emulated counters together.

    For chained events we only support generating an overflow interrupt
    on the high counter. We use the attributes of the low counter to
    determine the attributes of the perf event.

    Suggested-by: Marc Zyngier
    Signed-off-by: Andrew Murray
    Reviewed-by: Julien Thierry
    Reviewed-by: Suzuki K Poulose
    Signed-off-by: Marc Zyngier

    Andrew Murray
     
  • We currently use pmc->bitmask to determine the width of the pmc - however
    it's superfluous as the pmc index already describes if the pmc is a cycle
    counter or event counter. The architecture clearly describes the widths of
    these counters.

    Let's remove the bitmask to simplify the code.

    Signed-off-by: Andrew Murray
    Signed-off-by: Marc Zyngier

    Andrew Murray
     
  • The kvm_pmu_{enable/disable}_counter functions can enable/disable
    multiple counters at once as they operate on a bitmask. Let's
    make this clearer by renaming the function.

    Suggested-by: Suzuki K Poulose
    Signed-off-by: Andrew Murray
    Reviewed-by: Julien Thierry
    Reviewed-by: Suzuki K Poulose
    Signed-off-by: Marc Zyngier

    Andrew Murray
     

19 Jun, 2019

1 commit

  • Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation this program is
    distributed in the hope that it will be useful but without any
    warranty without even the implied warranty of merchantability or
    fitness for a particular purpose see the gnu general public license
    for more details you should have received a copy of the gnu general
    public license along with this program if not see http www gnu org
    licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 503 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Alexios Zavras
    Reviewed-by: Allison Randal
    Reviewed-by: Enrico Weigelt
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190602204653.811534538@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

05 Jun, 2019

2 commits

  • Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license this
    program is distributed in the hope that it will be useful but
    without any warranty without even the implied warranty of
    merchantability or fitness for a particular purpose see the gnu
    general public license for more details you should have received a
    copy of the gnu general public license along with this program if
    not see http www gnu org licenses

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 15 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Reviewed-by: Alexios Zavras
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190530000437.237481593@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     
  • Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license version 2 as
    published by the free software foundation this program is
    distributed in the hope that it will be useful but without any
    warranty without even the implied warranty of merchantability or
    fitness for a particular purpose see the gnu general public license
    for more details you should have received a copy of the gnu general
    public license along with this program if not write to the free
    software foundation inc 59 temple place suite 330 boston ma 02111
    1307 usa

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-only

    has been chosen to replace the boilerplate/reference in 136 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Alexios Zavras
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190530000436.384967451@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

16 Mar, 2019

1 commit

  • Pull KVM updates from Paolo Bonzini:
    "ARM:
    - some cleanups
    - direct physical timer assignment
    - cache sanitization for 32-bit guests

    s390:
    - interrupt cleanup
    - introduction of the Guest Information Block
    - preparation for processor subfunctions in cpu models

    PPC:
    - bug fixes and improvements, especially related to machine checks
    and protection keys

    x86:
    - many, many cleanups, including removing a bunch of MMU code for
    unnecessary optimizations
    - AVIC fixes

    Generic:
    - memcg accounting"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (147 commits)
    kvm: vmx: fix formatting of a comment
    KVM: doc: Document the life cycle of a VM and its resources
    MAINTAINERS: Add KVM selftests to existing KVM entry
    Revert "KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range()"
    KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char()
    KVM: PPC: Fix compilation when KVM is not enabled
    KVM: Minor cleanups for kvm_main.c
    KVM: s390: add debug logging for cpu model subfunctions
    KVM: s390: implement subfunction processor calls
    arm64: KVM: Fix architecturally invalid reset value for FPEXC32_EL2
    KVM: arm/arm64: Remove unused timer variable
    KVM: PPC: Book3S: Improve KVM reference counting
    KVM: PPC: Book3S HV: Fix build failure without IOMMU support
    Revert "KVM: Eliminate extra function calls in kvm_get_dirty_log_protect()"
    x86: kvmguest: use TSC clocksource if invariant TSC is exposed
    KVM: Never start grow vCPU halt_poll_ns from value below halt_poll_ns_grow_start
    KVM: Expose the initial start value in grow_halt_poll_ns() as a module parameter
    KVM: grow_halt_poll_ns() should never shrink vCPU halt_poll_ns
    KVM: x86/mmu: Consolidate kvm_mmu_zap_all() and kvm_mmu_zap_mmio_sptes()
    KVM: x86/mmu: WARN if zapping a MMIO spte results in zapping children
    ...

    Linus Torvalds
     

20 Feb, 2019

5 commits

  • We are currently emulating two timers in two different ways. When we
    add support for nested virtualization in the future, we are going to be
    emulating either two timers in two diffferent ways, or four timers in a
    single way.

    We need a unified data structure to keep track of how we map virtual
    state to physical state and we need to cleanup some of the timer code to
    operate more independently on a struct arch_timer_context instead of
    trying to consider the global state of the VCPU and recomputing all
    state.

    Co-written with Marc Zyngier

    Signed-off-by: Marc Zyngier
    Signed-off-by: Christoffer Dall

    Christoffer Dall
     
  • VHE systems don't have to emulate the physical timer, we can simply
    assign the EL1 physical timer directly to the VM as the host always
    uses the EL2 timers.

    In order to minimize the amount of cruft, AArch32 gets definitions for
    the physical timer too, but is should be generally unused on this
    architecture.

    Co-written with Marc Zyngier

    Signed-off-by: Marc Zyngier
    Signed-off-by: Christoffer Dall

    Christoffer Dall
     
  • Prepare for having 4 timer data structures (2 for now).

    Move loaded to the cpu data structure and not the individual timer
    structure, in preparation for assigning the EL1 phys timer as well.

    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     
  • At the moment we have separate system register emulation handlers for
    each timer register. Actually they are quite similar, and we rely on
    kvm_arm_timer_[gs]et_reg() for the actual emulation anyways, so let's
    just merge all of those handlers into one function, which just marshalls
    the arguments and then hands off to a set of common accessors.
    This makes extending the emulation to include EL2 timers much easier.

    Signed-off-by: Andre Przywara
    [Fixed 32-bit VM breakage and reduced to reworking existing code]
    Signed-off-by: Christoffer Dall
    [Fixed 32bit host, general cleanup]
    Signed-off-by: Marc Zyngier

    Andre Przywara
     
  • Instead of calling into kvm_timer_[un]schedule from the main kvm
    blocking path, test if the VCPU is on the wait queue from the load/put
    path and perform the background timer setup/cancel in this path.

    This has the distinct advantage that we no longer race between load/put
    and schedule/unschedule and programming and canceling of the bg_timer
    always happens when the timer state is not loaded.

    Note that we must now remove the checks in kvm_timer_blocking that do
    not schedule a background timer if one of the timers can fire, because
    we no longer have a guarantee that kvm_vcpu_check_block() will be called
    before kvm_timer_blocking.

    Reported-by: Andre Przywara
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     

24 Jan, 2019

3 commits


20 Dec, 2018

1 commit

  • The use of a work queue in the hrtimer expire function for the bg_timer
    is a leftover from the time when we would inject interrupts when the
    bg_timer expired.

    Since we are no longer doing that, we can instead call
    kvm_vcpu_wake_up() directly from the hrtimer function and remove all
    workqueue functionality from the arch timer code.

    Signed-off-by: Marc Zyngier
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     

12 Aug, 2018

1 commit

  • Although vgic-v3 now supports Group0 interrupts, it still doesn't
    deal with Group0 SGIs. As usually with the GIC, nothing is simple:

    - ICC_SGI1R can signal SGIs of both groups, since GICD_CTLR.DS==1
    with KVM (as per 8.1.10, Non-secure EL1 access)

    - ICC_SGI0R can only generate Group0 SGIs

    - ICC_ASGI1R sees its scope refocussed to generate only Group0
    SGIs (as per the note at the bottom of Table 8-14)

    We only support Group1 SGIs so far, so no material change.

    Reviewed-by: Eric Auger
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Marc Zyngier
     

21 Jul, 2018

3 commits

  • Simply letting IGROUPR be writable from userspace would break
    migration from old kernels to newer kernels, because old kernels
    incorrectly report interrupt groups as group 1. This would not be a big
    problem if userspace wrote GICD_IIDR as read from the kernel, because we
    could detect the incompatibility and return an error to userspace.
    Unfortunately, this is not the case with current userspace
    implementations and simply letting IGROUPR be writable from userspace for
    an emulated GICv2 silently breaks migration and causes the destination
    VM to no longer run after migration.

    We now encourage userspace to write the read and expected value of
    GICD_IIDR as the first part of a GIC register restore, and if we observe
    a write to GICD_IIDR we know that userspace has been updated and has had
    a chance to cope with older kernels (VGICv2 IIDR.Revision == 0)
    incorrectly reporting interrupts as group 1, and therefore we now allow
    groups to be user writable.

    Reviewed-by: Andrew Jones
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     
  • In preparation for proper group 0 and group 1 support in the vgic, we
    add a field in the struct irq to store the group of all interrupts.

    We initialize the group to group 0 when emulating GICv2 and to group 1
    when emulating GICv3, just like we treat them today. LPIs are always
    group 1. We also continue to ignore writes from the guest, preserving
    existing functionality, for now.

    Finally, we also add this field to the vgic debug logic to show the
    group for all interrupts.

    Reviewed-by: Andrew Jones
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     
  • As we are about to tweak implementation aspects of the VGIC emulation,
    while still preserving some level of backwards compatibility support,
    add a field to keep track of the implementation revision field which is
    reported to the VM and to userspace.

    Reviewed-by: Andrew Jones
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     

25 May, 2018

3 commits

  • Let's raise the number of supported vcpus along with
    vgic v3 now that HW is looming with more physical CPUs.

    Signed-off-by: Eric Auger
    Acked-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Eric Auger
     
  • kvm_vgic_vcpu_early_init gets called after kvm_vgic_cpu_init which
    is confusing. The call path is as follows:
    kvm_vm_ioctl_create_vcpu
    |_ kvm_arch_cpu_create
    |_ kvm_vcpu_init
    |_ kvm_arch_vcpu_init
    |_ kvm_vgic_vcpu_init
    |_ kvm_arch_vcpu_postcreate
    |_ kvm_vgic_vcpu_early_init

    Static initialization currently done in kvm_vgic_vcpu_early_init()
    can be moved to kvm_vgic_vcpu_init(). So let's move the code and
    remove kvm_vgic_vcpu_early_init(). kvm_arch_vcpu_postcreate() does
    nothing.

    Signed-off-by: Eric Auger
    Signed-off-by: Marc Zyngier

    Eric Auger
     
  • At the moment KVM supports a single rdist region. We want to
    support several separate rdist regions so let's introduce a list
    of them. This patch currently only cares about a single
    entry in this list as the functionality to register several redist
    regions is not yet there. So this only translates the existing code
    into something functionally similar using that new data struct.

    The redistributor region handle is stored in the vgic_cpu structure
    to allow later computation of the TYPER last bit.

    Signed-off-by: Eric Auger
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Eric Auger
     

27 Apr, 2018

1 commit

  • Now that we make sure we don't inject multiple instances of the
    same GICv2 SGI at the same time, we've made another bug more
    obvious:

    If we exit with an active SGI, we completely lose track of which
    vcpu it came from. On the next entry, we restore it with 0 as a
    source, and if that wasn't the right one, too bad. While this
    doesn't seem to trouble GIC-400, the architectural model gets
    offended and doesn't deactivate the interrupt on EOI.

    Another connected issue is that we will happilly make pending
    an interrupt from another vcpu, overriding the above zero with
    something that is just as inconsistent. Don't do that.

    The final issue is that we signal a maintenance interrupt when
    no pending interrupts are present in the LR. Assuming we've fixed
    the two issues above, we end-up in a situation where we keep
    exiting as soon as we've reached the active state, and not be
    able to inject the following pending.

    The fix comes in 3 parts:
    - GICv2 SGIs have their source vcpu saved if they are active on
    exit, and restored on entry
    - Multi-SGIs cannot go via the Pending+Active state, as this would
    corrupt the source field
    - Multi-SGIs are converted to using MI on EOI instead of NPIE

    Fixes: 16ca6a607d84bef0 ("KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid")
    Reported-by: Mark Rutland
    Tested-by: Mark Rutland
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Marc Zyngier
     

20 Apr, 2018

1 commit

  • Although we've implemented PSCI 0.1, 0.2 and 1.0, we expose either 0.1
    or 1.0 to a guest, defaulting to the latest version of the PSCI
    implementation that is compatible with the requested version. This is
    no different from doing a firmware upgrade on KVM.

    But in order to give a chance to hypothetical badly implemented guests
    that would have a fit by discovering something other than PSCI 0.2,
    let's provide a new API that allows userspace to pick one particular
    version of the API.

    This is implemented as a new class of "firmware" registers, where
    we expose the PSCI version. This allows the PSCI version to be
    save/restored as part of a guest migration, and also set to
    any supported version if the guest requires it.

    Cc: stable@vger.kernel.org #4.16
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Marc Zyngier
     

20 Mar, 2018

1 commit


19 Mar, 2018

2 commits

  • As we're about to change the way we map devices at HYP, we need
    to move away from kern_hyp_va on an IO address.

    One way of achieving this is to store the VAs in kvm_vgic_global_state,
    and use that directly from the HYP code. This requires a small change
    to create_hyp_io_mappings so that it can also return a HYP VA.

    We take this opportunity to nuke the vctrl_base field in the emulated
    distributor, as it is not used anymore.

    Acked-by: Catalin Marinas
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Marc Zyngier
     
  • There is really no need to store the vgic_elrsr on the VGIC data
    structures as the only need we have for the elrsr is to figure out if an
    LR is inactive when we save the VGIC state upon returning from the
    guest. We can might as well store this in a temporary local variable.

    Reviewed-by: Marc Zyngier
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     

15 Mar, 2018

1 commit

  • We currently don't allow resetting mapped IRQs from userspace, because
    their state is controlled by the hardware. But we do need to reset the
    state when the VM is reset, so we provide a function for the 'owner' of
    the mapped interrupt to reset the interrupt state.

    Currently only the timer uses mapped interrupts, so we call this
    function from the timer reset logic.

    Cc: stable@vger.kernel.org
    Fixes: 4c60e360d6df ("KVM: arm/arm64: Provide a get_input_level for the arch timer")
    Signed-off-by: Christoffer Dall
    Signed-off-by: Marc Zyngier

    Christoffer Dall
     

11 Feb, 2018

1 commit

  • Pull KVM updates from Radim Krčmář:
    "ARM:

    - icache invalidation optimizations, improving VM startup time

    - support for forwarded level-triggered interrupts, improving
    performance for timers and passthrough platform devices

    - a small fix for power-management notifiers, and some cosmetic
    changes

    PPC:

    - add MMIO emulation for vector loads and stores

    - allow HPT guests to run on a radix host on POWER9 v2.2 CPUs without
    requiring the complex thread synchronization of older CPU versions

    - improve the handling of escalation interrupts with the XIVE
    interrupt controller

    - support decrement register migration

    - various cleanups and bugfixes.

    s390:

    - Cornelia Huck passed maintainership to Janosch Frank

    - exitless interrupts for emulated devices

    - cleanup of cpuflag handling

    - kvm_stat counter improvements

    - VSIE improvements

    - mm cleanup

    x86:

    - hypervisor part of SEV

    - UMIP, RDPID, and MSR_SMI_COUNT emulation

    - paravirtualized TLB shootdown using the new KVM_VCPU_PREEMPTED bit

    - allow guests to see TOPOEXT, GFNI, VAES, VPCLMULQDQ, and more
    AVX512 features

    - show vcpu id in its anonymous inode name

    - many fixes and cleanups

    - per-VCPU MSR bitmaps (already merged through x86/pti branch)

    - stable KVM clock when nesting on Hyper-V (merged through
    x86/hyperv)"

    * tag 'kvm-4.16-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (197 commits)
    KVM: PPC: Book3S: Add MMIO emulation for VMX instructions
    KVM: PPC: Book3S HV: Branch inside feature section
    KVM: PPC: Book3S HV: Make HPT resizing work on POWER9
    KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code
    KVM: PPC: Book3S PR: Fix broken select due to misspelling
    KVM: x86: don't forget vcpu_put() in kvm_arch_vcpu_ioctl_set_sregs()
    KVM: PPC: Book3S PR: Fix svcpu copying with preemption enabled
    KVM: PPC: Book3S HV: Drop locks before reading guest memory
    kvm: x86: remove efer_reload entry in kvm_vcpu_stat
    KVM: x86: AMD Processor Topology Information
    x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
    kvm: embed vcpu id to dentry of vcpu anon inode
    kvm: Map PFN-type memory regions as writable (if possible)
    x86/kvm: Make it compile on 32bit and with HYPYERVISOR_GUEST=n
    KVM: arm/arm64: Fixup userspace irqchip static key optimization
    KVM: arm/arm64: Fix userspace_irqchip_in_use counting
    KVM: arm/arm64: Fix incorrect timer_is_pending logic
    MAINTAINERS: update KVM/s390 maintainers
    MAINTAINERS: add Halil as additional vfio-ccw maintainer
    MAINTAINERS: add David as a reviewer for KVM/s390
    ...

    Linus Torvalds
     

09 Feb, 2018

1 commit

  • Pull more arm64 updates from Catalin Marinas:
    "As I mentioned in the last pull request, there's a second batch of
    security updates for arm64 with mitigations for Spectre/v1 and an
    improved one for Spectre/v2 (via a newly defined firmware interface
    API).

    Spectre v1 mitigation:

    - back-end version of array_index_mask_nospec()

    - masking of the syscall number to restrict speculation through the
    syscall table

    - masking of __user pointers prior to deference in uaccess routines

    Spectre v2 mitigation update:

    - using the new firmware SMC calling convention specification update

    - removing the current PSCI GET_VERSION firmware call mitigation as
    vendors are deploying new SMCCC-capable firmware

    - additional branch predictor hardening for synchronous exceptions
    and interrupts while in user mode

    Meltdown v3 mitigation update:

    - Cavium Thunder X is unaffected but a hardware erratum gets in the
    way. The kernel now starts with the page tables mapped as global
    and switches to non-global if kpti needs to be enabled.

    Other:

    - Theoretical trylock bug fixed"

    * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (38 commits)
    arm64: Kill PSCI_GET_VERSION as a variant-2 workaround
    arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
    arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
    arm/arm64: smccc: Make function identifiers an unsigned quantity
    firmware/psci: Expose SMCCC version through psci_ops
    firmware/psci: Expose PSCI conduit
    arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
    arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
    arm/arm64: KVM: Turn kvm_psci_version into a static inline
    arm/arm64: KVM: Advertise SMCCC v1.1
    arm/arm64: KVM: Implement PSCI 1.0 support
    arm/arm64: KVM: Add smccc accessors to PSCI code
    arm/arm64: KVM: Add PSCI_VERSION helper
    arm/arm64: KVM: Consolidate the PSCI include files
    arm64: KVM: Increment PC after handling an SMC trap
    arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
    arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
    arm64: entry: Apply BP hardening for suspicious interrupts from EL0
    arm64: entry: Apply BP hardening for high-priority synchronous exceptions
    arm64: futex: Mask __user pointers prior to dereference
    ...

    Linus Torvalds
     

07 Feb, 2018

5 commits

  • We're about to need kvm_psci_version in HYP too. So let's turn it
    into a static inline, and pass the kvm structure as a second
    parameter (so that HYP can do a kern_hyp_va on it).

    Tested-by: Ard Biesheuvel
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier
    Signed-off-by: Catalin Marinas

    Marc Zyngier
     
  • The new SMC Calling Convention (v1.1) allows for a reduced overhead
    when calling into the firmware, and provides a new feature discovery
    mechanism.

    Make it visible to KVM guests.

    Tested-by: Ard Biesheuvel
    Reviewed-by: Christoffer Dall
    Signed-off-by: Marc Zyngier
    Signed-off-by: Catalin Marinas

    Marc Zyngier
     
  • PSCI 1.0 can be trivially implemented by providing the FEATURES
    call on top of PSCI 0.2 and returning 1.0 as the PSCI version.

    We happily ignore everything else, as they are either optional or
    are clarifications that do not require any additional change.

    PSCI 1.0 is now the default until we decide to add a userspace
    selection API.

    Reviewed-by: Christoffer Dall
    Tested-by: Ard Biesheuvel
    Signed-off-by: Marc Zyngier
    Signed-off-by: Catalin Marinas

    Marc Zyngier
     
  • As we're about to trigger a PSCI version explosion, it doesn't
    hurt to introduce a PSCI_VERSION helper that is going to be
    used everywhere.

    Reviewed-by: Christoffer Dall
    Tested-by: Ard Biesheuvel
    Signed-off-by: Marc Zyngier
    Signed-off-by: Catalin Marinas

    Marc Zyngier
     
  • As we're about to update the PSCI support, and because I'm lazy,
    let's move the PSCI include file to include/kvm so that both
    ARM architectures can find it.

    Acked-by: Christoffer Dall
    Tested-by: Ard Biesheuvel
    Signed-off-by: Marc Zyngier
    Signed-off-by: Catalin Marinas

    Marc Zyngier