lkml.org 
[lkml]   [2018]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 072/202] [Variant 2/Spectre-v2] arm64: KVM: Increment PC after handling an SMC trap
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Marc Zyngier <marc.zyngier@arm.com>


    Commit f5115e8869e1 upstream.

    When handling an SMC trap, the "preferred return address" is set
    to that of the SMC, and not the next PC (which is a departure from
    the behaviour of an SMC that isn't trapped).

    Increment PC in the handler, as the guest is otherwise forever
    stuck...

    Cc: stable@vger.kernel.org
    Fixes: acfb3b883f6d ("arm64: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls")
    Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
    Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/arm64/kvm/handle_exit.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    --- a/arch/arm64/kvm/handle_exit.c
    +++ b/arch/arm64/kvm/handle_exit.c
    @@ -54,7 +54,16 @@ static int handle_hvc(struct kvm_vcpu *v

    static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run)
    {
    + /*
    + * "If an SMC instruction executed at Non-secure EL1 is
    + * trapped to EL2 because HCR_EL2.TSC is 1, the exception is a
    + * Trap exception, not a Secure Monitor Call exception [...]"
    + *
    + * We need to advance the PC after the trap, as it would
    + * otherwise return to the same address...
    + */
    vcpu_set_reg(vcpu, 0, ~0UL);
    + kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
    return 1;
    }


    \
     
     \ /
      Last update: 2018-02-15 17:34    [W:4.122 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site