KVM: arm64: Ensure that SME controls are disabled in protected mode

KVM (and pKVM) do not support SME guests. Therefore KVM ensures
that the host's SME state is flushed and that SME controls for
enabling access to ZA storage and for streaming are disabled.

pKVM needs to protect against a buggy/malicious host. Ensure that
it wouldn't run a guest when protected mode is enabled should any
of the SME controls be enabled.

Signed-off-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20240603122852.3923848-10-tabba@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c
index eb21f29d91fc5ebae4f0fc26e768063b55fbba7b..521b32868d0d26e7ea802b918aea55cdb407f761 100644 (file)
--- a/arch/arm64/kvm/fpsimd.c
+++ b/arch/arm64/kvm/fpsimd.c
@@ -90,6 +90,13 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu)
                        fpsimd_save_and_flush_cpu_state();
                }
        }
+
+       /*
+        * If normal guests gain SME support, maintain this behavior for pKVM
+        * guests, which don't support SME.
+        */
+       WARN_ON(is_protected_kvm_enabled() && system_supports_sme() &&
+               read_sysreg_s(SYS_SVCR));
 }
 
 /*

diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index bd93b8a9e17261e991400f3f4e048684a3234c9b..f43d845f3c4ecdc41c1c661f8bbbb8165678897b 100644 (file)
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -140,6 +140,17 @@ static void handle___kvm_vcpu_run(struct kvm_cpu_context *host_ctxt)
                struct pkvm_hyp_vcpu *hyp_vcpu;
                struct kvm *host_kvm;
 
+               /*
+                * KVM (and pKVM) doesn't support SME guests for now, and
+                * ensures that SME features aren't enabled in pstate when
+                * loading a vcpu. Therefore, if SME features enabled the host
+                * is misbehaving.
+                */
+               if (unlikely(system_supports_sme() && read_sysreg_s(SYS_SVCR))) {
+                       ret = -EINVAL;
+                       goto out;
+               }
+
                host_kvm = kern_hyp_va(host_vcpu->kvm);
                hyp_vcpu = pkvm_load_hyp_vcpu(host_kvm->arch.pkvm.handle,
                                              host_vcpu->vcpu_idx);