From: Fuad Tabba <tabba@google.com>
To: kvmarm@lists.linux.dev
Cc: maz@kernel.org, oliver.upton@linux.dev, broonie@kernel.org,
james.morse@arm.com, suzuki.poulose@arm.com,
yuzenghui@huawei.com, catalin.marinas@arm.com, will@kernel.org,
eric.auger@redhat.com, jingzhangos@google.com,
joey.gouly@arm.com, tabba@google.com,
linux-arm-kernel@lists.infradead.org
Subject: [PATCH v3 16/17] KVM: arm64: Mark PAuth as a restricted feature for protected VMs
Date: Thu, 14 Dec 2023 10:01:56 +0000 [thread overview]
Message-ID: <20231214100158.2305400-17-tabba@google.com> (raw)
In-Reply-To: <20231214100158.2305400-1-tabba@google.com>
Protected VMs will only support basic PAuth (FEAT_PAuth). Mark it
as restricted to ensure that later versions aren't supported for
protected guests.
Signed-off-by: Fuad Tabba <tabba@google.com>
---
arch/arm64/kvm/hyp/include/nvhe/fixed_config.h | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h b/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h
index 8d97dff4bb7b..51f043649146 100644
--- a/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h
+++ b/arch/arm64/kvm/hyp/include/nvhe/fixed_config.h
@@ -184,10 +184,18 @@
ARM64_FEATURE_MASK(ID_AA64ISAR0_EL1_RNDR) \
)
+/* Restrict pointer authentication to the basic version. */
+#define PVM_ID_AA64ISAR1_RESTRICT_UNSIGNED (\
+ FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_APA), ID_AA64ISAR1_EL1_APA_PAuth) | \
+ FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_API), ID_AA64ISAR1_EL1_API_PAuth) \
+ )
+
+#define PVM_ID_AA64ISAR2_RESTRICT_UNSIGNED (\
+ FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_APA3), ID_AA64ISAR2_EL1_APA3_PAuth) \
+ )
+
#define PVM_ID_AA64ISAR1_ALLOW (\
ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_DPB) | \
- ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_APA) | \
- ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_API) | \
ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_JSCVT) | \
ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_FCMA) | \
ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_LRCPC) | \
@@ -202,8 +210,8 @@
)
#define PVM_ID_AA64ISAR2_ALLOW (\
+ ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_ATS1A)| \
ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_GPA3) | \
- ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_APA3) | \
ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_MOPS) \
)
--
2.43.0.472.g3155946c3a-goog
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2023-12-14 11:17 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-14 10:01 [PATCH v3 00/17] KVM: arm64: Fixes to fine grain traps and pKVM traps Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 01/17] arm64/sysreg: Add missing Pauth_LR field definitions to ID_AA64ISAR1_EL1 Fuad Tabba
2023-12-14 10:42 ` Mark Brown
2023-12-14 10:49 ` Mark Brown
2023-12-14 10:01 ` [PATCH v3 02/17] arm64/sysreg: Add missing ExtTrcBuff field definition to ID_AA64DFR0_EL1 Fuad Tabba
2023-12-14 10:46 ` Mark Brown
2023-12-14 10:01 ` [PATCH v3 03/17] arm64/sysreg: Add missing system register definitions for FGT Fuad Tabba
2023-12-14 10:50 ` Mark Brown
2023-12-14 10:01 ` [PATCH v3 04/17] arm64/sysreg: Add missing system instruction " Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 05/17] KVM: arm64: Explicitly trap unsupported HFGxTR_EL2 features Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 06/17] KVM: arm64: Add missing HFGxTR_EL2 FGT entries to nested virt Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 07/17] KVM: arm64: Add missing HFGITR_EL2 " Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 08/17] KVM: arm64: Add bit masks for HAFGRTR_EL2 Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 09/17] KVM: arm64: Handle HAFGRTR_EL2 trapping in nested virt Fuad Tabba
2023-12-15 13:43 ` Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 10/17] KVM: arm64: Update and fix FGT register masks Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 11/17] KVM: arm64: Add build validation for FGT trap mask values Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 12/17] KVM: arm64: Use generated FGT RES0 bits instead of specifying them Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 13/17] KVM: arm64: Define FGT nMASK bits relative to other fields Fuad Tabba
2023-12-18 9:07 ` Marc Zyngier
2023-12-18 9:16 ` Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 14/17] KVM: arm64: Macros for setting/clearing FGT bits Fuad Tabba
2023-12-15 13:45 ` Fuad Tabba
2023-12-18 9:40 ` Marc Zyngier
2023-12-18 9:56 ` Fuad Tabba
2023-12-18 11:12 ` Marc Zyngier
2023-12-18 11:17 ` Fuad Tabba
2023-12-18 12:25 ` Marc Zyngier
2023-12-18 12:30 ` Fuad Tabba
2023-12-14 10:01 ` [PATCH v3 15/17] KVM: arm64: Fix which features are marked as allowed for protected VMs Fuad Tabba
2023-12-14 10:01 ` Fuad Tabba [this message]
2023-12-14 10:01 ` [PATCH v3 17/17] KVM: arm64: Trap external trace " Fuad Tabba
2023-12-17 13:41 ` [PATCH v3 00/17] KVM: arm64: Fixes to fine grain traps and pKVM traps Will Deacon
2023-12-18 17:11 ` (subset) " Marc Zyngier
2023-12-18 17:15 ` Fuad Tabba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231214100158.2305400-17-tabba@google.com \
--to=tabba@google.com \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=eric.auger@redhat.com \
--cc=james.morse@arm.com \
--cc=jingzhangos@google.com \
--cc=joey.gouly@arm.com \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=maz@kernel.org \
--cc=oliver.upton@linux.dev \
--cc=suzuki.poulose@arm.com \
--cc=will@kernel.org \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox