From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9897CC3E8C5 for ; Fri, 27 Nov 2020 17:15:29 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 50F9622242 for ; Fri, 27 Nov 2020 17:15:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="JLFjIdpr"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="PZh/9V5L" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 50F9622242 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Type: Content-Transfer-Encoding:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Message-ID:References:In-Reply-To:Subject:To:From: Date:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=qbR83eCzBgaviyAGgReqX8tAwHycRgvHZrjnDk6Q4/w=; b=JLFjIdprbUlXkziM6h2mGDV1N rN/g0mgdzwd3Wp+vRic2Frvf8CbZIDuQnKcb6LDFfXpJYdFqgAM4mwe4H6HbSMv/KVvj5Ad13wQN3 +YrCGpnbQwWhQS1h8v9KLg/D3sbxHGrbAcKBQilqbfxr/dhy5sL9R5V7ZzwDJpxXGAsSzz6rWJo7I LxsKWgIIt2w0Ho0S4jCLzKda4hOnm/HvigKSm9Zpzixg1AUGSDazmFo8OIHSEvxJu1j3FIvsSKt3q BOuYGaqYB4Y/XTCOlyy2KsbXSx5ZlcF2PzaVfT+T4zvyQsRegYZR+OoDhXVJ8nLoNVEAlKQV7X1ZE F49vJYR8g==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kihK7-00071b-1T; Fri, 27 Nov 2020 17:14:19 +0000 Received: from mail.kernel.org ([198.145.29.99]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kihK3-00070c-Oe for linux-arm-kernel@lists.infradead.org; Fri, 27 Nov 2020 17:14:16 +0000 Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 57490221EB; Fri, 27 Nov 2020 17:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1606497254; bh=tWBrsQAV0dVK6FFIiWA7bl7RIx2UuTl5wZD4vgMjKfw=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=PZh/9V5LjXhxcgHdYZjEjrlc6/fzCy2+1KDzfiQtymlnX9gJlq8hFqrH/053xA6Gz 52oonsz6RSsVxU2uQ7o4ZHhevVwmWpYb+jHcexgQdxKqMmJFe08OAmKOcLtR1jhqVY K2YdLf3VT4ue93dSx7hXcr1mq1sZ8sUL16yImbv8= Received: from disco-boy.misterjones.org ([51.254.78.96] helo=www.loen.fr) by disco-boy.misterjones.org with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1kihJz-00E7Sw-V0; Fri, 27 Nov 2020 17:14:12 +0000 MIME-Version: 1.0 Date: Fri, 27 Nov 2020 17:14:11 +0000 From: Marc Zyngier To: Will Deacon Subject: Re: [PATCH v4 03/14] KVM: arm64: Kill 32-bit vCPUs on systems with mismatched EL0 support In-Reply-To: <20201127115304.GB20564@willie-the-truck> References: <20201124155039.13804-1-will@kernel.org> <20201124155039.13804-4-will@kernel.org> <9bd06b193e7fb859a1207bb1302b7597@kernel.org> <20201127115304.GB20564@willie-the-truck> User-Agent: Roundcube Webmail/1.4.9 Message-ID: <583c4074bbd4cf8b8085037745a5d1c0@kernel.org> X-Sender: maz@kernel.org X-SA-Exim-Connect-IP: 51.254.78.96 X-SA-Exim-Rcpt-To: will@kernel.org, linux-arm-kernel@lists.infradead.org, linux-arch@vger.kernel.org, linux-kernel@vger.kernel.org, catalin.marinas@arm.com, gregkh@linuxfoundation.org, peterz@infradead.org, morten.rasmussen@arm.com, qais.yousef@arm.com, surenb@google.com, qperret@google.com, tj@kernel.org, lizefan@huawei.com, hannes@cmpxchg.org, mingo@redhat.com, juri.lelli@redhat.com, vincent.guittot@linaro.org, kernel-team@android.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201127_121416_010532_D8A7B341 X-CRM114-Status: GOOD ( 32.88 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-arch@vger.kernel.org, Juri Lelli , kernel-team@android.com, Vincent Guittot , Quentin Perret , Peter Zijlstra , Catalin Marinas , Johannes Weiner , linux-kernel@vger.kernel.org, Qais Yousef , Ingo Molnar , Li Zefan , Greg Kroah-Hartman , Tejun Heo , Suren Baghdasaryan , Morten Rasmussen , linux-arm-kernel@lists.infradead.org Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 2020-11-27 11:53, Will Deacon wrote: > On Fri, Nov 27, 2020 at 10:26:47AM +0000, Marc Zyngier wrote: >> On 2020-11-24 15:50, Will Deacon wrote: >> > If a vCPU is caught running 32-bit code on a system with mismatched >> > support at EL0, then we should kill it. >> > >> > Acked-by: Marc Zyngier >> > Signed-off-by: Will Deacon >> > --- >> > arch/arm64/kvm/arm.c | 11 ++++++++++- >> > 1 file changed, 10 insertions(+), 1 deletion(-) >> > >> > diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c >> > index 5750ec34960e..d322ac0f4a8e 100644 >> > --- a/arch/arm64/kvm/arm.c >> > +++ b/arch/arm64/kvm/arm.c >> > @@ -633,6 +633,15 @@ static void check_vcpu_requests(struct kvm_vcpu >> > *vcpu) >> > } >> > } >> > >> > +static bool vcpu_mode_is_bad_32bit(struct kvm_vcpu *vcpu) >> > +{ >> > + if (likely(!vcpu_mode_is_32bit(vcpu))) >> > + return false; >> > + >> > + return !system_supports_32bit_el0() || >> > + static_branch_unlikely(&arm64_mismatched_32bit_el0); >> > +} >> > + >> > /** >> > * kvm_arch_vcpu_ioctl_run - the main VCPU run function to execute >> > guest code >> > * @vcpu: The VCPU pointer >> > @@ -816,7 +825,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) >> > * with the asymmetric AArch32 case), return to userspace with >> > * a fatal error. >> > */ >> > - if (!system_supports_32bit_el0() && vcpu_mode_is_32bit(vcpu)) { >> > + if (vcpu_mode_is_bad_32bit(vcpu)) { >> > /* >> > * As we have caught the guest red-handed, decide that >> > * it isn't fit for purpose anymore by making the vcpu >> >> Given the new definition of system_supports_32bit_el0() in the >> previous >> patch, >> why do we need this patch at all? > > I think the check is still needed, as this is an unusual case where we > want to reject the mismatched system. For example, imagine > 'arm64_mismatched_32bit_el0' is true and we're on a mismatched system: > in > this case system_supports_32bit_el0() will return 'true' because we > allow 32-bit applications to run, we support the 32-bit personality > etc. > > However, we still want to terminate 32-bit vCPUs if we spot them in > this > situation, so we have to check for: > > !system_supports_32bit_el0() || > static_branch_unlikely(&arm64_mismatched_32bit_el0) > > so that we only allow 32-bit vCPUs when all of the physical CPUs > support > it at EL0. > > I could make this clearer either by adding a comment, or avoiding > system_supports_32bit_el0() entirely here and just checking the > sanitised SYS_ID_AA64PFR0_EL1 register directly instead. > > What do you prefer? Yeah, the sanitized read feels better, if only because that is what we are going to read in all the valid cases, unfortunately. read_sanitised_ftr_reg() is sadly not designed to be called on a fast path, meaning that 32bit guests will do a bsearch() on the ID-regs every time they exit... I guess we will have to evaluate how much we loose with this. Thanks, M. -- Jazz is not dead. It just smells funny... _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel