From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 89520EB64DB for ; Thu, 15 Jun 2023 12:39:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Subject:Cc:To:From:Message-ID:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=JbMjiJRWyF+gQrzM/lLbn56QDsh8ypb29ts8AdGS0Ro=; b=hfwFpsMywlsXN0 f0cz8ihMlzyaIdIwzP9gtP3VCxf6dS9lOMJUJORawzyfG9ucjYmodA7A9e2HQ8mxR9NXgdDsNNA+q 9nxu5MYN86CWar91sl38X6LfuejqPDidD46QeJ6F/irc/qkae120Y8Z7keISB79Ju1aQZJrntDlsI VQ8490uNTBSCeMoxVExXENGkw/gmVpp6EZjaaclaiacUvpYr7ZuyI6n0EDVQyWaKDEldzt5beln0c ugIOorvxWgQjLPKn12xSC6Wl/MpWt0Vg1k3LZm5+LPE63NgI90g2w//MmJXngX9BioIRI9Gj/mPEN zAP3kf0evW6TqJwgcMOQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1q9mFO-00EuRh-0c; Thu, 15 Jun 2023 12:38:42 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1q9mFK-00EuR2-1B for linux-arm-kernel@lists.infradead.org; Thu, 15 Jun 2023 12:38:40 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 81CE3625CE; Thu, 15 Jun 2023 12:38:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1B83C433C8; Thu, 15 Jun 2023 12:38:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1686832716; bh=9s81qADenelpJjGK0nMIEOy4qlmfbd05sm3W6q919EI=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=XATEo4+7tn+4iRZ/jjUM6qoZtSAEqJnuRhBjI1DN8xtvg1MZgRoOLATNZXgtsAZHA pz1YN3m6W2yoyCrC9JIbTpHMfohHo5/qs/WlFAoDuD/ymybG54OfC5uRFQwPtEb0ys 5vsJ/gQ/NzpQmNG7PHRBEjI6AquVjNsr74JoGJp5scYd0OzZNJGHxyrYoEu4wgyHHG z/Jj5OuIdH4ntPyUPzrwbeXd5o7VjIj01YcO3Kq6M6u+RIE6ZMz1gG12xH+FkUx4fB KOWp0L+F/Gyrrwyuj4kUkzeXwe02WXGC/6RcP0Ps+OzcAzbMOse/d5bbIPQk+VtHKt EtrudhNvvusVw== Received: from [213.175.39.66] (helo=wait-a-minute.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1q9mFG-005bYc-8v; Thu, 15 Jun 2023 13:38:34 +0100 Date: Thu, 15 Jun 2023 13:38:34 +0100 Message-ID: <878rckrjcl.wl-maz@kernel.org> From: Marc Zyngier To: Oliver Upton Cc: kvmarm@lists.linux.dev, James Morse , Suzuki K Poulose , Zenghui Yu , Will Deacon , Catalin Marinas , Fuad Tabba , linux-arm-kernel@lists.infradead.org, surajjs@amazon.com, Cornelia Huck , Shameerali Kolothum Thodi , Jing Zhang Subject: Re: [PATCH v12 07/11] KVM: arm64: Use arm64_ftr_bits to sanitise ID register writes In-Reply-To: <20230609190054.1542113-8-oliver.upton@linux.dev> References: <20230609190054.1542113-1-oliver.upton@linux.dev> <20230609190054.1542113-8-oliver.upton@linux.dev> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/28.2 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-SA-Exim-Connect-IP: 213.175.39.66 X-SA-Exim-Rcpt-To: oliver.upton@linux.dev, kvmarm@lists.linux.dev, james.morse@arm.com, suzuki.poulose@arm.com, yuzenghui@huawei.com, will@kernel.org, catalin.marinas@arm.com, tabba@google.com, linux-arm-kernel@lists.infradead.org, surajjs@amazon.com, cohuck@redhat.com, shameerali.kolothum.thodi@huawei.com, jingzhangos@google.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230615_053838_478175_5FBB92DA X-CRM114-Status: GOOD ( 40.56 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Oliver, On Fri, 09 Jun 2023 20:00:50 +0100, Oliver Upton wrote: > > From: Jing Zhang > > Rather than reinventing the wheel in KVM to do ID register sanitisation > we can rely on the work already done in the core kernel. Implement a > generalized sanitisation of ID registers based on the combination of the > arm64_ftr_bits definitions from the core kernel and (optionally) a set > of KVM-specific overrides. > > This all amounts to absolutely nothing for now, but will be used in > subsequent changes to realize user-configurable ID registers. > > Signed-off-by: Jing Zhang > [Oliver: split off from monster patch, rewrote commit description, > reworked RAZ handling] > Signed-off-by: Oliver Upton > --- > arch/arm64/include/asm/cpufeature.h | 1 + > arch/arm64/kernel/cpufeature.c | 2 +- > arch/arm64/kvm/sys_regs.c | 113 +++++++++++++++++++++++++++- > 3 files changed, 111 insertions(+), 5 deletions(-) > > diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h > index 6bf013fb110d..dc769c2eb7a4 100644 > --- a/arch/arm64/include/asm/cpufeature.h > +++ b/arch/arm64/include/asm/cpufeature.h > @@ -915,6 +915,7 @@ static inline unsigned int get_vmid_bits(u64 mmfr1) > return 8; > } > > +s64 arm64_ftr_safe_value(const struct arm64_ftr_bits *ftrp, s64 new, s64 cur); > struct arm64_ftr_reg *get_arm64_ftr_reg(u32 sys_id); > > extern struct arm64_ftr_override id_aa64mmfr1_override; > diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c > index 7d7128c65161..3317a7b6deac 100644 > --- a/arch/arm64/kernel/cpufeature.c > +++ b/arch/arm64/kernel/cpufeature.c > @@ -798,7 +798,7 @@ static u64 arm64_ftr_set_value(const struct arm64_ftr_bits *ftrp, s64 reg, > return reg; > } > > -static s64 arm64_ftr_safe_value(const struct arm64_ftr_bits *ftrp, s64 new, > +s64 arm64_ftr_safe_value(const struct arm64_ftr_bits *ftrp, s64 new, > s64 cur) > { > s64 ret = 0; > diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c > index 3015c860deca..0fbdb6ef68e4 100644 > --- a/arch/arm64/kvm/sys_regs.c > +++ b/arch/arm64/kvm/sys_regs.c > @@ -1201,6 +1201,91 @@ static u8 vcpu_pmuver(const struct kvm_vcpu *vcpu) > return 0; > } > > +static s64 kvm_arm64_ftr_safe_value(u32 id, const struct arm64_ftr_bits *ftrp, > + s64 new, s64 cur) > +{ > + struct arm64_ftr_bits kvm_ftr = *ftrp; > + > + /* Some features have different safe value type in KVM than host features */ > + switch (id) { > + case SYS_ID_AA64DFR0_EL1: > + if (kvm_ftr.shift == ID_AA64DFR0_EL1_PMUVer_SHIFT) > + kvm_ftr.type = FTR_LOWER_SAFE; > + break; > + case SYS_ID_DFR0_EL1: > + if (kvm_ftr.shift == ID_DFR0_EL1_PerfMon_SHIFT) > + kvm_ftr.type = FTR_LOWER_SAFE; > + break; > + } > + > + return arm64_ftr_safe_value(&kvm_ftr, new, cur); > +} > + > +/** > + * arm64_check_features() - Check if a feature register value constitutes > + * a subset of features indicated by the idreg's KVM sanitised limit. > + * > + * This function will check if each feature field of @val is the "safe" value > + * against idreg's KVM sanitised limit return from reset() callback. > + * If a field value in @val is the same as the one in limit, it is always > + * considered the safe value regardless For register fields that are not in > + * writable, only the value in limit is considered the safe value. > + * > + * Return: 0 if all the fields are safe. Otherwise, return negative errno. > + */ > +static int arm64_check_features(struct kvm_vcpu *vcpu, > + const struct sys_reg_desc *rd, > + u64 val) > +{ > + const struct arm64_ftr_reg *ftr_reg; > + const struct arm64_ftr_bits *ftrp = NULL; > + u32 id = reg_to_encoding(rd); > + u64 writable_mask = rd->val; > + u64 limit = rd->reset(vcpu, rd); > + u64 mask = 0; > + > + /* > + * Hidden and unallocated ID registers may not have a corresponding > + * struct arm64_ftr_reg. Of course, if the register is RAZ we know the > + * only safe value is 0. > + */ > + if (sysreg_visible_as_raz(vcpu, rd)) > + return val ? -E2BIG : 0; This -E2BIG is certainly reflecting the error here. However... > + > + ftr_reg = get_arm64_ftr_reg(id); > + if (!ftr_reg) > + return -EINVAL; > + > + ftrp = ftr_reg->ftr_bits; > + > + for (; ftrp && ftrp->width; ftrp++) { > + s64 f_val, f_lim, safe_val; > + u64 ftr_mask; > + > + ftr_mask = arm64_ftr_mask(ftrp); > + if ((ftr_mask & writable_mask) != ftr_mask) > + continue; > + > + f_val = arm64_ftr_value(ftrp, val); > + f_lim = arm64_ftr_value(ftrp, limit); > + mask |= ftr_mask; > + > + if (f_val == f_lim) > + safe_val = f_val; > + else > + safe_val = kvm_arm64_ftr_safe_value(id, ftrp, f_val, f_lim); > + > + if (safe_val != f_val) > + return -E2BIG; > + } > + > + /* For fields that are not writable, values in limit are the safe values. */ > + if ((val & ~mask) != (limit & ~mask)) > + return -E2BIG; > + > + return 0; > +} > + > static u8 perfmon_to_pmuver(u8 perfmon) > { > switch (perfmon) { > @@ -1528,11 +1613,31 @@ static int get_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, > static int set_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, > u64 val) > { > - /* This is what we mean by invariant: you can't change it. */ > - if (val != read_id_reg(vcpu, rd)) > - return -EINVAL; > + u32 id = reg_to_encoding(rd); > + int ret; > > - return 0; > + mutex_lock(&vcpu->kvm->arch.config_lock); > + > + /* > + * Once the VM has started the ID registers are immutable. Reject any > + * write that does not match the final register value. > + */ > + if (kvm_vm_has_ran_once(vcpu->kvm)) { > + if (val != read_id_reg(vcpu, rd)) > + ret = -EBUSY; > + else > + ret = 0; > + > + mutex_unlock(&vcpu->kvm->arch.config_lock); > + return ret; > + } > + > + ret = arm64_check_features(vcpu, rd, val); > + if (!ret) > + IDREG(vcpu->kvm, id) = val; > + > + mutex_unlock(&vcpu->kvm->arch.config_lock); > + return ret; ... we now end-up with a *new* error code that userspace was never able to see so far. This may not be a big deal, but I'd rather err on the side of caution by keeping the current, slightly less precise error code. Thoughts? M. -- Without deviation from the norm, progress is not possible. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel