[PATCH 1/3] KVM: arm64: Stop writing aarch32's CSSELR into ACTLR

[PATCH 1/3] KVM: arm64: Stop writing aarch32's CSSELR into ACTLR

[James Morse]

aarch32 has pairs of registers to access the high and low parts of 64bit
registers. KVM has a union of 64bit sys_regs[] and 32bit copro[]. The
32bit accessors read the high or low part of the 64bit sys_reg[] value
through the union.

Both sys_reg_descs[] and cp15_regs[] list access_csselr() as the accessor
for CSSELR{,_EL1}. access_csselr() is only aware of the 64bit sys_regs[],
and expects r->reg to be 'CSSELR_EL1' in the enum, index 2 of the 64bit
array.

cp15_regs[] uses the 32bit copro[] alias of sys_regs[]. Here CSSELR is
c0_CSSELR which is the same location in sys_reg[]. r->reg is 'c0_CSSELR',
index 4 in the 32bit array.

access_csselr() uses the 32bit r->reg value to access the 64bit array,
so reads and write the wrong value. sys_regs[4], is ACTLR_EL1, which
is subsequently save/restored when we enter the guest.

ACTLR_EL1 is supposed to be read-only for the guest. This register
only affects execution at EL1, and the host's value is restored before
we return to host EL1.

Rename access_csselr() to access_csselr_el1(), to indicate it expects
the 64bit register index, and pass it CSSELR_EL1 from cp15_regs[].

Cc: stable@vger.kernel.org
Signed-off-by: James Morse <james.morse@arm.com>
----
Providing access_csselr_cp15() wouldn't work as with VHE CSSELR_EL1 is
loaded on the CPU while this code runs. access_csselr_cp15() would have
to map it back the 64bit resgister to use vcpu_write_sys_reg(). We may
as well do it in the table.

 arch/arm64/kvm/sys_regs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 51db934702b6..2eda539f3281 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1302,7 +1302,7 @@ static bool access_clidr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
 	return true;
 }
 
-static bool access_csselr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+static bool access_csselr_el1(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
 			  const struct sys_reg_desc *r)
 {
 	if (p->is_write)
@@ -1566,7 +1566,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
 
 	{ SYS_DESC(SYS_CCSIDR_EL1), access_ccsidr },
 	{ SYS_DESC(SYS_CLIDR_EL1), access_clidr },
-	{ SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
+	{ SYS_DESC(SYS_CSSELR_EL1), access_csselr_el1, reset_unknown, CSSELR_EL1 },
 	{ SYS_DESC(SYS_CTR_EL0), access_ctr },
 
 	{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
@@ -2060,7 +2060,7 @@ static const struct sys_reg_desc cp15_regs[] = {
 
 	{ Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
 	{ Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
-	{ Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, c0_CSSELR },
+	{ Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr_el1, NULL, CSSELR_EL1 },
 };
 
 static const struct sys_reg_desc cp15_64_regs[] = {
-- 
2.20.1

Re: [PATCH 1/3] KVM: arm64: Stop writing aarch32's CSSELR into ACTLR

[Sasha Levin]

Hi

[This is an automated email]

This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: all

The bot has tested the following trees: v5.6.14, v5.4.42, v4.19.124, v4.14.181, v4.9.224, v4.4.224.

v5.6.14: Build OK!
v5.4.42: Build OK!
v4.19.124: Failed to apply! Possible dependencies:
    f7f2b15c3d42 ("arm64: KVM: Expose sanitised cache type register to guest")

v4.14.181: Failed to apply! Possible dependencies:
    005781be127f ("arm64: KVM: Move CPU ID reg trap setup off the world switch path")
    93390c0a1b20 ("arm64: KVM: Hide unsupported AArch64 CPU features from guests")
    f7f2b15c3d42 ("arm64: KVM: Expose sanitised cache type register to guest")

v4.9.224: Failed to apply! Possible dependencies:
    005781be127f ("arm64: KVM: Move CPU ID reg trap setup off the world switch path")
    016f98afd050 ("irqchip/gic-v3: Use nops macro for Cavium ThunderX erratum 23154")
    0d449541c185 ("KVM: arm64: use common invariant sysreg definitions")
    0e9884fe63c6 ("arm64: sysreg: subsume GICv3 sysreg definitions")
    14ae7518dd55 ("arm64: sysreg: add register encodings used by KVM")
    47863d41ecf8 ("arm64: sysreg: sort by encoding")
    82e0191a1aa1 ("arm64: Support systems without FP/ASIMD")
    851050a573e1 ("KVM: arm64: Use common sysreg definitions")
    93390c0a1b20 ("arm64: KVM: Hide unsupported AArch64 CPU features from guests")
    bca8f17f57bd ("arm64: Get rid of asm/opcodes.h")
    c7a3c61fc606 ("arm64: sysreg: add performance monitor registers")
    c9a3c58f01fb ("KVM: arm64: Add the EL1 physical timer access handler")
    cd9e1927a525 ("arm64: Work around broken .inst when defective gas is detected")
    f7f2b15c3d42 ("arm64: KVM: Expose sanitised cache type register to guest")

v4.4.224: Failed to apply! Possible dependencies:
    005781be127f ("arm64: KVM: Move CPU ID reg trap setup off the world switch path")
    06282fd2c2bf ("arm64: KVM: Implement vgic-v2 save/restore")
    068a17a5805d ("arm64: mm: create new fine-grained mappings at boot")
    072f0a633838 ("arm64: Introduce raw_{d,i}cache_line_size")
    0a28714c53fd ("arm64: Use PoU cache instr for I/D coherency")
    116c81f427ff ("arm64: Work around systems with mismatched cache line sizes")
    1431af367e52 ("arm64: KVM: Implement timer save/restore")
    157962f5a8f2 ("arm64: decouple early fixmap init from linear mapping")
    1e48ef7fcc37 ("arm64: add support for building vmlinux as a relocatable PIE binary")
    2a803c4db615 ("arm64: head.S: use memset to clear BSS")
    57f4959bad0a ("arm64: kernel: Add support for User Access Override")
    6d6ec20fcf28 ("arm64: KVM: Implement system register save/restore")
    7b7293ae3dbd ("arm64: Fold proc-macros.S into assembler.h")
    82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk")
    82e0191a1aa1 ("arm64: Support systems without FP/ASIMD")
    8eb992674c9e ("arm64: KVM: Implement debug save/restore")
    910917bb7db0 ("arm64: KVM: Map the kernel RO section into HYP")
    93390c0a1b20 ("arm64: KVM: Hide unsupported AArch64 CPU features from guests")
    9e8e865bbe29 ("arm64: unify idmap removal")
    a0bf9776cd0b ("arm64: kvm: deal with kernel symbols outside of linear mapping")
    a7f8de168ace ("arm64: allow kernel Image to be loaded anywhere in physical memory")
    ab893fb9f1b1 ("arm64: introduce KIMAGE_VADDR as the virtual base of the kernel region")
    adc9b2dfd009 ("arm64: kernel: Rework finisher callback out of __cpu_suspend_enter()")
    b3122023df93 ("arm64: Fix an enum typo in mm/dump.c")
    b97b66c14b96 ("arm64: KVM: Implement guest entry")
    be901e9b15cd ("arm64: KVM: Implement the core world switch")
    c1a88e9124a4 ("arm64: kasan: avoid TLB conflicts")
    c76a0a6695c6 ("arm64: KVM: Add a HYP-specific header file")
    d5370f754875 ("arm64: prefetch: add alternative pattern for CPUs without a prefetcher")
    f68d2b1b73cc ("arm64: KVM: Implement vgic-v3 save/restore")
    f7f2b15c3d42 ("arm64: KVM: Expose sanitised cache type register to guest")
    f80fb3a3d508 ("arm64: add support for kernel ASLR")
    f9040773b7bb ("arm64: move kernel image to base of vmalloc area")
    fd045f6cd98e ("arm64: add support for module PLTs")


NOTE: The patch will not be queued to stable trees until it is upstream.

How should we proceed with this patch?

-- 
Thanks
Sasha

Re: [PATCH 1/3] KVM: arm64: Stop writing aarch32's CSSELR into ACTLR

[Marc Zyngier]

Hi James,

On 2020-05-26 17:18, James Morse wrote:
> aarch32 has pairs of registers to access the high and low parts of 
> 64bit
> registers. KVM has a union of 64bit sys_regs[] and 32bit copro[]. The
> 32bit accessors read the high or low part of the 64bit sys_reg[] value
> through the union.
> 
> Both sys_reg_descs[] and cp15_regs[] list access_csselr() as the 
> accessor
> for CSSELR{,_EL1}. access_csselr() is only aware of the 64bit 
> sys_regs[],
> and expects r->reg to be 'CSSELR_EL1' in the enum, index 2 of the 64bit
> array.
> 
> cp15_regs[] uses the 32bit copro[] alias of sys_regs[]. Here CSSELR is
> c0_CSSELR which is the same location in sys_reg[]. r->reg is 
> 'c0_CSSELR',
> index 4 in the 32bit array.
> 
> access_csselr() uses the 32bit r->reg value to access the 64bit array,
> so reads and write the wrong value. sys_regs[4], is ACTLR_EL1, which
> is subsequently save/restored when we enter the guest.

Huhuh... Nice catch.

> 
> ACTLR_EL1 is supposed to be read-only for the guest. This register
> only affects execution at EL1, and the host's value is restored before
> we return to host EL1.
> 
> Rename access_csselr() to access_csselr_el1(), to indicate it expects
> the 64bit register index, and pass it CSSELR_EL1 from cp15_regs[].
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: James Morse <james.morse@arm.com>
> ----
> Providing access_csselr_cp15() wouldn't work as with VHE CSSELR_EL1 is
> loaded on the CPU while this code runs. access_csselr_cp15() would have
> to map it back the 64bit resgister to use vcpu_write_sys_reg(). We may
> as well do it in the table.
> 
>  arch/arm64/kvm/sys_regs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 51db934702b6..2eda539f3281 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -1302,7 +1302,7 @@ static bool access_clidr(struct kvm_vcpu *vcpu,
> struct sys_reg_params *p,
>  	return true;
>  }
> 
> -static bool access_csselr(struct kvm_vcpu *vcpu, struct sys_reg_params 
> *p,
> +static bool access_csselr_el1(struct kvm_vcpu *vcpu, struct 
> sys_reg_params *p,
>  			  const struct sys_reg_desc *r)
>  {
>  	if (p->is_write)
> @@ -1566,7 +1566,7 @@ static const struct sys_reg_desc sys_reg_descs[] 
> = {
> 
>  	{ SYS_DESC(SYS_CCSIDR_EL1), access_ccsidr },
>  	{ SYS_DESC(SYS_CLIDR_EL1), access_clidr },
> -	{ SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 
> },
> +	{ SYS_DESC(SYS_CSSELR_EL1), access_csselr_el1, reset_unknown, 
> CSSELR_EL1 },
>  	{ SYS_DESC(SYS_CTR_EL0), access_ctr },
> 
>  	{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
> @@ -2060,7 +2060,7 @@ static const struct sys_reg_desc cp15_regs[] = {
> 
>  	{ Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
>  	{ Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
> -	{ Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, c0_CSSELR },
> +	{ Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr_el1, NULL, 
> CSSELR_EL1 },
>  };
> 
>  static const struct sys_reg_desc cp15_64_regs[] = {

This is a departure from the way we deal with 32bit CP15 registers.
We deal with this exact issue in a very different way for other
CP15 regs, by adjusting the index in the sys_regs array (see the
way we handle the VM regs).

How about something like this (untested):

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 12d07e7ced82..515c0c11a668 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1321,10 +1321,16 @@ static bool access_clidr(struct kvm_vcpu *vcpu, 
struct sys_reg_params *p,
  static bool access_csselr(struct kvm_vcpu *vcpu, struct sys_reg_params 
*p,
  			  const struct sys_reg_desc *r)
  {
+	int reg = r->reg;
+
+	/* See the 32bit mapping in kvm_host.h */
+	if (p->is_aarch32)
+		reg = r->reg / 2;
+
  	if (p->is_write)
-		vcpu_write_sys_reg(vcpu, p->regval, r->reg);
+		vcpu_write_sys_reg(vcpu, p->regval, reg);
  	else
-		p->regval = vcpu_read_sys_reg(vcpu, r->reg);
+		p->regval = vcpu_read_sys_reg(vcpu, reg);
  	return true;
  }

Ideally, I'd like the core sys_reg code to deal with this sort
of funnies, but I'm trying to keep the change minimal...

Thanks,

          M.
-- 
Jazz is not dead. It just smells funny...

Re: [PATCH 1/3] KVM: arm64: Stop writing aarch32's CSSELR into ACTLR

[James Morse]

Hi Marc,

On 28/05/2020 09:57, Marc Zyngier wrote:
> On 2020-05-26 17:18, James Morse wrote:
>> access_csselr() uses the 32bit r->reg value to access the 64bit array,
>> so reads and write the wrong value. sys_regs[4], is ACTLR_EL1, which
>> is subsequently save/restored when we enter the guest.

>> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
>> index 51db934702b6..2eda539f3281 100644
>> --- a/arch/arm64/kvm/sys_regs.c
>> +++ b/arch/arm64/kvm/sys_regs.c
>> @@ -2060,7 +2060,7 @@ static const struct sys_reg_desc cp15_regs[] = {
>>
>>      { Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
>>      { Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
>> -    { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, c0_CSSELR },
>> +    { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr_el1, NULL, CSSELR_EL1 },
>>  };

> This is a departure from the way we deal with 32bit CP15 registers.
> We deal with this exact issue in a very different way for other
> CP15 regs, by adjusting the index in the sys_regs array (see the
> way we handle the VM regs).
> 
> How about something like this (untested):

[like access_vm_reg() does]

Sure, I'll give that a test and re-post it.


> Ideally, I'd like the core sys_reg code to deal with this sort
> of funnies, but I'm trying to keep the change minimal...

Roll this '/2' and upper/lower bits stuff into a vcpu_write_cp15_reg() that calls
vcpu_write_sys_reg()? (/me hunts out the todo list)


Thanks,

James

Re: [PATCH 1/3] KVM: arm64: Stop writing aarch32's CSSELR into ACTLR

[Marc Zyngier]

On 2020-05-28 12:59, James Morse wrote:
> Hi Marc,
> 
> On 28/05/2020 09:57, Marc Zyngier wrote:
>> On 2020-05-26 17:18, James Morse wrote:
>>> access_csselr() uses the 32bit r->reg value to access the 64bit 
>>> array,
>>> so reads and write the wrong value. sys_regs[4], is ACTLR_EL1, which
>>> is subsequently save/restored when we enter the guest.
> 
>>> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
>>> index 51db934702b6..2eda539f3281 100644
>>> --- a/arch/arm64/kvm/sys_regs.c
>>> +++ b/arch/arm64/kvm/sys_regs.c
>>> @@ -2060,7 +2060,7 @@ static const struct sys_reg_desc cp15_regs[] = 
>>> {
>>> 
>>>      { Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
>>>      { Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
>>> -    { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, 
>>> c0_CSSELR },
>>> +    { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr_el1, NULL, 
>>> CSSELR_EL1 },
>>>  };
> 
>> This is a departure from the way we deal with 32bit CP15 registers.
>> We deal with this exact issue in a very different way for other
>> CP15 regs, by adjusting the index in the sys_regs array (see the
>> way we handle the VM regs).
>> 
>> How about something like this (untested):
> 
> [like access_vm_reg() does]
> 
> Sure, I'll give that a test and re-post it.

Thanks!

> 
> 
>> Ideally, I'd like the core sys_reg code to deal with this sort
>> of funnies, but I'm trying to keep the change minimal...
> 
> Roll this '/2' and upper/lower bits stuff into a vcpu_write_cp15_reg()
> that calls
> vcpu_write_sys_reg()? (/me hunts out the todo list)

I was thinking of hiding it differently: in emulate_cp, substitute the
sys_reg_desc structure for a temporary one that represents the 64bit
version, and make it completely transparent.

I'm sure there is a couple of nits around that though...

         M.
-- 
Jazz is not dead. It just smells funny...