Commit 21de26db authored by Fuad Tabba's avatar Fuad Tabba Committed by Marc Zyngier
Browse files

KVM: arm64: Mark PAuth as a restricted feature for protected VMs 



Protected VMs will only support basic PAuth (FEAT_PAuth). Mark it
as restricted to ensure that later versions aren't supported for
protected guests.

Signed-off-by: default avatarFuad Tabba <tabba@google.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20231214100158.2305400-17-tabba@google.com
parent 73e3ce3f

arch/arm64/kvm/hyp/include/nvhe/fixed_config.h

+11 −3
Original line number Diff line number Diff line
@@ -184,10 +184,18 @@ 
	ARM64_FEATURE_MASK(ID_AA64ISAR0_EL1_RNDR) \

	)



/* Restrict pointer authentication to the basic version. */

#define PVM_ID_AA64ISAR1_RESTRICT_UNSIGNED (\

	FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_APA), ID_AA64ISAR1_EL1_APA_PAuth) | \

	FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_API), ID_AA64ISAR1_EL1_API_PAuth) \

	)



#define PVM_ID_AA64ISAR2_RESTRICT_UNSIGNED (\

	FIELD_PREP(ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_APA3), ID_AA64ISAR2_EL1_APA3_PAuth) \

	)



#define PVM_ID_AA64ISAR1_ALLOW (\

	ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_DPB) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_APA) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_API) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_JSCVT) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_FCMA) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR1_EL1_LRCPC) | \
@@ -202,8 +210,8 @@ 
	)



#define PVM_ID_AA64ISAR2_ALLOW (\

	ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_ATS1A)| \

	ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_GPA3) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_APA3) | \

	ARM64_FEATURE_MASK(ID_AA64ISAR2_EL1_MOPS) \

	)