Commit 6eb0ed96 authored by Marc Zyngier's avatar Marc Zyngier
Browse files

Merge branch kvm-arm64/mte-frac into kvmarm-master/next 



* kvm-arm64/mte-frac:
  : .
  : Prevent FEAT_MTE_ASYNC from being accidently exposed to a guest,
  : courtesy of Ben Horgan. From the cover letter:
  :
  : "The ID_AA64PFR1_EL1.MTE_frac field is currently hidden from KVM.
  : However, when ID_AA64PFR1_EL1.MTE==2, ID_AA64PFR1_EL1.MTE_frac==0
  : indicates that MTE_ASYNC is supported. On a host with
  : ID_AA64PFR1_EL1.MTE==2 but without MTE_ASYNC support a guest with the
  : MTE capability enabled will incorrectly see MTE_ASYNC advertised as
  : supported. This series fixes that."
  : .
  KVM: selftests: Confirm exposing MTE_frac does not break migration
  KVM: arm64: Make MTE_frac masking conditional on MTE capability
  arm64/sysreg: Expose MTE_frac so that it is visible to KVM

Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
parents cb86616c 69018866

arch/arm64/kernel/cpufeature.c

+1 −0
Original line number Diff line number Diff line
@@ -298,6 +298,7 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = { 
static const struct arm64_ftr_bits ftr_id_aa64pfr1[] = {

	ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_GCS),

		       FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR1_EL1_GCS_SHIFT, 4, 0),

	S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR1_EL1_MTE_frac_SHIFT, 4, 0),

	ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_SME),

		       FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR1_EL1_SME_SHIFT, 4, 0),

	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR1_EL1_MPAM_frac_SHIFT, 4, 0),

arch/arm64/kvm/sys_regs.c

+26 −2
Original line number Diff line number Diff line
@@ -1601,13 +1601,14 @@ static u64 __kvm_read_sanitised_id_reg(const struct kvm_vcpu *vcpu, 
		val = sanitise_id_aa64pfr0_el1(vcpu, val);

		break;

	case SYS_ID_AA64PFR1_EL1:

		if (!kvm_has_mte(vcpu->kvm))

		if (!kvm_has_mte(vcpu->kvm)) {

			val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE);

			val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE_frac);

		}



		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_SME);

		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_RNDR_trap);

		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_NMI);

		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE_frac);

		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_GCS);

		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_THE);

		val &= ~ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTEX);
@@ -1954,11 +1955,34 @@ static int set_id_aa64pfr1_el1(struct kvm_vcpu *vcpu, 
{

	u64 hw_val = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1);

	u64 mpam_mask = ID_AA64PFR1_EL1_MPAM_frac_MASK;

	u8 mte = SYS_FIELD_GET(ID_AA64PFR1_EL1, MTE, hw_val);

	u8 user_mte_frac = SYS_FIELD_GET(ID_AA64PFR1_EL1, MTE_frac, user_val);

	u8 hw_mte_frac = SYS_FIELD_GET(ID_AA64PFR1_EL1, MTE_frac, hw_val);



	/* See set_id_aa64pfr0_el1 for comment about MPAM */

	if ((hw_val & mpam_mask) == (user_val & mpam_mask))

		user_val &= ~ID_AA64PFR1_EL1_MPAM_frac_MASK;



	/*

	 * Previously MTE_frac was hidden from guest. However, if the

	 * hardware supports MTE2 but not MTE_ASYM_FAULT then a value

	 * of 0 for this field indicates that the hardware supports

	 * MTE_ASYNC. Whereas, 0xf indicates MTE_ASYNC is not supported.

	 *

	 * As KVM must accept values from KVM provided by user-space,

	 * when ID_AA64PFR1_EL1.MTE is 2 allow user-space to set

	 * ID_AA64PFR1_EL1.MTE_frac to 0. However, ignore it to avoid

	 * incorrectly claiming hardware support for MTE_ASYNC in the

	 * guest.

	 */



	if (mte == ID_AA64PFR1_EL1_MTE_MTE2 &&

	    hw_mte_frac == ID_AA64PFR1_EL1_MTE_frac_NI &&

	    user_mte_frac == ID_AA64PFR1_EL1_MTE_frac_ASYNC) {

		user_val &= ~ID_AA64PFR1_EL1_MTE_frac_MASK;

		user_val |= hw_val & ID_AA64PFR1_EL1_MTE_frac_MASK;

	}



	return set_id_reg(vcpu, rd, user_val);

}

tools/testing/selftests/kvm/arm64/set_id_regs.c

+76 −1
Original line number Diff line number Diff line
@@ -15,6 +15,8 @@ 
#include "test_util.h"

#include <linux/bitfield.h>



bool have_cap_arm_mte;



enum ftr_type {

	FTR_EXACT,			/* Use a predefined safe value */

	FTR_LOWER_SAFE,			/* Smaller value is safe */
@@ -543,6 +545,70 @@ static void test_user_set_mpam_reg(struct kvm_vcpu *vcpu) 
		ksft_test_result_fail("ID_AA64PFR1_EL1.MPAM_frac value should not be ignored\n");

}



#define MTE_IDREG_TEST 1

static void test_user_set_mte_reg(struct kvm_vcpu *vcpu)

{

	uint64_t masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];

	struct reg_mask_range range = {

		.addr = (__u64)masks,

	};

	uint64_t val;

	uint64_t mte;

	uint64_t mte_frac;

	int idx, err;



	if (!have_cap_arm_mte) {

		ksft_test_result_skip("MTE capability not supported, nothing to test\n");

		return;

	}



	/* Get writable masks for feature ID registers */

	memset(range.reserved, 0, sizeof(range.reserved));

	vm_ioctl(vcpu->vm, KVM_ARM_GET_REG_WRITABLE_MASKS, &range);



	idx = encoding_to_range_idx(SYS_ID_AA64PFR1_EL1);

	if ((masks[idx] & ID_AA64PFR1_EL1_MTE_frac_MASK) == ID_AA64PFR1_EL1_MTE_frac_MASK) {

		ksft_test_result_skip("ID_AA64PFR1_EL1.MTE_frac is officially writable, nothing to test\n");

		return;

	}



	/*

	 * When MTE is supported but MTE_ASYMM is not (ID_AA64PFR1_EL1.MTE == 2)

	 * ID_AA64PFR1_EL1.MTE_frac == 0xF indicates MTE_ASYNC is unsupported

	 * and MTE_frac == 0 indicates it is supported.

	 *

	 * As MTE_frac was previously unconditionally read as 0, check

	 * that the set to 0 succeeds but does not change MTE_frac

	 * from unsupported (0xF) to supported (0).

	 *

	 */

	val = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64PFR1_EL1));



	mte = FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE), val);

	mte_frac = FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE_frac), val);

	if (mte != ID_AA64PFR1_EL1_MTE_MTE2 ||

	    mte_frac != ID_AA64PFR1_EL1_MTE_frac_NI) {

		ksft_test_result_skip("MTE_ASYNC or MTE_ASYMM are supported, nothing to test\n");

		return;

	}



	/* Try to set MTE_frac=0. */

	val &= ~ID_AA64PFR1_EL1_MTE_frac_MASK;

	val |= FIELD_PREP(ID_AA64PFR1_EL1_MTE_frac_MASK, 0);

	err = __vcpu_set_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64PFR1_EL1), val);

	if (err) {

		ksft_test_result_fail("ID_AA64PFR1_EL1.MTE_frac=0 was not accepted\n");

		return;

	}



	val = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64PFR1_EL1));

	mte_frac = FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR1_EL1_MTE_frac), val);

	if (mte_frac == ID_AA64PFR1_EL1_MTE_frac_NI)

		ksft_test_result_pass("ID_AA64PFR1_EL1.MTE_frac=0 accepted and still 0xF\n");

	else

		ksft_test_result_pass("ID_AA64PFR1_EL1.MTE_frac no longer 0xF\n");

}



static void test_guest_reg_read(struct kvm_vcpu *vcpu)

{

	bool done = false;
@@ -673,6 +739,14 @@ static void test_reset_preserves_id_regs(struct kvm_vcpu *vcpu) 
	ksft_test_result_pass("%s\n", __func__);

}



void kvm_arch_vm_post_create(struct kvm_vm *vm)

{

	if (vm_check_cap(vm, KVM_CAP_ARM_MTE)) {

		vm_enable_cap(vm, KVM_CAP_ARM_MTE, 0);

		have_cap_arm_mte = true;

	}

}



int main(void)

{

	struct kvm_vcpu *vcpu;
@@ -701,7 +775,7 @@ int main(void) 
		   ARRAY_SIZE(ftr_id_aa64pfr1_el1) + ARRAY_SIZE(ftr_id_aa64mmfr0_el1) +

		   ARRAY_SIZE(ftr_id_aa64mmfr1_el1) + ARRAY_SIZE(ftr_id_aa64mmfr2_el1) +

		   ARRAY_SIZE(ftr_id_aa64zfr0_el1) - ARRAY_SIZE(test_regs) + 3 +

		   MPAM_IDREG_TEST;

		   MPAM_IDREG_TEST + MTE_IDREG_TEST;



	ksft_set_plan(test_cnt);
@@ -709,6 +783,7 @@ int main(void) 
	test_vcpu_ftr_id_regs(vcpu);

	test_vcpu_non_ftr_id_regs(vcpu);

	test_user_set_mpam_reg(vcpu);

	test_user_set_mte_reg(vcpu);



	test_guest_reg_read(vcpu);