From: Marc Zyngier <maz@kernel.org> To: kvmarm@lists.linux.dev, kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: James Morse <james.morse@arm.com>, Suzuki K Poulose <suzuki.poulose@arm.com>, Oliver Upton <oliver.upton@linux.dev>, Zenghui Yu <yuzenghui@huawei.com>, Joey Gouly <joey.gouly@arm.com>, Fuad Tabba <tabba@google.com>, Mostafa Saleh <smostafa@google.com>, Will Deacon <will@kernel.org>, Catalin Marinas <catalin.marinas@arm.com> Subject: [PATCH v4 03/15] KVM: arm64: Constraint PAuth support to consistent implementations Date: Fri, 19 Apr 2024 11:29:23 +0100 [thread overview] Message-ID: <20240419102935.1935571-4-maz@kernel.org> (raw) In-Reply-To: <20240419102935.1935571-1-maz@kernel.org> PAuth comes it two parts: address authentication, and generic authentication. So far, KVM mandates that both are implemented. PAuth also comes in three flavours: Q5, Q3, and IMPDEF. Only one can be implemented for any of address and generic authentication. Crucially, the architecture doesn't mandate that address and generic authentication implement the *same* flavour. This would make implementing ERETAx very difficult for NV, something we are not terribly keen on. So only allow PAuth support for KVM on systems that are not totally insane. Which is so far 100% of the known HW. Signed-off-by: Marc Zyngier <maz@kernel.org> --- arch/arm64/kvm/arm.c | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 3dee5490eea9..a7178af1ab0c 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -218,6 +218,40 @@ void kvm_arch_destroy_vm(struct kvm *kvm) kvm_arm_teardown_hypercalls(kvm); } +static bool kvm_has_full_ptr_auth(void) +{ + bool apa, gpa, api, gpi, apa3, gpa3; + u64 isar1, isar2, val; + + /* + * Check that: + * + * - both Address and Generic auth are implemented for a given + * algorithm (Q5, IMPDEF or Q3) + * - only a single algorithm is implemented. + */ + if (!system_has_full_ptr_auth()) + return false; + + isar1 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1); + isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1); + + apa = !!FIELD_GET(ID_AA64ISAR1_EL1_APA_MASK, isar1); + val = FIELD_GET(ID_AA64ISAR1_EL1_GPA_MASK, isar1); + gpa = (val == ID_AA64ISAR1_EL1_GPA_IMP); + + api = !!FIELD_GET(ID_AA64ISAR1_EL1_API_MASK, isar1); + val = FIELD_GET(ID_AA64ISAR1_EL1_GPI_MASK, isar1); + gpi = (val == ID_AA64ISAR1_EL1_GPI_IMP); + + apa3 = !!FIELD_GET(ID_AA64ISAR2_EL1_APA3_MASK, isar2); + val = FIELD_GET(ID_AA64ISAR2_EL1_GPA3_MASK, isar2); + gpa3 = (val == ID_AA64ISAR2_EL1_GPA3_IMP); + + return (apa == gpa && api == gpi && apa3 == gpa3 && + (apa + api + apa3) == 1); +} + int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) { int r; @@ -311,7 +345,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) break; case KVM_CAP_ARM_PTRAUTH_ADDRESS: case KVM_CAP_ARM_PTRAUTH_GENERIC: - r = system_has_full_ptr_auth(); + r = kvm_has_full_ptr_auth(); break; case KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE: if (kvm) @@ -1270,7 +1304,7 @@ static unsigned long system_supported_vcpu_features(void) if (!system_supports_sve()) clear_bit(KVM_ARM_VCPU_SVE, &features); - if (!system_has_full_ptr_auth()) { + if (!kvm_has_full_ptr_auth()) { clear_bit(KVM_ARM_VCPU_PTRAUTH_ADDRESS, &features); clear_bit(KVM_ARM_VCPU_PTRAUTH_GENERIC, &features); } -- 2.39.2 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
WARNING: multiple messages have this Message-ID (diff)
From: Marc Zyngier <maz@kernel.org> To: kvmarm@lists.linux.dev, kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: James Morse <james.morse@arm.com>, Suzuki K Poulose <suzuki.poulose@arm.com>, Oliver Upton <oliver.upton@linux.dev>, Zenghui Yu <yuzenghui@huawei.com>, Joey Gouly <joey.gouly@arm.com>, Fuad Tabba <tabba@google.com>, Mostafa Saleh <smostafa@google.com>, Will Deacon <will@kernel.org>, Catalin Marinas <catalin.marinas@arm.com> Subject: [PATCH v4 03/15] KVM: arm64: Constraint PAuth support to consistent implementations Date: Fri, 19 Apr 2024 11:29:23 +0100 [thread overview] Message-ID: <20240419102935.1935571-4-maz@kernel.org> (raw) In-Reply-To: <20240419102935.1935571-1-maz@kernel.org> PAuth comes it two parts: address authentication, and generic authentication. So far, KVM mandates that both are implemented. PAuth also comes in three flavours: Q5, Q3, and IMPDEF. Only one can be implemented for any of address and generic authentication. Crucially, the architecture doesn't mandate that address and generic authentication implement the *same* flavour. This would make implementing ERETAx very difficult for NV, something we are not terribly keen on. So only allow PAuth support for KVM on systems that are not totally insane. Which is so far 100% of the known HW. Signed-off-by: Marc Zyngier <maz@kernel.org> --- arch/arm64/kvm/arm.c | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 3dee5490eea9..a7178af1ab0c 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -218,6 +218,40 @@ void kvm_arch_destroy_vm(struct kvm *kvm) kvm_arm_teardown_hypercalls(kvm); } +static bool kvm_has_full_ptr_auth(void) +{ + bool apa, gpa, api, gpi, apa3, gpa3; + u64 isar1, isar2, val; + + /* + * Check that: + * + * - both Address and Generic auth are implemented for a given + * algorithm (Q5, IMPDEF or Q3) + * - only a single algorithm is implemented. + */ + if (!system_has_full_ptr_auth()) + return false; + + isar1 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1); + isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1); + + apa = !!FIELD_GET(ID_AA64ISAR1_EL1_APA_MASK, isar1); + val = FIELD_GET(ID_AA64ISAR1_EL1_GPA_MASK, isar1); + gpa = (val == ID_AA64ISAR1_EL1_GPA_IMP); + + api = !!FIELD_GET(ID_AA64ISAR1_EL1_API_MASK, isar1); + val = FIELD_GET(ID_AA64ISAR1_EL1_GPI_MASK, isar1); + gpi = (val == ID_AA64ISAR1_EL1_GPI_IMP); + + apa3 = !!FIELD_GET(ID_AA64ISAR2_EL1_APA3_MASK, isar2); + val = FIELD_GET(ID_AA64ISAR2_EL1_GPA3_MASK, isar2); + gpa3 = (val == ID_AA64ISAR2_EL1_GPA3_IMP); + + return (apa == gpa && api == gpi && apa3 == gpa3 && + (apa + api + apa3) == 1); +} + int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) { int r; @@ -311,7 +345,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) break; case KVM_CAP_ARM_PTRAUTH_ADDRESS: case KVM_CAP_ARM_PTRAUTH_GENERIC: - r = system_has_full_ptr_auth(); + r = kvm_has_full_ptr_auth(); break; case KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE: if (kvm) @@ -1270,7 +1304,7 @@ static unsigned long system_supported_vcpu_features(void) if (!system_supports_sve()) clear_bit(KVM_ARM_VCPU_SVE, &features); - if (!system_has_full_ptr_auth()) { + if (!kvm_has_full_ptr_auth()) { clear_bit(KVM_ARM_VCPU_PTRAUTH_ADDRESS, &features); clear_bit(KVM_ARM_VCPU_PTRAUTH_GENERIC, &features); } -- 2.39.2
next prev parent reply other threads:[~2024-04-19 10:30 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-04-19 10:29 [PATCH v4 00/15] KVM/arm64: Add NV support for ERET and PAuth Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 01/15] KVM: arm64: Harden __ctxt_sys_reg() against out-of-range values Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 02/15] KVM: arm64: Add helpers for ESR_ELx_ERET_ISS_ERET* Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier [this message] 2024-04-19 10:29 ` [PATCH v4 03/15] KVM: arm64: Constraint PAuth support to consistent implementations Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 04/15] KVM: arm64: nv: Drop VCPU_HYP_CONTEXT flag Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 05/15] KVM: arm64: nv: Configure HCR_EL2 for FEAT_NV2 Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 06/15] KVM: arm64: nv: Add trap forwarding for ERET and SMC Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 07/15] KVM: arm64: nv: Fast-track 'InHost' exception returns Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 08/15] KVM: arm64: nv: Honor HFGITR_EL2.ERET being set Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 09/15] KVM: arm64: nv: Handle HCR_EL2.{API,APK} independently Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 10/15] KVM: arm64: nv: Reinject PAC exceptions caused by HCR_EL2.API==0 Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 11/15] KVM: arm64: nv: Add kvm_has_pauth() helper Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 12/15] KVM: arm64: nv: Add emulation for ERETAx instructions Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-23 9:22 ` Jon Hunter 2024-04-23 9:22 ` Jon Hunter 2024-04-23 9:40 ` Zenghui Yu 2024-04-23 9:40 ` Zenghui Yu 2024-04-23 11:42 ` Marc Zyngier 2024-04-23 11:42 ` Marc Zyngier 2024-04-23 12:30 ` Jon Hunter 2024-04-23 12:30 ` Jon Hunter 2024-04-23 12:09 ` Jon Hunter 2024-04-23 12:09 ` Jon Hunter 2024-04-19 10:29 ` [PATCH v4 13/15] KVM: arm64: nv: Handle ERETA[AB] instructions Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 14/15] KVM: arm64: nv: Advertise support for PAuth Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 10:29 ` [PATCH v4 15/15] KVM: arm64: Drop trapping of PAuth instructions/keys Marc Zyngier 2024-04-19 10:29 ` Marc Zyngier 2024-04-19 17:59 ` [PATCH v4 00/15] KVM/arm64: Add NV support for ERET and PAuth Oliver Upton 2024-04-19 17:59 ` Oliver Upton 2024-04-20 11:49 ` Marc Zyngier 2024-04-20 11:49 ` Marc Zyngier 2024-04-20 12:18 ` Marc Zyngier 2024-04-20 12:18 ` Marc Zyngier
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240419102935.1935571-4-maz@kernel.org \ --to=maz@kernel.org \ --cc=catalin.marinas@arm.com \ --cc=james.morse@arm.com \ --cc=joey.gouly@arm.com \ --cc=kvm@vger.kernel.org \ --cc=kvmarm@lists.linux.dev \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=oliver.upton@linux.dev \ --cc=smostafa@google.com \ --cc=suzuki.poulose@arm.com \ --cc=tabba@google.com \ --cc=will@kernel.org \ --cc=yuzenghui@huawei.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.