From: Marc Zyngier <maz@kernel.org>
To: Mark Brown <broonie@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>, Jonathan Corbet <corbet@lwn.net>,
Andrew Morton <akpm@linux-foundation.org>,
Oliver Upton <oliver.upton@linux.dev>,
James Morse <james.morse@arm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Arnd Bergmann <arnd@arndb.de>, Oleg Nesterov <oleg@redhat.com>,
Eric Biederman <ebiederm@xmission.com>,
Kees Cook <keescook@chromium.org>, Shuah Khan <shuah@kernel.org>,
"Rick P. Edgecombe" <rick.p.edgecombe@intel.com>,
Deepak Gupta <debug@rivosinc.com>,
Ard Biesheuvel <ardb@kernel.org>,
Szabolcs Nagy <Szabolcs.Nagy@arm.com>,
"H.J. Lu" <hjl.tools@gmail.com>,
Paul Walmsley <paul.walmsley@sifive.com>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Florian Weimer <fweimer@redhat.com>,
Christian Brauner <brauner@kernel.org>,
Thiago Jung Bauermann <thiago.bauermann@linaro.org>,
linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org,
kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org,
linux-arch@vger.kernel.org, linux-mm@kvack.org,
linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-riscv@lists.infradead.org
Subject: Re: [PATCH v8 13/38] KVM: arm64: Manage GCS registers for guests
Date: Mon, 05 Feb 2024 09:46:16 +0000 [thread overview]
Message-ID: <868r3z6y6v.wl-maz@kernel.org> (raw)
In-Reply-To: <20240203-arm64-gcs-v8-13-c9fec77673ef@kernel.org>
On Sat, 03 Feb 2024 12:25:39 +0000,
Mark Brown <broonie@kernel.org> wrote:
>
> GCS introduces a number of system registers for EL1 and EL0, on systems
and EL2.
> with GCS we need to context switch them and expose them to VMMs to allow
> guests to use GCS, as well as describe their fine grained traps to
> nested virtualisation. Traps are already disabled.
The latter is not true with NV, since the guest is in control of the
FGT registers.
>
> Signed-off-by: Mark Brown <broonie@kernel.org>
> ---
> arch/arm64/include/asm/kvm_host.h | 12 ++++++++++++
> arch/arm64/kvm/emulate-nested.c | 4 ++++
> arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 17 +++++++++++++++++
> arch/arm64/kvm/sys_regs.c | 22 ++++++++++++++++++++++
> 4 files changed, 55 insertions(+)
>
> diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> index 21c57b812569..6c7ea7f9cd92 100644
> --- a/arch/arm64/include/asm/kvm_host.h
> +++ b/arch/arm64/include/asm/kvm_host.h
> @@ -388,6 +388,12 @@ enum vcpu_sysreg {
> GCR_EL1, /* Tag Control Register */
> TFSRE0_EL1, /* Tag Fault Status Register (EL0) */
>
> + /* Guarded Control Stack registers */
> + GCSCRE0_EL1, /* Guarded Control Stack Control (EL0) */
> + GCSCR_EL1, /* Guarded Control Stack Control (EL1) */
This is subjected to VNCR (0x8D0).
> + GCSPR_EL0, /* Guarded Control Stack Pointer (EL0) */
> + GCSPR_EL1, /* Guarded Control Stack Pointer (EL1) */
So is this one (0x8C0). And how about the *_EL2 versions?
> +
> /* 32bit specific registers. */
> DACR32_EL2, /* Domain Access Control Register */
> IFSR32_EL2, /* Instruction Fault Status Register */
> @@ -1221,6 +1227,12 @@ static inline bool __vcpu_has_feature(const struct kvm_arch *ka, int feature)
>
> #define vcpu_has_feature(v, f) __vcpu_has_feature(&(v)->kvm->arch, (f))
>
> +static inline bool has_gcs(void)
> +{
> + return IS_ENABLED(CONFIG_ARM64_GCS) &&
> + cpus_have_final_cap(ARM64_HAS_GCS);
> +}
> +
> int kvm_trng_call(struct kvm_vcpu *vcpu);
> #ifdef CONFIG_KVM
> extern phys_addr_t hyp_mem_base;
> diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
> index 431fd429932d..24eb7eccbae4 100644
> --- a/arch/arm64/kvm/emulate-nested.c
> +++ b/arch/arm64/kvm/emulate-nested.c
> @@ -1098,8 +1098,12 @@ static const struct encoding_to_trap_config encoding_to_fgt[] __initconst = {
> SR_FGT(SYS_ESR_EL1, HFGxTR, ESR_EL1, 1),
> SR_FGT(SYS_DCZID_EL0, HFGxTR, DCZID_EL0, 1),
> SR_FGT(SYS_CTR_EL0, HFGxTR, CTR_EL0, 1),
> + SR_FGT(SYS_GCSPR_EL0, HFGxTR, nGCS_EL0, 1),
> SR_FGT(SYS_CSSELR_EL1, HFGxTR, CSSELR_EL1, 1),
> SR_FGT(SYS_CPACR_EL1, HFGxTR, CPACR_EL1, 1),
> + SR_FGT(SYS_GCSCR_EL1, HFGxTR, nGCS_EL1, 1),
> + SR_FGT(SYS_GCSPR_EL1, HFGxTR, nGCS_EL1, 1),
> + SR_FGT(SYS_GCSCRE0_EL1, HFGxTR, nGCS_EL0, 1),
This is clearly wrong on all 4 counts (the n prefix gives it away...).
> SR_FGT(SYS_CONTEXTIDR_EL1, HFGxTR, CONTEXTIDR_EL1, 1),
> SR_FGT(SYS_CLIDR_EL1, HFGxTR, CLIDR_EL1, 1),
> SR_FGT(SYS_CCSIDR_EL1, HFGxTR, CCSIDR_EL1, 1),
> diff --git a/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h b/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
> index bb6b571ec627..ec34d4a90717 100644
> --- a/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
> +++ b/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
> @@ -25,6 +25,8 @@ static inline void __sysreg_save_user_state(struct kvm_cpu_context *ctxt)
> {
> ctxt_sys_reg(ctxt, TPIDR_EL0) = read_sysreg(tpidr_el0);
> ctxt_sys_reg(ctxt, TPIDRRO_EL0) = read_sysreg(tpidrro_el0);
> + if (has_gcs())
> + ctxt_sys_reg(ctxt, GCSPR_EL0) = read_sysreg_s(SYS_GCSPR_EL0);
We have had this discussion in the past. This must be based on the
VM's configuration. Guarding the check with the host capability is a
valuable optimisation, but that's nowhere near enough. See the series
that I have posted on this very subject (you're on Cc), but you are
welcome to invent your own mechanism in the meantime.
> }
>
> static inline bool ctxt_has_mte(struct kvm_cpu_context *ctxt)
> @@ -62,6 +64,12 @@ static inline void __sysreg_save_el1_state(struct kvm_cpu_context *ctxt)
> ctxt_sys_reg(ctxt, PAR_EL1) = read_sysreg_par();
> ctxt_sys_reg(ctxt, TPIDR_EL1) = read_sysreg(tpidr_el1);
>
> + if (has_gcs()) {
> + ctxt_sys_reg(ctxt, GCSPR_EL1) = read_sysreg_el1(SYS_GCSPR);
> + ctxt_sys_reg(ctxt, GCSCR_EL1) = read_sysreg_el1(SYS_GCSCR);
> + ctxt_sys_reg(ctxt, GCSCRE0_EL1) = read_sysreg_s(SYS_GCSCRE0_EL1);
> + }
> +
Same thing.
> if (ctxt_has_mte(ctxt)) {
> ctxt_sys_reg(ctxt, TFSR_EL1) = read_sysreg_el1(SYS_TFSR);
> ctxt_sys_reg(ctxt, TFSRE0_EL1) = read_sysreg_s(SYS_TFSRE0_EL1);
> @@ -95,6 +103,8 @@ static inline void __sysreg_restore_user_state(struct kvm_cpu_context *ctxt)
> {
> write_sysreg(ctxt_sys_reg(ctxt, TPIDR_EL0), tpidr_el0);
> write_sysreg(ctxt_sys_reg(ctxt, TPIDRRO_EL0), tpidrro_el0);
> + if (has_gcs())
> + write_sysreg_s(ctxt_sys_reg(ctxt, GCSPR_EL0), SYS_GCSPR_EL0);
> }
>
> static inline void __sysreg_restore_el1_state(struct kvm_cpu_context *ctxt)
> @@ -138,6 +148,13 @@ static inline void __sysreg_restore_el1_state(struct kvm_cpu_context *ctxt)
> write_sysreg(ctxt_sys_reg(ctxt, PAR_EL1), par_el1);
> write_sysreg(ctxt_sys_reg(ctxt, TPIDR_EL1), tpidr_el1);
>
> + if (has_gcs()) {
> + write_sysreg_el1(ctxt_sys_reg(ctxt, GCSPR_EL1), SYS_GCSPR);
> + write_sysreg_el1(ctxt_sys_reg(ctxt, GCSCR_EL1), SYS_GCSCR);
> + write_sysreg_s(ctxt_sys_reg(ctxt, GCSCRE0_EL1),
> + SYS_GCSCRE0_EL1);
> + }
> +
For the benefit of the unsuspecting reviewers, and in the absence of a
public specification (which the XML drop isn't), it would be good to
have the commit message explaining the rationale of what gets saved
when.
> if (ctxt_has_mte(ctxt)) {
> write_sysreg_el1(ctxt_sys_reg(ctxt, TFSR_EL1), SYS_TFSR);
> write_sysreg_s(ctxt_sys_reg(ctxt, TFSRE0_EL1), SYS_TFSRE0_EL1);
> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 30253bd19917..83ba767e75d2 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -2000,6 +2000,23 @@ static unsigned int mte_visibility(const struct kvm_vcpu *vcpu,
> .visibility = mte_visibility, \
> }
>
> +static unsigned int gcs_visibility(const struct kvm_vcpu *vcpu,
> + const struct sys_reg_desc *rd)
> +{
> + if (has_gcs())
> + return 0;
Yet another case of exposing potentially unwanted state, to the VMM
this time.
> +
> + return REG_HIDDEN;
> +}
> +
> +#define GCS_REG(name) { \
> + SYS_DESC(SYS_##name), \
> + .access = undef_access, \
> + .reset = reset_unknown, \
> + .reg = name, \
> + .visibility = gcs_visibility, \
> +}
> +
> static unsigned int el2_visibility(const struct kvm_vcpu *vcpu,
> const struct sys_reg_desc *rd)
> {
> @@ -2376,6 +2393,10 @@ static const struct sys_reg_desc sys_reg_descs[] = {
> PTRAUTH_KEY(APDB),
> PTRAUTH_KEY(APGA),
>
> + GCS_REG(GCSCR_EL1),
> + GCS_REG(GCSPR_EL1),
> + GCS_REG(GCSCRE0_EL1),
> +
> { SYS_DESC(SYS_SPSR_EL1), access_spsr},
> { SYS_DESC(SYS_ELR_EL1), access_elr},
>
> @@ -2462,6 +2483,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
> { SYS_DESC(SYS_SMIDR_EL1), undef_access },
> { SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
> { SYS_DESC(SYS_CTR_EL0), access_ctr },
> + GCS_REG(GCSPR_EL0),
> { SYS_DESC(SYS_SVCR), undef_access },
>
> { PMU_SYS_REG(PMCR_EL0), .access = access_pmcr, .reset = reset_pmcr,
>
Thanks,
M.
--
Without deviation from the norm, progress is not possible.
next prev parent reply other threads:[~2024-02-05 9:46 UTC|newest]
Thread overview: 90+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-03 12:25 [PATCH v8 00/38] arm64/gcs: Provide support for GCS in userspace Mark Brown
2024-02-03 12:25 ` [PATCH v8 01/38] arm64/mm: Restructure arch_validate_flags() for extensibility Mark Brown
2024-02-03 12:25 ` [PATCH v8 02/38] prctl: arch-agnostic prctl for shadow stack Mark Brown
2024-02-03 12:25 ` [PATCH v8 03/38] mman: Add map_shadow_stack() flags Mark Brown
2024-02-03 12:25 ` [PATCH v8 04/38] arm64: Document boot requirements for Guarded Control Stacks Mark Brown
2024-02-03 12:25 ` [PATCH v8 05/38] arm64/gcs: Document the ABI " Mark Brown
2024-02-03 12:25 ` [PATCH v8 06/38] arm64/sysreg: Add definitions for architected GCS caps Mark Brown
2024-02-03 12:25 ` [PATCH v8 07/38] arm64/gcs: Add manual encodings of GCS instructions Mark Brown
2024-02-03 12:25 ` [PATCH v8 08/38] arm64/gcs: Provide put_user_gcs() Mark Brown
2024-02-03 12:25 ` [PATCH v8 09/38] arm64/cpufeature: Runtime detection of Guarded Control Stack (GCS) Mark Brown
2024-02-03 12:25 ` [PATCH v8 10/38] arm64/mm: Allocate PIE slots for EL0 guarded control stack Mark Brown
2024-02-03 12:25 ` [PATCH v8 11/38] mm: Define VM_SHADOW_STACK for arm64 when we support GCS Mark Brown
2024-02-03 12:25 ` [PATCH v8 12/38] arm64/mm: Map pages for guarded control stack Mark Brown
2024-02-03 12:25 ` [PATCH v8 13/38] KVM: arm64: Manage GCS registers for guests Mark Brown
2024-02-05 9:46 ` Marc Zyngier [this message]
2024-02-05 12:35 ` Mark Brown
2024-02-05 15:34 ` Marc Zyngier
2024-02-05 16:58 ` Mark Brown
2024-02-03 12:25 ` [PATCH v8 14/38] arm64/gcs: Allow GCS usage at EL0 and EL1 Mark Brown
2024-02-03 12:25 ` [PATCH v8 15/38] arm64/idreg: Add overrride for GCS Mark Brown
2024-02-03 12:25 ` [PATCH v8 16/38] arm64/hwcap: Add hwcap " Mark Brown
2024-02-03 12:25 ` [PATCH v8 17/38] arm64/traps: Handle GCS exceptions Mark Brown
2024-02-03 12:25 ` [PATCH v8 18/38] arm64/mm: Handle GCS data aborts Mark Brown
2024-02-03 12:25 ` [PATCH v8 19/38] arm64/gcs: Context switch GCS state for EL0 Mark Brown
2024-02-03 12:25 ` [PATCH v8 20/38] arm64/gcs: Ensure that new threads have a GCS Mark Brown
2024-02-20 2:02 ` Thiago Jung Bauermann
2024-02-21 18:16 ` Mark Brown
2024-02-03 12:25 ` [PATCH v8 21/38] arm64/gcs: Implement shadow stack prctl() interface Mark Brown
2024-02-03 12:25 ` [PATCH v8 22/38] arm64/mm: Implement map_shadow_stack() Mark Brown
2024-02-03 12:25 ` [PATCH v8 23/38] arm64/signal: Set up and restore the GCS context for signal handlers Mark Brown
2024-02-20 2:03 ` Thiago Jung Bauermann
2024-02-03 12:25 ` [PATCH v8 24/38] arm64/signal: Expose GCS state in signal frames Mark Brown
2024-02-03 12:25 ` [PATCH v8 25/38] arm64/ptrace: Expose GCS via ptrace and core files Mark Brown
2024-02-03 12:25 ` [PATCH v8 26/38] arm64: Add Kconfig for Guarded Control Stack (GCS) Mark Brown
2024-02-03 12:25 ` [PATCH v8 27/38] kselftest/arm64: Verify the GCS hwcap Mark Brown
2024-02-03 12:25 ` [PATCH v8 28/38] kselftest/arm64: Add GCS as a detected feature in the signal tests Mark Brown
2024-02-03 12:25 ` [PATCH v8 29/38] kselftest/arm64: Add framework support for GCS to signal handling tests Mark Brown
2024-02-03 12:25 ` [PATCH v8 30/38] kselftest/arm64: Allow signals tests to specify an expected si_code Mark Brown
2024-02-03 12:25 ` [PATCH v8 31/38] kselftest/arm64: Always run signals tests with GCS enabled Mark Brown
2024-02-03 12:25 ` [PATCH v8 32/38] kselftest/arm64: Add very basic GCS test program Mark Brown
2024-02-03 12:25 ` [PATCH v8 33/38] kselftest/arm64: Add a GCS test program built with the system libc Mark Brown
2024-02-20 2:15 ` Thiago Jung Bauermann
2024-02-21 19:20 ` Mark Brown
2024-02-22 19:11 ` Mark Brown
2024-02-23 2:24 ` Thiago Jung Bauermann
2024-02-27 16:14 ` Mark Brown
2024-02-27 19:08 ` Thiago Jung Bauermann
2024-02-29 21:45 ` Mark Brown
2024-02-29 22:13 ` Thiago Jung Bauermann
2024-02-03 12:26 ` [PATCH v8 34/38] kselftest/arm64: Add test coverage for GCS mode locking Mark Brown
2024-02-03 12:26 ` [PATCH v8 35/38] selftests/arm64: Add GCS signal tests Mark Brown
2024-02-20 2:17 ` Thiago Jung Bauermann
2024-02-03 12:26 ` [PATCH v8 36/38] kselftest/arm64: Add a GCS stress test Mark Brown
2024-02-03 12:26 ` [PATCH v8 37/38] kselftest/arm64: Enable GCS for the FP stress tests Mark Brown
2024-02-03 12:26 ` [PATCH v8 38/38] kselftest: Provide shadow stack enable helpers for arm64 Mark Brown
2024-02-20 2:00 ` [PATCH v8 00/38] arm64/gcs: Provide support for GCS in userspace Thiago Jung Bauermann
2024-02-20 16:36 ` Stefan O'Rear
2024-02-20 18:41 ` Edgecombe, Rick P
2024-02-20 18:57 ` [musl] " Rich Felker
2024-02-20 23:30 ` Edgecombe, Rick P
2024-02-20 23:54 ` dalias
2024-02-21 0:35 ` Edgecombe, Rick P
2024-02-21 0:44 ` Mark Brown
2024-02-21 1:27 ` dalias
2024-02-21 2:11 ` Edgecombe, Rick P
2024-02-21 4:18 ` Edgecombe, Rick P
2024-02-21 13:53 ` Mark Brown
2024-02-21 14:58 ` dalias
2024-02-21 17:36 ` Mark Brown
2024-02-21 17:57 ` dalias
2024-02-21 18:12 ` Edgecombe, Rick P
2024-02-21 18:30 ` dalias
2024-02-21 18:53 ` Edgecombe, Rick P
2024-02-21 19:06 ` dalias
2024-02-21 19:22 ` Edgecombe, Rick P
2024-02-21 20:18 ` H.J. Lu
2024-02-21 20:25 ` H.J. Lu
2024-02-21 21:12 ` H.J. Lu
2024-02-21 20:18 ` dalias
2024-02-22 13:57 ` Mark Brown
2024-02-21 18:32 ` Mark Brown
2024-02-21 19:10 ` dalias
2024-03-02 14:57 ` Szabolcs Nagy
2024-03-02 15:05 ` H.J. Lu
2024-03-14 14:03 ` Mark Brown
2024-02-20 23:59 ` Stefan O'Rear
2024-02-21 0:40 ` Mark Brown
2024-02-21 4:30 ` Edgecombe, Rick P
2024-02-20 20:14 ` Mark Brown
2024-02-20 23:30 ` Edgecombe, Rick P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=868r3z6y6v.wl-maz@kernel.org \
--to=maz@kernel.org \
--cc=Szabolcs.Nagy@arm.com \
--cc=akpm@linux-foundation.org \
--cc=aou@eecs.berkeley.edu \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=brauner@kernel.org \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=corbet@lwn.net \
--cc=debug@rivosinc.com \
--cc=ebiederm@xmission.com \
--cc=fweimer@redhat.com \
--cc=hjl.tools@gmail.com \
--cc=james.morse@arm.com \
--cc=keescook@chromium.org \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-riscv@lists.infradead.org \
--cc=oleg@redhat.com \
--cc=oliver.upton@linux.dev \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=rick.p.edgecombe@intel.com \
--cc=shuah@kernel.org \
--cc=suzuki.poulose@arm.com \
--cc=thiago.bauermann@linaro.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).