| Message ID | 20220125153803.549084-5-james.morse@arm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: arm64: A510 errata workaround and fixes for fixup_guest_exit() | expand |
Hi James, Thanks for this. I guess. On Tue, 25 Jan 2022 15:38:03 +0000, James Morse <james.morse@arm.com> wrote: > > Cortex-A510's erratum #2077057 causes SPSR_EL2 to be corrupted when > single-stepping authenticated ERET instructions. A single step is > expected, but a pointer authentication trap is taken instead. The > erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow > EL1 to cause a return to EL2 with a guest controlled ELR_EL2. > > Because the conditions require an ERET into active-not-pending state, > this is only a problem for the EL2 when EL2 is stepping EL1. In this case > the previous SPSR_EL2 value is preserved in struct kvm_vcpu, and can be > restored. Urgh. That's pretty nasty :-(. > > Cc: stable@vger.kernel.org # ${GITHASHHERE}: arm64: Add Cortex-A510 CPU part definition > Cc: stable@vger.kernel.org > Signed-off-by: James Morse <james.morse@arm.com> > --- > Documentation/arm64/silicon-errata.rst | 2 ++ > arch/arm64/Kconfig | 16 ++++++++++++++++ > arch/arm64/kernel/cpu_errata.c | 8 ++++++++ > arch/arm64/kvm/hyp/include/hyp/switch.h | 24 +++++++++++++++++++++--- > arch/arm64/tools/cpucaps | 1 + > 5 files changed, 48 insertions(+), 3 deletions(-) > > diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst > index 5342e895fb60..ac1ae34564c9 100644 > --- a/Documentation/arm64/silicon-errata.rst > +++ b/Documentation/arm64/silicon-errata.rst > @@ -92,6 +92,8 @@ stable kernels. > +----------------+-----------------+-----------------+-----------------------------+ > | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | > +----------------+-----------------+-----------------+-----------------------------+ > +| ARM | Cortex-A510 | #2077057 | ARM64_ERRATUM_2077057 | > ++----------------+-----------------+-----------------+-----------------------------+ > | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | > +----------------+-----------------+-----------------+-----------------------------+ > | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 | > diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > index 6978140edfa4..02b542ec18c8 100644 > --- a/arch/arm64/Kconfig > +++ b/arch/arm64/Kconfig > @@ -670,6 +670,22 @@ config ARM64_ERRATUM_1508412 > config ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE > bool > > +config ARM64_ERRATUM_2077057 > + bool "Cortex-A510: 2077057: workaround software-step corrupting SPSR_EL2" > + help > + This option adds the workaround for ARM Cortex-A510 erratum 2077057. > + Affected Cortex-A510 may corrupt SPSR_EL2 when the a step exception is > + expected, but a Pointer Authentication trap is taken instead. The > + erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow > + EL1 to cause a return to EL2 with a guest controlled ELR_EL2. > + > + This can only happen when EL2 is stepping EL1. > + > + When these conditions occur, the SPSR_EL2 value is unchanged from the > + previous guest entry, and can be restored from the in-memory copy. > + > + If unsure, say Y. > + > config ARM64_ERRATUM_2119858 > bool "Cortex-A710: 2119858: workaround TRBE overwriting trace data in FILL mode" > default y > diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c > index 9e1c1aef9ebd..04a014c63251 100644 > --- a/arch/arm64/kernel/cpu_errata.c > +++ b/arch/arm64/kernel/cpu_errata.c > @@ -597,6 +597,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = { > .type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE, > CAP_MIDR_RANGE_LIST(trbe_write_out_of_range_cpus), > }, > +#endif > +#ifdef CONFIG_ARM64_ERRATUM_2077057 > + { > + .desc = "ARM erratum 2077057", > + .capability = ARM64_WORKAROUND_2077057, > + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, > + ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A510, 0, 0, 2), > + }, > #endif > { > } > diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h > index 331dd10821df..93bf140cc972 100644 > --- a/arch/arm64/kvm/hyp/include/hyp/switch.h > +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h > @@ -409,6 +409,8 @@ static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > */ > static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > { > + u8 esr_ec; > + > /* > * Save PSTATE early so that we can evaluate the vcpu mode > * early on. > @@ -421,13 +423,13 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > */ > early_exit_filter(vcpu, exit_code); > > - if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) > + if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) { > vcpu->arch.fault.esr_el2 = read_sysreg_el2(SYS_ESR); > + esr_ec = kvm_vcpu_trap_get_class(vcpu); > + } > > if (ARM_SERROR_PENDING(*exit_code) && > ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) { > - u8 esr_ec = kvm_vcpu_trap_get_class(vcpu); > - > /* > * HVC already have an adjusted PC, which we need to > * correct in order to return to after having injected > @@ -440,6 +442,22 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR); > } > > + /* > + * Check for the conditions of Cortex-A510's #2077057. When these occur > + * SPSR_EL2 can't be trusted, but isn't needed either as it is > + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. > + * Did we just take a PAC exception when a step exception was expected? > + */ > + if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057) && nit: we can drop this IS_ENABLED()... > + cpus_have_const_cap(ARM64_WORKAROUND_2077057) && and make this a final cap. Being a ARM64_CPUCAP_LOCAL_CPU_ERRATUM, we won't accept late CPUs on a system that wasn't affected until then. > + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && > + esr_ec == ESR_ELx_EC_PAC && > + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { > + /* Active-not-pending? */ > + if (*vcpu_cpsr(vcpu) & DBG_SPSR_SS) > + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); Err... Isn't this way too late? The function starts with: vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); which is just another way to write: *vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR); By that time, the vcpu's PSTATE is terminally corrupted. I think you need to hoist this workaround way up, before we call into early_exit_filter() as it will assume that the guest pstate is correct (this is used by both pKVM and the NV code). Something like this (untested): diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h index 93bf140cc972..a8a1502db237 100644 --- a/arch/arm64/kvm/hyp/include/hyp/switch.h +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h @@ -402,6 +402,26 @@ static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) return false; } +static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, + u64 *exit_code) +{ + /* + * Check for the conditions of Cortex-A510's #2077057. When these occur + * SPSR_EL2 can't be trusted, but isn't needed either as it is + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. + * Did we just take a PAC exception when a step exception (being in the + * Active-not-pending state) was expected? + */ + if (cpus_have_final_cap(ARM64_WORKAROUND_2077057) && + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && + kvm_vcpu_trap_get_class(vcpu) == ESR_ELx_EC_PAC && + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP && + *vcpu_cpsr(vcpu) & DBG_SPSR_SS) + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); + + *vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR); +} + /* * Return true when we were able to fixup the guest exit and should return to * the guest, false when we should restore the host state and return to the @@ -415,7 +435,7 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) * Save PSTATE early so that we can evaluate the vcpu mode * early on. */ - vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); + synchronize_vcpu_pstate(vcpu, exit_code); /* * Check whether we want to repaint the state one way or @@ -442,22 +462,6 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR); } - /* - * Check for the conditions of Cortex-A510's #2077057. When these occur - * SPSR_EL2 can't be trusted, but isn't needed either as it is - * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. - * Did we just take a PAC exception when a step exception was expected? - */ - if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057) && - cpus_have_const_cap(ARM64_WORKAROUND_2077057) && - ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && - esr_ec == ESR_ELx_EC_PAC && - vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { - /* Active-not-pending? */ - if (*vcpu_cpsr(vcpu) & DBG_SPSR_SS) - write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); - } - /* * We're using the raw exception code in order to only process * the trap if no SError is pending. We will come back to the > + } > + > /* > * We're using the raw exception code in order to only process > * the trap if no SError is pending. We will come back to the > diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps > index 870c39537dd0..2e7cd3fecca6 100644 > --- a/arch/arm64/tools/cpucaps > +++ b/arch/arm64/tools/cpucaps > @@ -55,6 +55,7 @@ WORKAROUND_1418040 > WORKAROUND_1463225 > WORKAROUND_1508412 > WORKAROUND_1542419 > +WORKAROUND_2077057 > WORKAROUND_TRBE_OVERWRITE_FILL_MODE > WORKAROUND_TSB_FLUSH_FAILURE > WORKAROUND_TRBE_WRITE_OUT_OF_RANGE Other than that, I'm happy to take the series as a whole ASAP, if only for the two pretty embarrassing bug fixes. If you can respin it shortly and address the comments above, I'd like it into -rc2. Thanks, M.
Hi Marc, On 25/01/2022 16:51, Marc Zyngier wrote: > On Tue, 25 Jan 2022 15:38:03 +0000, > James Morse <james.morse@arm.com> wrote: >> >> Cortex-A510's erratum #2077057 causes SPSR_EL2 to be corrupted when >> single-stepping authenticated ERET instructions. A single step is >> expected, but a pointer authentication trap is taken instead. The >> erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow >> EL1 to cause a return to EL2 with a guest controlled ELR_EL2. >> >> Because the conditions require an ERET into active-not-pending state, >> this is only a problem for the EL2 when EL2 is stepping EL1. In this case >> the previous SPSR_EL2 value is preserved in struct kvm_vcpu, and can be >> restored. > Urgh. That's pretty nasty :-(. >> diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h >> index 331dd10821df..93bf140cc972 100644 >> --- a/arch/arm64/kvm/hyp/include/hyp/switch.h >> +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h >> @@ -440,6 +442,22 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) >> write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR); >> } >> >> + /* >> + * Check for the conditions of Cortex-A510's #2077057. When these occur >> + * SPSR_EL2 can't be trusted, but isn't needed either as it is >> + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. >> + * Did we just take a PAC exception when a step exception was expected? >> + */ >> + if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057) && > > nit: we can drop this IS_ENABLED()... Hmmm, I thought dead code elimination was a good thing! Without the cpu_errata.c match, (which is also guarded by #ifdef), the cap will never be true, even if an affected CPU showed up. This way the compiler knows it can remove all this. >> + cpus_have_const_cap(ARM64_WORKAROUND_2077057) && > > and make this a final cap. Being a ARM64_CPUCAP_LOCAL_CPU_ERRATUM, we > won't accept late CPUs on a system that wasn't affected until then. > >> + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && >> + esr_ec == ESR_ELx_EC_PAC && >> + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { >> + /* Active-not-pending? */ >> + if (*vcpu_cpsr(vcpu) & DBG_SPSR_SS) >> + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); > > Err... Isn't this way too late? The function starts with: > > vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); > > which is just another way to write: > > *vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR); > > By that time, the vcpu's PSTATE is terminally corrupted. Yes - bother. Staring at it didn't let me spot that! I can hit the conditions to test this, but due to lack of imagination the model doesn't corrupt the SPSR. > I think you need to hoist this workaround way up, before we call into > early_exit_filter() as it will assume that the guest pstate is correct > (this is used by both pKVM and the NV code). > > Something like this (untested): > > diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h > index 93bf140cc972..a8a1502db237 100644 > --- a/arch/arm64/kvm/hyp/include/hyp/switch.h > +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h > @@ -402,6 +402,26 @@ static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > return false; > } > > +static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, > + u64 *exit_code) > +{ > + /* > + * Check for the conditions of Cortex-A510's #2077057. When these occur > + * SPSR_EL2 can't be trusted, but isn't needed either as it is > + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. > + * Did we just take a PAC exception when a step exception (being in the > + * Active-not-pending state) was expected? > + */ > + if (cpus_have_final_cap(ARM64_WORKAROUND_2077057) && > + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && > + kvm_vcpu_trap_get_class(vcpu) == ESR_ELx_EC_PAC && The vcpu's esr_el2 isn't yet set: | ESR_ELx_EC(read_sysreg_el2(SYS_ESR)) == ESR_ELx_EC_PAC (and I'll shuffle the order so this is last as its an extra sysreg read) > + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP && > + *vcpu_cpsr(vcpu) & DBG_SPSR_SS) > + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); > + > + *vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR); > +} > + > /* > * Return true when we were able to fixup the guest exit and should return to > * the guest, false when we should restore the host state and return to the > @@ -415,7 +435,7 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > * Save PSTATE early so that we can evaluate the vcpu mode > * early on. > */ > - vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); > + synchronize_vcpu_pstate(vcpu, exit_code); Even better, that saves the noise from moving esr_ec around! > Other than that, I'm happy to take the series as a whole ASAP, if only > for the two pretty embarrassing bug fixes. If you can respin it > shortly and address the comments above, I'd like it into -rc2. Will do. Shout if you strongly care about the IS_ENABLED(). Thanks, James
On Tue, 25 Jan 2022 18:19:45 +0000, James Morse <james.morse@arm.com> wrote: > > Hi Marc, > > On 25/01/2022 16:51, Marc Zyngier wrote: > > On Tue, 25 Jan 2022 15:38:03 +0000, > > James Morse <james.morse@arm.com> wrote: > >> > >> Cortex-A510's erratum #2077057 causes SPSR_EL2 to be corrupted when > >> single-stepping authenticated ERET instructions. A single step is > >> expected, but a pointer authentication trap is taken instead. The > >> erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow > >> EL1 to cause a return to EL2 with a guest controlled ELR_EL2. > >> > >> Because the conditions require an ERET into active-not-pending state, > >> this is only a problem for the EL2 when EL2 is stepping EL1. In this case > >> the previous SPSR_EL2 value is preserved in struct kvm_vcpu, and can be > >> restored. > > > Urgh. That's pretty nasty :-(. > > >> diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h > >> index 331dd10821df..93bf140cc972 100644 > >> --- a/arch/arm64/kvm/hyp/include/hyp/switch.h > >> +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h > >> @@ -440,6 +442,22 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > >> write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR); > >> } > >> > >> + /* > >> + * Check for the conditions of Cortex-A510's #2077057. When these occur > >> + * SPSR_EL2 can't be trusted, but isn't needed either as it is > >> + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. > >> + * Did we just take a PAC exception when a step exception was expected? > >> + */ > >> + if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057) && > > > > nit: we can drop this IS_ENABLED()... > > Hmmm, I thought dead code elimination was a good thing! > Without the cpu_errata.c match, (which is also guarded by #ifdef), > the cap will never be true, even if an affected CPU showed up. This > way the compiler knows it can remove all this. I don't dispute that. However, experience shows that the more of these we sprinkle around, the quicker this code bitrots as we don't build for all the possible configurations. In general, we hardly have any dependency on configuration symbols, and rely on static keys got things not be terribly sucky. > > > >> + cpus_have_const_cap(ARM64_WORKAROUND_2077057) && > > > > and make this a final cap. Being a ARM64_CPUCAP_LOCAL_CPU_ERRATUM, we > > won't accept late CPUs on a system that wasn't affected until then. > > > >> + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && > >> + esr_ec == ESR_ELx_EC_PAC && > >> + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { > >> + /* Active-not-pending? */ > >> + if (*vcpu_cpsr(vcpu) & DBG_SPSR_SS) > >> + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); > > > > Err... Isn't this way too late? The function starts with: > > > > vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); > > > > which is just another way to write: > > > > *vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR); > > > > By that time, the vcpu's PSTATE is terminally corrupted. > > Yes - bother. Staring at it didn't let me spot that! > I can hit the conditions to test this, but due to lack of > imagination the model doesn't corrupt the SPSR. Bad model. ;-) > > > > I think you need to hoist this workaround way up, before we call into > > early_exit_filter() as it will assume that the guest pstate is correct > > (this is used by both pKVM and the NV code). > > > > Something like this (untested): > > > > diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h > > index 93bf140cc972..a8a1502db237 100644 > > --- a/arch/arm64/kvm/hyp/include/hyp/switch.h > > +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h > > @@ -402,6 +402,26 @@ static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > > return false; > > } > > > > +static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, > > + u64 *exit_code) > > +{ > > + /* > > + * Check for the conditions of Cortex-A510's #2077057. When these occur > > + * SPSR_EL2 can't be trusted, but isn't needed either as it is > > + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. > > + * Did we just take a PAC exception when a step exception (being in the > > + * Active-not-pending state) was expected? > > + */ > > + if (cpus_have_final_cap(ARM64_WORKAROUND_2077057) && > > + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && > > > + kvm_vcpu_trap_get_class(vcpu) == ESR_ELx_EC_PAC && > > The vcpu's esr_el2 isn't yet set: > | ESR_ELx_EC(read_sysreg_el2(SYS_ESR)) == ESR_ELx_EC_PAC Ah, well spotted! > > (and I'll shuffle the order so this is last as its an extra sysreg read) > > > > + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP && > > + *vcpu_cpsr(vcpu) & DBG_SPSR_SS) > > + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); > > + > > + *vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR); > > +} > > + > > /* > > * Return true when we were able to fixup the guest exit and should return to > > * the guest, false when we should restore the host state and return to the > > @@ -415,7 +435,7 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > > * Save PSTATE early so that we can evaluate the vcpu mode > > * early on. > > */ > > - vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); > > + synchronize_vcpu_pstate(vcpu, exit_code); > > Even better, that saves the noise from moving esr_ec around! Yup, the patch becomes marginally smaller. > > > > Other than that, I'm happy to take the series as a whole ASAP, if only > > for the two pretty embarrassing bug fixes. If you can respin it > > shortly and address the comments above, I'd like it into -rc2. > > Will do. Shout if you strongly care about the IS_ENABLED(). I'd really like it gone. Otherwise, I'll never compile that code. Thanks, M.
Hi Marc, On 25/01/2022 18:36, Marc Zyngier wrote: > On Tue, 25 Jan 2022 18:19:45 +0000, > James Morse <james.morse@arm.com> wrote: >> On 25/01/2022 16:51, Marc Zyngier wrote: >>> On Tue, 25 Jan 2022 15:38:03 +0000, >>> James Morse <james.morse@arm.com> wrote: >>>> >>>> Cortex-A510's erratum #2077057 causes SPSR_EL2 to be corrupted when >>>> single-stepping authenticated ERET instructions. A single step is >>>> expected, but a pointer authentication trap is taken instead. The >>>> erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow >>>> EL1 to cause a return to EL2 with a guest controlled ELR_EL2. >>>> >>>> Because the conditions require an ERET into active-not-pending state, >>>> this is only a problem for the EL2 when EL2 is stepping EL1. In this case >>>> the previous SPSR_EL2 value is preserved in struct kvm_vcpu, and can be >>>> restored. >>>> diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h >>>> index 331dd10821df..93bf140cc972 100644 >>>> --- a/arch/arm64/kvm/hyp/include/hyp/switch.h >>>> +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h >>>> @@ -440,6 +442,22 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) >>>> write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR); >>>> } >>>> >>>> + /* >>>> + * Check for the conditions of Cortex-A510's #2077057. When these occur >>>> + * SPSR_EL2 can't be trusted, but isn't needed either as it is >>>> + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. >>>> + * Did we just take a PAC exception when a step exception was expected? >>>> + */ >>>> + if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057) && >>> >>> nit: we can drop this IS_ENABLED()... >> >> Hmmm, I thought dead code elimination was a good thing! >> Without the cpu_errata.c match, (which is also guarded by #ifdef), >> the cap will never be true, even if an affected CPU showed up. This >> way the compiler knows it can remove all this. > I don't dispute that. However, experience shows that the more of these > we sprinkle around, the quicker this code bitrots as we don't build > for all the possible configurations. In general, we hardly have any > dependency on configuration symbols, and rely on static keys got > things not be terribly sucky. I'll remove it - but I'm not convinced: If this were in an #ifdef block, I agree that would prevent the compiler from even seeing this code, and it would certainly bitrot if that Kconfig isn't selected, and would not be build-tested properly in all the bizarre cases that only CI systems try. But the IS_ENABLED() stuff lets the compiler can see inside that block, and means the compiler can check the types etc, before eventually removing it as the condition becomes "if(false)". For example: | if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057)) | synchronize_vcpu_pstate(42); This fails to compile regardless of the value of the Kconfig symbol: | In file included from arch/arm64/kvm/hyp/vhe/switch.c:7: | ./arch/arm64/kvm/hyp/include/hyp/switch.h: In function ‘synchronize_vcpu_pstate’: | ./arch/arm64/kvm/hyp/include/hyp/switch.h:415:27: warning: passing argument 1 of | ‘synchronize_vcpu_pstate’ makes pointer from integer without a cast [-Wint-conversion] | 415 | synchronize_vcpu_pstate(42); | | ./arch/arm64/kvm/hyp/include/hyp/switch.h:405:61: note: expected ‘struct kvm_vcpu *’ but | argument is of type ‘int’ | 405 | static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, u64 *exit_code) etc. | cat .config | grep 2077057 | # CONFIG_ARM64_ERRATUM_2077057 is not set I guess you're worried about link errors. [..] >>> Other than that, I'm happy to take the series as a whole ASAP, if only >>> for the two pretty embarrassing bug fixes. If you can respin it >>> shortly and address the comments above, I'd like it into -rc2. >> >> Will do. Shout if you strongly care about the IS_ENABLED(). > > I'd really like it gone. Otherwise, I'll never compile that code. Thanks, James
diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 5342e895fb60..ac1ae34564c9 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -92,6 +92,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A510 | #2077057 | ARM64_ERRATUM_2077057 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6978140edfa4..02b542ec18c8 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -670,6 +670,22 @@ config ARM64_ERRATUM_1508412 config ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE bool +config ARM64_ERRATUM_2077057 + bool "Cortex-A510: 2077057: workaround software-step corrupting SPSR_EL2" + help + This option adds the workaround for ARM Cortex-A510 erratum 2077057. + Affected Cortex-A510 may corrupt SPSR_EL2 when the a step exception is + expected, but a Pointer Authentication trap is taken instead. The + erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow + EL1 to cause a return to EL2 with a guest controlled ELR_EL2. + + This can only happen when EL2 is stepping EL1. + + When these conditions occur, the SPSR_EL2 value is unchanged from the + previous guest entry, and can be restored from the in-memory copy. + + If unsure, say Y. + config ARM64_ERRATUM_2119858 bool "Cortex-A710: 2119858: workaround TRBE overwriting trace data in FILL mode" default y diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 9e1c1aef9ebd..04a014c63251 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -597,6 +597,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE, CAP_MIDR_RANGE_LIST(trbe_write_out_of_range_cpus), }, +#endif +#ifdef CONFIG_ARM64_ERRATUM_2077057 + { + .desc = "ARM erratum 2077057", + .capability = ARM64_WORKAROUND_2077057, + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, + ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A510, 0, 0, 2), + }, #endif { } diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h index 331dd10821df..93bf140cc972 100644 --- a/arch/arm64/kvm/hyp/include/hyp/switch.h +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h @@ -409,6 +409,8 @@ static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) */ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) { + u8 esr_ec; + /* * Save PSTATE early so that we can evaluate the vcpu mode * early on. @@ -421,13 +423,13 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) */ early_exit_filter(vcpu, exit_code); - if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) + if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) { vcpu->arch.fault.esr_el2 = read_sysreg_el2(SYS_ESR); + esr_ec = kvm_vcpu_trap_get_class(vcpu); + } if (ARM_SERROR_PENDING(*exit_code) && ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) { - u8 esr_ec = kvm_vcpu_trap_get_class(vcpu); - /* * HVC already have an adjusted PC, which we need to * correct in order to return to after having injected @@ -440,6 +442,22 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR); } + /* + * Check for the conditions of Cortex-A510's #2077057. When these occur + * SPSR_EL2 can't be trusted, but isn't needed either as it is + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. + * Did we just take a PAC exception when a step exception was expected? + */ + if (IS_ENABLED(CONFIG_ARM64_ERRATUM_2077057) && + cpus_have_const_cap(ARM64_WORKAROUND_2077057) && + ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ && + esr_ec == ESR_ELx_EC_PAC && + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { + /* Active-not-pending? */ + if (*vcpu_cpsr(vcpu) & DBG_SPSR_SS) + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); + } + /* * We're using the raw exception code in order to only process * the trap if no SError is pending. We will come back to the diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index 870c39537dd0..2e7cd3fecca6 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -55,6 +55,7 @@ WORKAROUND_1418040 WORKAROUND_1463225 WORKAROUND_1508412 WORKAROUND_1542419 +WORKAROUND_2077057 WORKAROUND_TRBE_OVERWRITE_FILL_MODE WORKAROUND_TSB_FLUSH_FAILURE WORKAROUND_TRBE_WRITE_OUT_OF_RANGE
Cortex-A510's erratum #2077057 causes SPSR_EL2 to be corrupted when single-stepping authenticated ERET instructions. A single step is expected, but a pointer authentication trap is taken instead. The erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow EL1 to cause a return to EL2 with a guest controlled ELR_EL2. Because the conditions require an ERET into active-not-pending state, this is only a problem for the EL2 when EL2 is stepping EL1. In this case the previous SPSR_EL2 value is preserved in struct kvm_vcpu, and can be restored. Cc: stable@vger.kernel.org # ${GITHASHHERE}: arm64: Add Cortex-A510 CPU part definition Cc: stable@vger.kernel.org Signed-off-by: James Morse <james.morse@arm.com> --- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 16 ++++++++++++++++ arch/arm64/kernel/cpu_errata.c | 8 ++++++++ arch/arm64/kvm/hyp/include/hyp/switch.h | 24 +++++++++++++++++++++--- arch/arm64/tools/cpucaps | 1 + 5 files changed, 48 insertions(+), 3 deletions(-)