From patchwork Tue Jan 17 01:35:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Reiji Watanabe X-Patchwork-Id: 13104028 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 952DCC46467 for ; Tue, 17 Jan 2023 01:40:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=N31dRUsFFo2G5q6g6YpWdxpS2moiU4DUIy0RCgGyBc8=; b=e14AEG3iK5APiM4Ig9NQU0ao7A nQibTVn+X3zuP1/KrS3x3kPFkwCmbNhLnRk5P11b/E7HMUhA+EDZZQ1gxdqKZABFppyVCgKyfA2v7 y2l+8cUdCKuCT5UauK8y5plBaFqi2NFnjGiawBOT/NagSHk9Iako7lzrBXwYj5HrseZDIaJ2sXjv5 qG9rIuEOe6x+AmCQH7siYo77d6T2KyKzGc1Kiq+ysP6EkZfGzH/lb183Yn0QiJnbSvWQFdjuDkQ74 foA4DS4cZz84/z1cb8+JTlNscE8qH2JreISXt+I13zB5aHg30pMNBjeQYoSdbnYcJZuYemWPSk8gl hmbEzoyg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1pHavl-00CVKf-Vt; Tue, 17 Jan 2023 01:38:30 +0000 Received: from mail-pj1-x104a.google.com ([2607:f8b0:4864:20::104a]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1pHavj-00CVJX-AK for linux-arm-kernel@lists.infradead.org; Tue, 17 Jan 2023 01:38:28 +0000 Received: by mail-pj1-x104a.google.com with SMTP id o19-20020a17090a9f9300b002296c011686so1425574pjp.8 for ; Mon, 16 Jan 2023 17:38:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=SDhGZMGcl/+rCpQW7EzsP5A7EK7uMx6I717AP5BdSVE=; b=g3A+F2lovTBusknN04Pspphh2sOZEygyJHo6g0SrJ2qVG/CZS9TOHepUiFMEbeu2P7 +pbgUZcUYF9GlDu2Noju5TPTZatLo7dvV3wDHPHHLXd7YJ9d+17CzdZGeEHU0NL4BMYF rcTYh00PPwtNgsZ5yVDHHXSEHB5qB5IITaq2PmI67NCedEepfxXkNWDlmZrX+EBPgqAI pIGKaWKriMwjqFxECsiRor9wGaYSvU1+JKqrYzRyYHNVdGAb8aiO6l5y2aoYhYKiNmyz GLk9+y/dlVZ3Ae67oQRNlOcxe92GGHLfiG6kT5OlPZtVfxpx1K9Mty5YY4ISn/Piwj1A DtIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=SDhGZMGcl/+rCpQW7EzsP5A7EK7uMx6I717AP5BdSVE=; b=eCse5iwh4s9h29uouHU8msxGwRveLrdw8VtY4h7Fu5vcjpM9Rm1+80VQzLo2fbnBLs Fr66+jkyQUEFQd8rAOJsVNHfT5MyTWPdhcLBtPYRWFmxmQBCMX8TtjxeA15YHV1gnk1E uuzUTUZl68ZTF9VxY9oyFrw/dOkk+EHyY5SeJTsjwF9qcDRjDJx3klAOk8TjN97TXiIG zVKQYow704vALY7aBg9ye3ImEWqTs+7j+hqJWAyutTddJZCItkeepdc8ZRTpEfrNtmAu DcNUVy6psVvHyLkkgLzIFG/DdfyoKzaJQU/Hi1wI8x9e+CaIDEMM07xOIdGpSBL/KoOs HV1w== X-Gm-Message-State: AFqh2krNYDz2F4zwE1H45UDrJ/bRBKM5GZyGVo+4zeV3GZH5/hGmQYd0 qbOAQgZPp3C77KvUp2xVYyIL5hlG8CA= X-Google-Smtp-Source: AMrXdXuVU/+Elb5Rp0AHcmNgcHCXEJox4jaCx2mUWqCwLJEwmIXLFTyN3/3HemE7+V5HT6N4PiGUjHLD8m8= X-Received: from reijiw-west4.c.googlers.com ([fda3:e722:ac3:cc00:20:ed76:c0a8:aa1]) (user=reijiw job=sendgmr) by 2002:aa7:9f95:0:b0:578:1e16:f788 with SMTP id z21-20020aa79f95000000b005781e16f788mr134098pfr.12.1673919505841; Mon, 16 Jan 2023 17:38:25 -0800 (PST) Date: Mon, 16 Jan 2023 17:35:38 -0800 In-Reply-To: <20230117013542.371944-1-reijiw@google.com> Mime-Version: 1.0 References: <20230117013542.371944-1-reijiw@google.com> X-Mailer: git-send-email 2.39.0.314.g84b9a713c41-goog Message-ID: <20230117013542.371944-5-reijiw@google.com> Subject: [PATCH v2 4/8] KVM: arm64: PMU: Disallow userspace to set PMCR.N greater than the host value From: Reiji Watanabe To: Marc Zyngier , kvmarm@lists.linux.dev Cc: kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, James Morse , Alexandru Elisei , Zenghui Yu , Suzuki K Poulose , Paolo Bonzini , Ricardo Koller , Oliver Upton , Jing Zhang , Raghavendra Rao Anata , Reiji Watanabe X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230116_173827_379790_563DA96B X-CRM114-Status: GOOD ( 19.07 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Currently, KVM allows userspace to set PMCR_EL0 to any values with KVM_SET_ONE_REG for a vCPU with PMUv3 configured. Disallow userspace to set PMCR_EL0.N to a value that is greater than the host value (KVM_SET_ONE_REG will fail), as KVM doesn't support more event counters than the host HW implements. Although this is an ABI change, this change only affects userspace setting PMCR_EL0.N to a larger value than the host. As accesses to unadvertised event counters indices is CONSTRAINED UNPREDICTABLE behavior, and PMCR_EL0.N was reset to the host value on every vCPU reset before this series, I can't think of any use case where a user space would do that. Also, ignore writes to read-only bits that are cleared on vCPU reset, and RES{0,1} bits (including writable bits that KVM doesn't support yet), as those bits shouldn't be modified (at least with the current KVM). Signed-off-by: Reiji Watanabe Reviewed-by: Marc Zyngier --- arch/arm64/kvm/sys_regs.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 67c1bd39b478..e4bff9621473 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -958,6 +958,43 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, return true; } +static int set_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r, + u64 val) +{ + u64 host_pmcr, host_n, new_n, mutable_mask; + + new_n = (val >> ARMV8_PMU_PMCR_N_SHIFT) & ARMV8_PMU_PMCR_N_MASK; + + host_pmcr = read_sysreg(pmcr_el0); + host_n = (host_pmcr >> ARMV8_PMU_PMCR_N_SHIFT) & ARMV8_PMU_PMCR_N_MASK; + + /* The vCPU can't have more counters than the host have. */ + if (new_n > host_n) + return -EINVAL; + + /* + * Ignore writes to RES0 bits, read only bits that are cleared on + * vCPU reset, and writable bits that KVM doesn't support yet. + * (i.e. only PMCR.N and bits [7:0] are mutable from userspace) + * The LP bit is RES0 when FEAT_PMUv3p5 is not supported on the vCPU. + * But, we leave the bit as it is here, as the vCPU's PMUver might + * be changed later (NOTE: the bit will be cleared on first vCPU run + * if necessary). + */ + mutable_mask = (ARMV8_PMU_PMCR_MASK | + (ARMV8_PMU_PMCR_N_MASK << ARMV8_PMU_PMCR_N_SHIFT)); + val &= mutable_mask; + val |= (__vcpu_sys_reg(vcpu, r->reg) & ~mutable_mask); + + /* The LC bit is RES1 when AArch32 is not supported */ + if (!kvm_supports_32bit_el0()) + val |= ARMV8_PMU_PMCR_LC; + + __vcpu_sys_reg(vcpu, r->reg) = val; + + return 0; +} + /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */ #define DBG_BCR_BVR_WCR_WVR_EL1(n) \ { SYS_DESC(SYS_DBGBVRn_EL1(n)), \ @@ -1718,7 +1755,7 @@ static const struct sys_reg_desc sys_reg_descs[] = { { SYS_DESC(SYS_SVCR), undef_access }, { PMU_SYS_REG(SYS_PMCR_EL0), .access = access_pmcr, - .reset = reset_pmcr, .reg = PMCR_EL0 }, + .reset = reset_pmcr, .reg = PMCR_EL0, .set_user = set_pmcr }, { PMU_SYS_REG(SYS_PMCNTENSET_EL0), .access = access_pmcnten, .reg = PMCNTENSET_EL0 }, { PMU_SYS_REG(SYS_PMCNTENCLR_EL0),