Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp3735653yba; Tue, 23 Apr 2019 08:46:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqxE5+MTwczvynfmVNTjC3EVjmTDpMl2u6DNytRvC/jY8441f8/dwhzxRQY89w0/QeecxIAR X-Received: by 2002:a63:d24d:: with SMTP id t13mr25291288pgi.439.1556034394804; Tue, 23 Apr 2019 08:46:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1556034394; cv=none; d=google.com; s=arc-20160816; b=WfgkHhJsUk7gPtkLMvjGAmeJTasR8272a3zedVZHpFGoalHBpxovVixr3dopsujufc d18oG9S76X5zS25cqAr0D1IOAMLyH2bxVF2QttQqdeF7aI602dGaxAmeilaTQWiUmmXF iVmgSfE3tSkZGWLGtsBXNdOLs8xnduKEwPvFe4H+CCdxel055THI2JzfwgrNhHRBIrQJ qBjfcXxmqzfi9B6j+3jq5+kx962sVIRaUbFVP466bUpZlGQLC/V3sFTsZnCWdkWA5cZX 4atw9mOujFOD/RM0y4hE88Ei9KXI98cQOsFG56o1+w82KQLFFrZ4Xl9xVn0YawM6Fshe PKJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=VCNWl8NrbN52ABlbRb/4vfQXOm/PWQ9s2T5UD3mTkgM=; b=uLdXH/qLZEJaHh+W+2M8qmZAZDbd6BtF8TYCvy/bbGqov9MMKv4ZxHEbjgAw/omqSw ytHLdEj7K3GVfSrs9SNzsdOkohyuo40SDW5XHt2z5j4SlzlPZkoO9tggwzq6UAAPPaU+ LdIRUXQFQdt6Wv5Hg8DqZbJPCCBlKA8KDA2pT1WTu0OD1UjbL/h8elEaJqfx/BL68SQG 1wJ2xi2Pvi2mRIBce0uIwtG8zjDIEx3UDha/p66d000eYlqOgYOCFiNK1gqbEcemyROm xQ/yqxYmH/mxYTD5crmwILqU330ZVCRV7kgPM+vu48oxbRtZE7lU2RhIn/EpM23fePRr Xeiw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l3si14807236pgj.136.2019.04.23.08.46.19; Tue, 23 Apr 2019 08:46:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728476AbfDWPof (ORCPT + 99 others); Tue, 23 Apr 2019 11:44:35 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:58486 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728233AbfDWPof (ORCPT ); Tue, 23 Apr 2019 11:44:35 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 6FB6680D; Tue, 23 Apr 2019 08:44:34 -0700 (PDT) Received: from e103592.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id B37BD3F5AF; Tue, 23 Apr 2019 08:44:32 -0700 (PDT) Date: Tue, 23 Apr 2019 16:44:30 +0100 From: Dave Martin To: Amit Daniel Kachhap Cc: Marc Zyngier , linux-kernel@vger.kernel.org, Catalin Marinas , Will Deacon , Kristina Martsenko , kvmarm@lists.cs.columbia.edu, Ramana Radhakrishnan , linux-arm-kernel@lists.infradead.org Subject: Re: [PATCH v10 2/5] KVM: arm/arm64: context-switch ptrauth registers Message-ID: <20190423154430.GM3567@e103592.cambridge.arm.com> References: <1555994558-26349-1-git-send-email-amit.kachhap@arm.com> <1555994558-26349-3-git-send-email-amit.kachhap@arm.com> <8636m9awmu.wl-marc.zyngier@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 23, 2019 at 03:54:32PM +0530, Amit Daniel Kachhap wrote: > Hi Mark, > > On 4/23/19 3:09 PM, Marc Zyngier wrote: > >On Tue, 23 Apr 2019 05:42:35 +0100, > >Amit Daniel Kachhap wrote: > >> > >>From: Mark Rutland > >> > >>When pointer authentication is supported, a guest may wish to use it. > >>This patch adds the necessary KVM infrastructure for this to work, with > >>a semi-lazy context switch of the pointer auth state. > >> > >>Pointer authentication feature is only enabled when VHE is built > >>in the kernel and present in the CPU implementation so only VHE code > >>paths are modified. > >> > >>When we schedule a vcpu, we disable guest usage of pointer > >>authentication instructions and accesses to the keys. While these are > >>disabled, we avoid context-switching the keys. When we trap the guest > >>trying to use pointer authentication functionality, we change to eagerly > >>context-switching the keys, and enable the feature. The next time the > >>vcpu is scheduled out/in, we start again. However the host key save is > >>optimized and implemented inside ptrauth instruction/register access > >>trap. > >> > >>Pointer authentication consists of address authentication and generic > >>authentication, and CPUs in a system might have varied support for > >>either. Where support for either feature is not uniform, it is hidden > >>from guests via ID register emulation, as a result of the cpufeature > >>framework in the host. > >> > >>Unfortunately, address authentication and generic authentication cannot > >>be trapped separately, as the architecture provides a single EL2 trap > >>covering both. If we wish to expose one without the other, we cannot > >>prevent a (badly-written) guest from intermittently using a feature > >>which is not uniformly supported (when scheduled on a physical CPU which > >>supports the relevant feature). Hence, this patch expects both type of > >>authentication to be present in a cpu. > >> > >>This switch of key is done from guest enter/exit assembly as preparation > >>for the upcoming in-kernel pointer authentication support. Hence, these > >>key switching routines are not implemented in C code as they may cause > >>pointer authentication key signing error in some situations. > >> > >>Signed-off-by: Mark Rutland > >>[Only VHE, key switch in full assembly, vcpu_has_ptrauth checks > >>, save host key in ptrauth exception trap] > >>Signed-off-by: Amit Daniel Kachhap > >>Reviewed-by: Julien Thierry > >>Cc: Marc Zyngier > >>Cc: Christoffer Dall > >>Cc: kvmarm@lists.cs.columbia.edu > >>--- > >>Changes since v9: > >> > >>* Removed hardcoding of enum values[Mark Zyngier]. > >>* Changed kvm_ptrauth_asm.h to kvm_ptrauth.h[Mark Zyngier]. > >>* Removed macro __ptrauth_save_state and applied inline [Marc Zyngier]. > >>* Moved kvm_arm_vcpu_ptrauth_setup_lazy, kvm_arm_vcpu_ptrauth_enable and > >> kvm_arm_vcpu_ptrauth_disable from *.c to kvm_emulate.h file [Marc Zyngier]. > >>* Added/Modified comments at few places [Marc Zyngier]. > >> > >> arch/arm/include/asm/kvm_emulate.h | 2 + > >> arch/arm64/Kconfig | 5 +- > >> arch/arm64/include/asm/kvm_emulate.h | 16 ++++++ > >> arch/arm64/include/asm/kvm_host.h | 14 +++++ > >> arch/arm64/include/asm/kvm_ptrauth.h | 108 +++++++++++++++++++++++++++++++++++ > >> arch/arm64/kernel/asm-offsets.c | 6 ++ > >> arch/arm64/kvm/handle_exit.c | 36 +++++++++--- > >> arch/arm64/kvm/hyp/entry.S | 15 +++++ > >> arch/arm64/kvm/sys_regs.c | 43 +++++++++++++- > >> virt/kvm/arm/arm.c | 2 + > >> 10 files changed, 234 insertions(+), 13 deletions(-) > >> create mode 100644 arch/arm64/include/asm/kvm_ptrauth.h [...] > >>diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > >>index 7e34b9e..3cfe2eb 100644 > >>--- a/arch/arm64/Kconfig > >>+++ b/arch/arm64/Kconfig > >>@@ -1301,8 +1301,9 @@ config ARM64_PTR_AUTH > >> context-switched along with the process. > >> The feature is detected at runtime. If the feature is not present in > >>- hardware it will not be advertised to userspace nor will it be > >>- enabled. > >>+ hardware it will not be advertised to userspace/KVM guest nor will it > >>+ be enabled. However, KVM guest also require VHE mode and hence > >>+ CONFIG_ARM64_VHE=y option to use this feature. > > > >SVE seems to have the exact same requirements, and has > > > > depends on !KVM || ARM64_VHE > > > >Why don't we have that for PTR_AUTH too? > This point came up earlier also and it was suggested by Dave[1] to leave > userspace ptrauth for non-vhe mode as that would bring regression now. > [1]:https://lkml.org/lkml/2019/3/27/583 I see Marc applied this change in https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git/commit/?h=queue&id=e19b245fa4c61558536bd34f80845f0c41eab65f0 The risk here is that someone has a custom config from an old kernel that explicitly turns CONFIG_ARM64_VHE off, and that try to use that config with this patch. I'm not sure how much we care about that. Otherwise, blocking this config so that people don't accidentally rely on it seems sensible. [...] Cheers ---Dave