KVM: arm64: Allow setting of ID_AA64PFR0_EL1.CSV2 from userspace

We now expose ID_AA64PFR0_EL1.CSV2=1 to guests running on hosts
that are immune to Spectre-v2, but that don't have this field set,
most likely because they predate the specification.

However, this prevents the migration of guests that have started on
a host the doesn't fake this CSV2 setting to one that does, as KVM
rejects the write to ID_AA64PFR0_EL2 on the grounds that it isn't
what is already there.

In order to fix this, allow userspace to set this field as long as
this doesn't result in a promising more than what is already there
(setting CSV2 to 0 is acceptable, but setting it to 1 when it is
already set to 0 isn't).

Fixes: 1d6c752dce7f3 ("KVM: arm64: Set CSV2 for guests on hardware unaffected by Spectre-v2")
Reported-by: Peng Liang <liangpeng10@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20201110141308.451654-2-maz@kernel.org

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 781d029b8aa857174604cb9d66e00afca6bc0963..0cd9f0f75c135f3bb62e12792eb76d70bfae316c 100644 (file)
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -118,6 +118,8 @@ struct kvm_arch {
         */
        unsigned long *pmu_filter;
        unsigned int pmuver;
+
+       u8 pfr0_csv2;
 };
 
 struct kvm_vcpu_fault_info {

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index a3b32df1afb0a1e76f869610f0410bc11fa90a02..a6e25a4b4dc5e4927bc60c0c9b3bbca7cd4930a3 100644 (file)
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -102,6 +102,20 @@ static int kvm_arm_default_max_vcpus(void)
        return vgic_present ? kvm_vgic_get_max_vcpus() : KVM_MAX_VCPUS;
 }
 
+static void set_default_csv2(struct kvm *kvm)
+{
+       /*
+        * The default is to expose CSV2 == 1 if the HW isn't affected.
+        * Although this is a per-CPU feature, we make it global because
+        * asymmetric systems are just a nuisance.
+        *
+        * Userspace can override this as long as it doesn't promise
+        * the impossible.
+        */
+       if (arm64_get_spectre_v2_state() == SPECTRE_UNAFFECTED)
+               kvm->arch.pfr0_csv2 = 1;
+}
+
 /**
  * kvm_arch_init_vm - initializes a VM data structure
  * @kvm:       pointer to the KVM struct
@@ -127,6 +141,8 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
        /* The maximum number of VCPUs is limited by the host's GIC model */
        kvm->arch.max_vcpus = kvm_arm_default_max_vcpus();
 
+       set_default_csv2(kvm);
+
        return ret;
 out_free_stage2_pgd:
        kvm_free_stage2_pgd(&kvm->arch.mmu);

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 6d287eefd9f1240ab4bd59181ba665d7281c496d..0aa86250e354abd027fd03799c48af9457200062 100644 (file)
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1128,9 +1128,8 @@ static u64 read_id_reg(const struct kvm_vcpu *vcpu,
                if (!vcpu_has_sve(vcpu))
                        val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT);
                val &= ~(0xfUL << ID_AA64PFR0_AMU_SHIFT);
-               if (!(val & (0xfUL << ID_AA64PFR0_CSV2_SHIFT)) &&
-                   arm64_get_spectre_v2_state() == SPECTRE_UNAFFECTED)
-                       val |= (1UL << ID_AA64PFR0_CSV2_SHIFT);
+               val &= ~(0xfUL << ID_AA64PFR0_CSV2_SHIFT);
+               val |= ((u64)vcpu->kvm->arch.pfr0_csv2 << ID_AA64PFR0_CSV2_SHIFT);
        } else if (id == SYS_ID_AA64PFR1_EL1) {
                val &= ~(0xfUL << ID_AA64PFR1_MTE_SHIFT);
        } else if (id == SYS_ID_AA64ISAR1_EL1 && !vcpu_has_ptrauth(vcpu)) {
@@ -1213,6 +1212,40 @@ static unsigned int sve_visibility(const struct kvm_vcpu *vcpu,
        return REG_HIDDEN;
 }
 
+static int set_id_aa64pfr0_el1(struct kvm_vcpu *vcpu,
+                              const struct sys_reg_desc *rd,
+                              const struct kvm_one_reg *reg, void __user *uaddr)
+{
+       const u64 id = sys_reg_to_index(rd);
+       int err;
+       u64 val;
+       u8 csv2;
+
+       err = reg_from_user(&val, uaddr, id);
+       if (err)
+               return err;
+
+       /*
+        * Allow AA64PFR0_EL1.CSV2 to be set from userspace as long as
+        * it doesn't promise more than what is actually provided (the
+        * guest could otherwise be covered in ectoplasmic residue).
+        */
+       csv2 = cpuid_feature_extract_unsigned_field(val, ID_AA64PFR0_CSV2_SHIFT);
+       if (csv2 > 1 ||
+           (csv2 && arm64_get_spectre_v2_state() != SPECTRE_UNAFFECTED))
+               return -EINVAL;
+
+       /* We can only differ with CSV2, and anything else is an error */
+       val ^= read_id_reg(vcpu, rd, false);
+       val &= ~(0xFUL << ID_AA64PFR0_CSV2_SHIFT);
+       if (val)
+               return -EINVAL;
+
+       vcpu->kvm->arch.pfr0_csv2 = csv2;
+
+       return 0;
+}
+
 /*
  * cpufeature ID register user accessors
  *
@@ -1472,7 +1505,8 @@ static const struct sys_reg_desc sys_reg_descs[] = {
 
        /* AArch64 ID registers */
        /* CRm=4 */
-       ID_SANITISED(ID_AA64PFR0_EL1),
+       { SYS_DESC(SYS_ID_AA64PFR0_EL1), .access = access_id_reg,
+         .get_user = get_id_reg, .set_user = set_id_aa64pfr0_el1, },
        ID_SANITISED(ID_AA64PFR1_EL1),
        ID_UNALLOCATED(4,2),
        ID_UNALLOCATED(4,3),