History

Merge branch 'for-next/pauth' into for-next/core

* for-next/pauth: arm64: Add support of PAuth QARMA3 architected algorithm arm64: cpufeature: Mark existing PAuth architected algorithm as QARMA5 arm64: cpufeature: Account min_field_value when cheking secondaries for PAuth

Will Deacon committed 4 years ago

Commit 292ca2d2 parents bf587af def8c2211 files · +110 −13Browse files

Unified · Split

11 files
  1. arch/arm64/include/asm/asm_pointer_auth.h +3 −0
  2. arch/arm64/include/asm/cpufeature.h +1 −0
  3. arch/arm64/include/asm/kvm_hyp.h +1 −0
  4. arch/arm64/include/asm/sysreg.h +12 −0
  5. arch/arm64/kernel/cpufeature.c +50 −9
  6. arch/arm64/kernel/idreg-override.c +14 −2
  7. arch/arm64/kvm/arm.c +1 −0
  8. arch/arm64/kvm/hyp/include/nvhe/fixed_config.h +5 −0
  9. arch/arm64/kvm/hyp/nvhe/sys_regs.c +14 −0
  10. arch/arm64/kvm/sys_regs.c +5 −0
  11. arch/arm64/tools/cpucaps +4 −2
arch/arm64/include/asm/asm_pointer_auth.h+3−0
@@ -60,6 +60,9 @@ alternative_else_nop_endif · 59 unmodified lines
6060 .macro __ptrauth_keys_init_cpu tsk, tmp1, tmp2, tmp3
6161 mrs \tmp1, id_aa64isar1_el1
6262 ubfx \tmp1, \tmp1, #ID_AA64ISAR1_APA_SHIFT, #8
63+ mrs_s \tmp2, SYS_ID_AA64ISAR2_EL1
64+ ubfx \tmp2, \tmp2, #ID_AA64ISAR2_APA3_SHIFT, #4
65+ orr \tmp1, \tmp1, \tmp2
6366 cbz \tmp1, .Lno_addr_auth\@
6467 mov_q \tmp1, (SCTLR_ELx_ENIA | SCTLR_ELx_ENIB | \
6568 SCTLR_ELx_ENDA | SCTLR_ELx_ENDB)
arch/arm64/include/asm/cpufeature.h+1−0
@@ -854,6 +854,7 @@ static inline unsigned int get_vmid_bits(u64 mmfr1) · 853 unmodified lines
854854 extern struct arm64_ftr_override id_aa64mmfr1_override;
855855 extern struct arm64_ftr_override id_aa64pfr1_override;
856856 extern struct arm64_ftr_override id_aa64isar1_override;
857+extern struct arm64_ftr_override id_aa64isar2_override;
857858
858859 u32 get_kvm_ipa_limit(void);
859860 void dump_cpu_features(void);
arch/arm64/include/asm/kvm_hyp.h+1−0
@@ -118,6 +118,7 @@ extern u64 kvm_nvhe_sym(id_aa64pfr0_el1_sys_val); · 117 unmodified lines
118118 extern u64 kvm_nvhe_sym(id_aa64pfr1_el1_sys_val);
119119 extern u64 kvm_nvhe_sym(id_aa64isar0_el1_sys_val);
120120 extern u64 kvm_nvhe_sym(id_aa64isar1_el1_sys_val);
121+extern u64 kvm_nvhe_sym(id_aa64isar2_el1_sys_val);
121122 extern u64 kvm_nvhe_sym(id_aa64mmfr0_el1_sys_val);
122123 extern u64 kvm_nvhe_sym(id_aa64mmfr1_el1_sys_val);
123124 extern u64 kvm_nvhe_sym(id_aa64mmfr2_el1_sys_val);
arch/arm64/include/asm/sysreg.h+12−0
@@ -773,6 +773,8 @@ · 772 unmodified lines
773773 #define ID_AA64ISAR1_GPI_IMP_DEF 0x1
774774
775775 /* id_aa64isar2 */
776+#define ID_AA64ISAR2_APA3_SHIFT 12
777+#define ID_AA64ISAR2_GPA3_SHIFT 8
776778 #define ID_AA64ISAR2_RPRES_SHIFT 4
777779 #define ID_AA64ISAR2_WFXT_SHIFT 0
778780
@@ -786,6 +788,16 @@ · 7 unmodified lines
786788 #define ID_AA64ISAR2_WFXT_NI 0x0
787789 #define ID_AA64ISAR2_WFXT_SUPPORTED 0x2
788790
791+#define ID_AA64ISAR2_APA3_NI 0x0
792+#define ID_AA64ISAR2_APA3_ARCHITECTED 0x1
793+#define ID_AA64ISAR2_APA3_ARCH_EPAC 0x2
794+#define ID_AA64ISAR2_APA3_ARCH_EPAC2 0x3
795+#define ID_AA64ISAR2_APA3_ARCH_EPAC2_FPAC 0x4
796+#define ID_AA64ISAR2_APA3_ARCH_EPAC2_FPAC_CMB 0x5
797+
798+#define ID_AA64ISAR2_GPA3_NI 0x0
799+#define ID_AA64ISAR2_GPA3_ARCHITECTED 0x1
800+
789801 /* id_aa64pfr0 */
790802 #define ID_AA64PFR0_CSV3_SHIFT 60
791803 #define ID_AA64PFR0_CSV2_SHIFT 56
arch/arm64/kernel/cpufeature.c+50−9
@@ -226,6 +226,10 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { · 225 unmodified lines
226226 };
227227
228228 static const struct arm64_ftr_bits ftr_id_aa64isar2[] = {
229+ ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_PTR_AUTH),
230+ FTR_STRICT, FTR_EXACT, ID_AA64ISAR2_APA3_SHIFT, 4, 0),
231+ ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_PTR_AUTH),
232+ FTR_STRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_GPA3_SHIFT, 4, 0),
229233 ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_RPRES_SHIFT, 4, 0),
230234 ARM64_FTR_END,
231235 };
@@ -596,6 +600,7 @@ static const struct arm64_ftr_bits ftr_raz[] = { · 364 unmodified lines
596600 struct arm64_ftr_override __ro_after_init id_aa64mmfr1_override;
597601 struct arm64_ftr_override __ro_after_init id_aa64pfr1_override;
598602 struct arm64_ftr_override __ro_after_init id_aa64isar1_override;
603+struct arm64_ftr_override __ro_after_init id_aa64isar2_override;
599604
600605 static const struct __ftr_reg_entry {
601606 u32 sys_id;
@@ -644,6 +649,8 @@ static const struct __ftr_reg_entry { · 42 unmodified lines
644649 ARM64_FTR_REG_OVERRIDE(SYS_ID_AA64ISAR1_EL1, ftr_id_aa64isar1,
645650 &id_aa64isar1_override),
646651 ARM64_FTR_REG(SYS_ID_AA64ISAR2_EL1, ftr_id_aa64isar2),
652+ ARM64_FTR_REG_OVERRIDE(SYS_ID_AA64ISAR2_EL1, ftr_id_aa64isar2,
653+ &id_aa64isar2_override),
647654
648655 /* Op1 = 0, CRn = 0, CRm = 7 */
649656 ARM64_FTR_REG(SYS_ID_AA64MMFR0_EL1, ftr_id_aa64mmfr0),
@@ -1821,21 +1828,27 @@ static bool has_address_auth_cpucap(const struct arm64_cpu_capabilities *entry, · 1171 unmodified lines
18211828 /* Now check for the secondary CPUs with SCOPE_LOCAL_CPU scope */
18221829 sec_val = cpuid_feature_extract_field(__read_sysreg_by_encoding(entry->sys_reg),
18231830 entry->field_pos, entry->sign);
1824− return sec_val == boot_val;
1831+ return (sec_val >= entry->min_field_value) && (sec_val == boot_val);
18251832 }
18261833
18271834 static bool has_address_auth_metacap(const struct arm64_cpu_capabilities *entry,
18281835 int scope)
18291836 {
1830− return has_address_auth_cpucap(cpu_hwcaps_ptrs[ARM64_HAS_ADDRESS_AUTH_ARCH], scope) ||
1831− has_address_auth_cpucap(cpu_hwcaps_ptrs[ARM64_HAS_ADDRESS_AUTH_IMP_DEF], scope);
1837+ bool api = has_address_auth_cpucap(cpu_hwcaps_ptrs[ARM64_HAS_ADDRESS_AUTH_IMP_DEF], scope);
1838+ bool apa = has_address_auth_cpucap(cpu_hwcaps_ptrs[ARM64_HAS_ADDRESS_AUTH_ARCH_QARMA5], scope);
1839+ bool apa3 = has_address_auth_cpucap(cpu_hwcaps_ptrs[ARM64_HAS_ADDRESS_AUTH_ARCH_QARMA3], scope);
1840+
1841+ return apa || apa3 || api;
18321842 }
18331843
18341844 static bool has_generic_auth(const struct arm64_cpu_capabilities *entry,
18351845 int __unused)
18361846 {
1837− return __system_matches_cap(ARM64_HAS_GENERIC_AUTH_ARCH) ||
1838− __system_matches_cap(ARM64_HAS_GENERIC_AUTH_IMP_DEF);
1847+ bool gpi = __system_matches_cap(ARM64_HAS_GENERIC_AUTH_IMP_DEF);
1848+ bool gpa = __system_matches_cap(ARM64_HAS_GENERIC_AUTH_ARCH_QARMA5);
1849+ bool gpa3 = __system_matches_cap(ARM64_HAS_GENERIC_AUTH_ARCH_QARMA3);
1850+
1851+ return gpa || gpa3 || gpi;
18391852 }
18401853 #endif /* CONFIG_ARM64_PTR_AUTH */
18411854
@@ -2221,8 +2234,8 @@ static const struct arm64_cpu_capabilities arm64_features[] = { · 379 unmodified lines
22212234 },
22222235 #ifdef CONFIG_ARM64_PTR_AUTH
22232236 {
2224− .desc = "Address authentication (architected algorithm)",
2225− .capability = ARM64_HAS_ADDRESS_AUTH_ARCH,
2237+ .desc = "Address authentication (architected QARMA5 algorithm)",
2238+ .capability = ARM64_HAS_ADDRESS_AUTH_ARCH_QARMA5,
22262239 .type = ARM64_CPUCAP_BOOT_CPU_FEATURE,
22272240 .sys_reg = SYS_ID_AA64ISAR1_EL1,
22282241 .sign = FTR_UNSIGNED,
@@ -2230,6 +2243,16 @@ static const struct arm64_cpu_capabilities arm64_features[] = { · 1 unmodified line
22302243 .min_field_value = ID_AA64ISAR1_APA_ARCHITECTED,
22312244 .matches = has_address_auth_cpucap,
22322245 },
2246+ {
2247+ .desc = "Address authentication (architected QARMA3 algorithm)",
2248+ .capability = ARM64_HAS_ADDRESS_AUTH_ARCH_QARMA3,
2249+ .type = ARM64_CPUCAP_BOOT_CPU_FEATURE,
2250+ .sys_reg = SYS_ID_AA64ISAR2_EL1,
2251+ .sign = FTR_UNSIGNED,
2252+ .field_pos = ID_AA64ISAR2_APA3_SHIFT,
2253+ .min_field_value = ID_AA64ISAR2_APA3_ARCHITECTED,
2254+ .matches = has_address_auth_cpucap,
2255+ },
22332256 {
22342257 .desc = "Address authentication (IMP DEF algorithm)",
22352258 .capability = ARM64_HAS_ADDRESS_AUTH_IMP_DEF,
@@ -2246,8 +2269,8 @@ static const struct arm64_cpu_capabilities arm64_features[] = { · 10 unmodified lines
22462269 .matches = has_address_auth_metacap,
22472270 },
22482271 {
2249− .desc = "Generic authentication (architected algorithm)",
2250− .capability = ARM64_HAS_GENERIC_AUTH_ARCH,
2272+ .desc = "Generic authentication (architected QARMA5 algorithm)",
2273+ .capability = ARM64_HAS_GENERIC_AUTH_ARCH_QARMA5,
22512274 .type = ARM64_CPUCAP_SYSTEM_FEATURE,
22522275 .sys_reg = SYS_ID_AA64ISAR1_EL1,
22532276 .sign = FTR_UNSIGNED,
@@ -2255,6 +2278,16 @@ static const struct arm64_cpu_capabilities arm64_features[] = { · 1 unmodified line
22552278 .min_field_value = ID_AA64ISAR1_GPA_ARCHITECTED,
22562279 .matches = has_cpuid_feature,
22572280 },
2281+ {
2282+ .desc = "Generic authentication (architected QARMA3 algorithm)",
2283+ .capability = ARM64_HAS_GENERIC_AUTH_ARCH_QARMA3,
2284+ .type = ARM64_CPUCAP_SYSTEM_FEATURE,
2285+ .sys_reg = SYS_ID_AA64ISAR2_EL1,
2286+ .sign = FTR_UNSIGNED,
2287+ .field_pos = ID_AA64ISAR2_GPA3_SHIFT,
2288+ .min_field_value = ID_AA64ISAR2_GPA3_ARCHITECTED,
2289+ .matches = has_cpuid_feature,
2290+ },
22582291 {
22592292 .desc = "Generic authentication (IMP DEF algorithm)",
22602293 .capability = ARM64_HAS_GENERIC_AUTH_IMP_DEF,
@@ -2402,6 +2435,10 @@ static const struct arm64_cpu_capabilities ptr_auth_hwcap_addr_matches[] = { · 141 unmodified lines
24022435 HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_APA_SHIFT,
24032436 FTR_UNSIGNED, ID_AA64ISAR1_APA_ARCHITECTED)
24042437 },
2438+ {
2439+ HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR2_EL1, ID_AA64ISAR2_APA3_SHIFT,
2440+ FTR_UNSIGNED, ID_AA64ISAR2_APA3_ARCHITECTED)
2441+ },
24052442 {
24062443 HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_API_SHIFT,
24072444 FTR_UNSIGNED, ID_AA64ISAR1_API_IMP_DEF)
@@ -2414,6 +2451,10 @@ static const struct arm64_cpu_capabilities ptr_auth_hwcap_gen_matches[] = { · 6 unmodified lines
24142451 HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_GPA_SHIFT,
24152452 FTR_UNSIGNED, ID_AA64ISAR1_GPA_ARCHITECTED)
24162453 },
2454+ {
2455+ HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR2_EL1, ID_AA64ISAR2_GPA3_SHIFT,
2456+ FTR_UNSIGNED, ID_AA64ISAR2_GPA3_ARCHITECTED)
2457+ },
24172458 {
24182459 HWCAP_CPUID_MATCH(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_GPI_SHIFT,
24192460 FTR_UNSIGNED, ID_AA64ISAR1_GPI_IMP_DEF)
arch/arm64/kernel/idreg-override.c+14−2
@@ -17,7 +17,7 @@ · 16 unmodified lines
1717 #define FTR_DESC_NAME_LEN 20
1818 #define FTR_DESC_FIELD_LEN 10
1919 #define FTR_ALIAS_NAME_LEN 30
20−#define FTR_ALIAS_OPTION_LEN 80
20+#define FTR_ALIAS_OPTION_LEN 116
2121
2222 struct ftr_set_desc {
2323 char name[FTR_DESC_NAME_LEN];
@@ -71,6 +71,16 @@ static const struct ftr_set_desc isar1 __initconst = { · 47 unmodified lines
7171 },
7272 };
7373
74+static const struct ftr_set_desc isar2 __initconst = {
75+ .name = "id_aa64isar2",
76+ .override = &id_aa64isar2_override,
77+ .fields = {
78+ { "gpa3", ID_AA64ISAR2_GPA3_SHIFT },
79+ { "apa3", ID_AA64ISAR2_APA3_SHIFT },
80+ {}
81+ },
82+};
83+
7484 extern struct arm64_ftr_override kaslr_feature_override;
7585
7686 static const struct ftr_set_desc kaslr __initconst = {
@@ -88,6 +98,7 @@ static const struct ftr_set_desc * const regs[] __initconst = { · 11 unmodified lines
8898 &mmfr1,
8999 &pfr1,
90100 &isar1,
101+ &isar2,
91102 &kaslr,
92103 };
93104
@@ -100,7 +111,8 @@ static const struct { · 6 unmodified lines
100111 { "arm64.nobti", "id_aa64pfr1.bt=0" },
101112 { "arm64.nopauth",
102113 "id_aa64isar1.gpi=0 id_aa64isar1.gpa=0 "
103− "id_aa64isar1.api=0 id_aa64isar1.apa=0" },
114+ "id_aa64isar1.api=0 id_aa64isar1.apa=0 "
115+ "id_aa64isar2.gpa3=0 id_aa64isar2.apa3=0" },
104116 { "arm64.nomte", "id_aa64pfr1.mte=0" },
105117 { "nokaslr", "kaslr.disabled=1" },
106118 };
arch/arm64/kvm/arm.c+1−0
@@ -1870,6 +1870,7 @@ static int kvm_hyp_init_protection(u32 hyp_va_bits) · 1869 unmodified lines
18701870 kvm_nvhe_sym(id_aa64pfr1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1);
18711871 kvm_nvhe_sym(id_aa64isar0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR0_EL1);
18721872 kvm_nvhe_sym(id_aa64isar1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1);
1873+ kvm_nvhe_sym(id_aa64isar2_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1);
18731874 kvm_nvhe_sym(id_aa64mmfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
18741875 kvm_nvhe_sym(id_aa64mmfr1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1);
18751876 kvm_nvhe_sym(id_aa64mmfr2_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64MMFR2_EL1);
arch/arm64/kvm/hyp/include/nvhe/fixed_config.h+5−0
@@ -192,6 +192,11 @@ · 191 unmodified lines
192192 ARM64_FEATURE_MASK(ID_AA64ISAR1_I8MM) \
193193 )
194194
195+#define PVM_ID_AA64ISAR2_ALLOW (\
196+ ARM64_FEATURE_MASK(ID_AA64ISAR2_GPA3) | \
197+ ARM64_FEATURE_MASK(ID_AA64ISAR2_APA3) \
198+ )
199+
195200 u64 pvm_read_id_reg(const struct kvm_vcpu *vcpu, u32 id);
196201 bool kvm_handle_pvm_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code);
197202 bool kvm_handle_pvm_restricted(struct kvm_vcpu *vcpu, u64 *exit_code);
arch/arm64/kvm/hyp/nvhe/sys_regs.c+14−0
@@ -22,6 +22,7 @@ u64 id_aa64pfr0_el1_sys_val; · 21 unmodified lines
2222 u64 id_aa64pfr1_el1_sys_val;
2323 u64 id_aa64isar0_el1_sys_val;
2424 u64 id_aa64isar1_el1_sys_val;
25+u64 id_aa64isar2_el1_sys_val;
2526 u64 id_aa64mmfr0_el1_sys_val;
2627 u64 id_aa64mmfr1_el1_sys_val;
2728 u64 id_aa64mmfr2_el1_sys_val;
@@ -183,6 +184,17 @@ static u64 get_pvm_id_aa64isar1(const struct kvm_vcpu *vcpu) · 155 unmodified lines
183184 return id_aa64isar1_el1_sys_val & allow_mask;
184185 }
185186
187+static u64 get_pvm_id_aa64isar2(const struct kvm_vcpu *vcpu)
188+{
189+ u64 allow_mask = PVM_ID_AA64ISAR2_ALLOW;
190+
191+ if (!vcpu_has_ptrauth(vcpu))
192+ allow_mask &= ~(ARM64_FEATURE_MASK(ID_AA64ISAR2_APA3) |
193+ ARM64_FEATURE_MASK(ID_AA64ISAR2_GPA3));
194+
195+ return id_aa64isar2_el1_sys_val & allow_mask;
196+}
197+
186198 static u64 get_pvm_id_aa64mmfr0(const struct kvm_vcpu *vcpu)
187199 {
188200 u64 set_mask;
@@ -225,6 +237,8 @@ u64 pvm_read_id_reg(const struct kvm_vcpu *vcpu, u32 id) · 36 unmodified lines
225237 return get_pvm_id_aa64isar0(vcpu);
226238 case SYS_ID_AA64ISAR1_EL1:
227239 return get_pvm_id_aa64isar1(vcpu);
240+ case SYS_ID_AA64ISAR2_EL1:
241+ return get_pvm_id_aa64isar2(vcpu);
228242 case SYS_ID_AA64MMFR0_EL1:
229243 return get_pvm_id_aa64mmfr0(vcpu);
230244 case SYS_ID_AA64MMFR1_EL1:
arch/arm64/kvm/sys_regs.c+5−0
@@ -1097,6 +1097,11 @@ static u64 read_id_reg(const struct kvm_vcpu *vcpu, · 1096 unmodified lines
10971097 ARM64_FEATURE_MASK(ID_AA64ISAR1_GPA) |
10981098 ARM64_FEATURE_MASK(ID_AA64ISAR1_GPI));
10991099 break;
1100+ case SYS_ID_AA64ISAR2_EL1:
1101+ if (!vcpu_has_ptrauth(vcpu))
1102+ val &= ~(ARM64_FEATURE_MASK(ID_AA64ISAR2_APA3) |
1103+ ARM64_FEATURE_MASK(ID_AA64ISAR2_GPA3));
1104+ break;
11001105 case SYS_ID_AA64DFR0_EL1:
11011106 /* Limit debug to ARMv8.0 */
11021107 val &= ~ARM64_FEATURE_MASK(ID_AA64DFR0_DEBUGVER);
arch/arm64/tools/cpucaps+4−2
@@ -7,7 +7,8 @@ BTI · 6 unmodified lines
77 HAS_32BIT_EL0_DO_NOT_USE
88 HAS_32BIT_EL1
99 HAS_ADDRESS_AUTH
10−HAS_ADDRESS_AUTH_ARCH
10+HAS_ADDRESS_AUTH_ARCH_QARMA3
11+HAS_ADDRESS_AUTH_ARCH_QARMA5
1112 HAS_ADDRESS_AUTH_IMP_DEF
1213 HAS_AMU_EXTN
1314 HAS_ARMv8_4_TTL
@@ -21,7 +22,8 @@ HAS_E0PD · 7 unmodified lines
2122 HAS_ECV
2223 HAS_EPAN
2324 HAS_GENERIC_AUTH
24−HAS_GENERIC_AUTH_ARCH
25+HAS_GENERIC_AUTH_ARCH_QARMA3
26+HAS_GENERIC_AUTH_ARCH_QARMA5
2527 HAS_GENERIC_AUTH_IMP_DEF
2628 HAS_IRQ_PRIO_MASKING
2729 HAS_LDAPR

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t