This patch adds id_reg_desc for ID_AA64MMFR0_EL1 to make it
writable by userspace.
Since ID_AA64MMFR0_EL1 stage 2 granule size fields don't follow the
standard ID scheme, we need a special handling to validate those fields.
Signed-off-by: Reiji Watanabe <reijiw@xxxxxxxxxx>
---
arch/arm64/kvm/sys_regs.c | 133 ++++++++++++++++++++++++++++++++++++++
1 file changed, 133 insertions(+)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index ba2e6dac7774..b68ae53af792 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -542,6 +542,118 @@ static int validate_id_aa64isar2_el1(struct kvm_vcpu *vcpu,
return 0;
}
+/*
+ * Check if the requested stage2 translation granule size indicated in
+ * @mmfr0 is also indicated in @mmfr0_lim.
+ * If TGranX_2 field is zero, the value must be validated based on TGranX
+ * field because that indicates the feature support is identified in
+ * TGranX field.
+ * This function relies on the fact TGranX fields are validated before
+ * through arm64_check_features.
+ */
+static int aa64mmfr0_tgran2_check(int field, u64 mmfr0, u64 mmfr0_lim)
+{
+ s64 tgran2, lim_tgran2, rtgran1;
+ int f1;
+ bool is_signed;
+
+ tgran2 = cpuid_feature_extract_unsigned_field(mmfr0, field);
+ lim_tgran2 = cpuid_feature_extract_unsigned_field(mmfr0_lim, field);
+ if (tgran2 && lim_tgran2)
+ /*
+ * We don't need to check TGranX field. We can simply
+ * compare tgran2 and lim_tgran2.
+ */
+ return (tgran2 > lim_tgran2) ? -E2BIG : 0;
+
+ if (tgran2 == lim_tgran2)
+ /*
+ * Both of them are zero. Since TGranX in @mmfr0 is already
+ * validated by arm64_check_features, tgran2 must be fine.
+ */
+ return 0;
+
+ /*
+ * Either tgran2 or lim_tgran2 is zero.
+ * Need stage1 granule size to validate tgran2.
+ */
+
+ /*
+ * Get TGranX's bit position by subtracting 12 from TGranX_2's bit
+ * position.
+ */
+ f1 = field - 12;
+
+ /* TGran4/TGran64 is signed and TGran16 is unsigned field. */
+ is_signed = (f1 == ID_AA64MMFR0_TGRAN16_SHIFT) ? false : true;
+
+ /*
+ * If tgran2 == 0 (&& lim_tgran2 != 0), the requested stage2 granule
+ * size is indicated in the stage1 granule size field of @mmfr0.
+ * So, validate the stage1 granule size against the stage2 limit
+ * granule size.
+ * If lim_tgran2 == 0 (&& tgran2 != 0), the stage2 limit granule size
+ * is indicated in the stage1 granule size field of @mmfr0_lim.
+ * So, validate the requested stage2 granule size against the stage1
+ * limit granule size.
+ */
+
+ /* Get the relevant stage1 granule size to validate tgran2 */
+ if (tgran2 == 0)
+ /* The requested stage1 granule size */
+ rtgran1 = cpuid_feature_extract_field(mmfr0, f1, is_signed);
+ else /* lim_tgran2 == 0 */
+ /* The stage1 limit granule size */
+ rtgran1 = cpuid_feature_extract_field(mmfr0_lim, f1, is_signed);
+
+ /*
+ * Adjust the value of rtgran1 to compare with stage2 granule size,
+ * which indicates: 1: Not supported, 2: Supported, etc.
+ */
+ if (is_signed)
+ /* For signed, -1: Not supported, 0: Supported, etc. */
+ rtgran1 += 0x2;
+ else
+ /* For unsigned, 0: Not supported, 1: Supported, etc. */
+ rtgran1 += 0x1;
+
+ if ((tgran2 == 0) && (rtgran1 > lim_tgran2))
+ /*
+ * The requested stage1 granule size (== the requested stage2
+ * granule size) is larger than the stage2 limit granule size.
+ */
+ return -E2BIG;
+ else if ((lim_tgran2 == 0) && (tgran2 > rtgran1))
+ /*
+ * The requested stage2 granule size is larger than the stage1
+ * limit granulze size (== the stage2 limit granule size).
+ */
+ return -E2BIG;
+
+ return 0;
+}
+
+static int validate_id_aa64mmfr0_el1(struct kvm_vcpu *vcpu,
+ const struct id_reg_desc *id_reg, u64 val)
+{
+ u64 limit = id_reg->vcpu_limit_val;
+ int ret;
+
+ ret = aa64mmfr0_tgran2_check(ID_AA64MMFR0_TGRAN4_2_SHIFT, val, limit);
+ if (ret)
+ return ret;
+
+ ret = aa64mmfr0_tgran2_check(ID_AA64MMFR0_TGRAN64_2_SHIFT, val, limit);
+ if (ret)
+ return ret;
+
+ ret = aa64mmfr0_tgran2_check(ID_AA64MMFR0_TGRAN16_2_SHIFT, val, limit);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
static void init_id_aa64pfr0_el1_desc(struct id_reg_desc *id_reg)
{
u64 limit = id_reg->vcpu_limit_val;
@@ -3413,6 +3525,24 @@ static struct id_reg_desc id_aa64isar2_el1_desc = {
},
};
+static struct id_reg_desc id_aa64mmfr0_el1_desc = {
+ .reg_desc = ID_SANITISED(ID_AA64MMFR0_EL1),
+ /*
+ * When TGranX_2 value is 0, validity of the value depend on TGranX
+ * value, and TGranX_2 value must be validated against TGranX value,
+ * which is done by validate_id_aa64mmfr0_el1.
+ * So, skip the regular validity checking for TGranX_2 fields.
+ */
+ .ignore_mask = ARM64_FEATURE_MASK(ID_AA64MMFR0_TGRAN4_2) |
+ ARM64_FEATURE_MASK(ID_AA64MMFR0_TGRAN64_2) |
+ ARM64_FEATURE_MASK(ID_AA64MMFR0_TGRAN16_2),
+ .validate = validate_id_aa64mmfr0_el1,
+ .ftr_bits = {
+ S_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, ID_AA64MMFR0_TGRAN64_NI),
+ S_FTR_BITS(FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, ID_AA64MMFR0_TGRAN4_NI),
+ },
+};
+
#define ID_DESC(id_reg_name, id_reg_desc) \
[IDREG_IDX(SYS_##id_reg_name)] = (id_reg_desc)
@@ -3426,6 +3556,9 @@ static struct id_reg_desc *id_reg_desc_table[KVM_ARM_ID_REG_MAX_NUM] = {
ID_DESC(ID_AA64ISAR0_EL1, &id_aa64isar0_el1_desc),
ID_DESC(ID_AA64ISAR1_EL1, &id_aa64isar1_el1_desc),
ID_DESC(ID_AA64ISAR2_EL1, &id_aa64isar2_el1_desc),
+
+ /* CRm=7 */
+ ID_DESC(ID_AA64MMFR0_EL1, &id_aa64mmfr0_el1_desc),
};
static inline struct id_reg_desc *get_id_reg_desc(u32 id)
--
2.36.0.rc0.470.gd361397f0d-goog
