On Thu, May 20, 2021 at 01:22:53PM +0100, Marc Zyngier wrote:
> It looks like we have tolerated creating mixed-width VMs since...
> forever. However, that was never the intention, and we'd rather
> not have to support that pointless complexity.
>
> Forbid such a setup by making sure all the vcpus have the same
> register width.
>
> Reported-by: Steven Price <steven.price@xxxxxxx>
> Signed-off-by: Marc Zyngier <maz@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> ---
> arch/arm64/kvm/reset.c | 28 ++++++++++++++++++++++++----
> 1 file changed, 24 insertions(+), 4 deletions(-)
>
> diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
> index 956cdc240148..1cf308be6ef3 100644
> --- a/arch/arm64/kvm/reset.c
> +++ b/arch/arm64/kvm/reset.c
> @@ -166,6 +166,25 @@ static int kvm_vcpu_enable_ptrauth(struct kvm_vcpu *vcpu)
> return 0;
> }
>
> +static bool vcpu_allowed_register_width(struct kvm_vcpu *vcpu)
> +{
> + struct kvm_vcpu *tmp;
> + int i;
> +
> + /* Check that the vcpus are either all 32bit or all 64bit */
> + kvm_for_each_vcpu(i, tmp, vcpu->kvm) {
> + bool w;
> +
> + w = test_bit(KVM_ARM_VCPU_EL1_32BIT, tmp->arch.features);
> + w ^= test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features);
> +
> + if (w)
> + return false;
> + }
I think this is wrong for a single-cpu VM. In that case, the loop will
have a single iteration, and tmp == vcpu, so w must be 0 regardless of
the value of arch.features.
IIUC that doesn't prevent KVM_ARM_VCPU_EL1_32BIT being set when we don't
have the ARM64_HAS_32BIT_EL1 cap, unless that's checked elsewhere?
How about something like:
| static bool vcpu_allowed_register_width(struct kvm_vcpu *vcpu)
| {
| bool is_32bit = vcpu_features_32bit(vcpu);
| struct kvm_vcpu *tmp;
| int i;
|
| if (!cpus_have_const_cap(ARM64_HAS_32BIT_EL1) && is_32bit)
| return false;
|
| kvm_for_each_vcpu(i, tmp, vcpu->kvm) {
| if (is_32bit != vcpu_features_32bit(tmp))
| return false;
| }
|
| return true;
| }
... with a helper in <asm/kvm_emulate.h> like:
| static bool vcpu_features_32bit(struct kvm_vcpu *vcpu)
| {
| return test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features);
| }
... or
| static inline bool vcpu_has_feature(struct kvm_vcpu *vcpu, int feature)
| {
| return test_bit(feature, vcpu->arch.features);
| }
... so that we can avoid the line splitting required by the length of
the test_bit() expression?
Thanks,
Mark.
> +
> + return true;
> +}
> +
> /**
> * kvm_reset_vcpu - sets core registers and sys_regs to reset value
> * @vcpu: The VCPU pointer
> @@ -217,13 +236,14 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
> }
> }
>
> + if (!vcpu_allowed_register_width(vcpu)) {
> + ret = -EINVAL;
> + goto out;
> + }
> +
> switch (vcpu->arch.target) {
> default:
> if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features)) {
> - if (!cpus_have_const_cap(ARM64_HAS_32BIT_EL1)) {
> - ret = -EINVAL;
> - goto out;
> - }
> pstate = VCPU_RESET_PSTATE_SVC;
> } else {
> pstate = VCPU_RESET_PSTATE_EL1;
> --
> 2.30.2
>
> _______________________________________________
> kvmarm mailing list
> kvmarm@xxxxxxxxxxxxxxxxxxxxx
> https://lists.cs.columbia.edu/mailman/listinfo/kvmarm
