Merge tag 'kvmarm-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux…

…/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 6.11, round #1

 - Use kvfree() for the kvmalloc'd nested MMUs array

 - Set of fixes to address warnings in W=1 builds

 - Make KVM depend on assembler support for ARMv8.4

 - Fix for vgic-debug interface for VMs without LPIs

 - Actually check ID_AA64MMFR3_EL1.S1PIE in get-reg-list selftest

 - Minor code / comment cleanups for configuring PAuth traps

 - Take kvm->arch.config_lock to prevent destruction / initialization
   race for a vCPU's CPUIF which may lead to a UAF

Documentation/virt/kvm/api.rst

@@ -2592,7 +2592,7 @@ Specifically:
  0x6030 0000 0010 004a SPSR_ABT 64 spsr[KVM_SPSR_ABT]
  0x6030 0000 0010 004c SPSR_UND 64 spsr[KVM_SPSR_UND]
  0x6030 0000 0010 004e SPSR_IRQ 64 spsr[KVM_SPSR_IRQ]
- 0x6060 0000 0010 0050 SPSR_FIQ 64 spsr[KVM_SPSR_FIQ]
+ 0x6030 0000 0010 0050 SPSR_FIQ 64 spsr[KVM_SPSR_FIQ]
  0x6040 0000 0010 0054 V0 128 fp_regs.vregs[0] [1]_
  0x6040 0000 0010 0058 V1 128 fp_regs.vregs[1] [1]_
  ...

arch/arm64/include/asm/kvm_ptrauth.h

@@ -104,7 +104,7 @@ alternative_else_nop_endif
 
 #define __ptrauth_save_key(ctxt, key) \
  do { \
- u64 __val; \
+ u64 __val; \
  __val = read_sysreg_s(SYS_ ## key ## KEYLO_EL1); \
  ctxt_sys_reg(ctxt, key ## KEYLO_EL1) = __val; \
  __val = read_sysreg_s(SYS_ ## key ## KEYHI_EL1); \

arch/arm64/kvm/Kconfig

@@ -19,6 +19,7 @@ if VIRTUALIZATION
 
 menuconfig KVM
  bool "Kernel-based Virtual Machine (KVM) support"
+ depends on AS_HAS_ARMV8_4
  select KVM_COMMON
  select KVM_GENERIC_HARDWARE_ENABLING
  select KVM_GENERIC_MMU_NOTIFIER

arch/arm64/kvm/Makefile

@@ -10,6 +10,9 @@ include $(srctree)/virt/kvm/Makefile.kvm
 obj-$(CONFIG_KVM) += kvm.o
 obj-$(CONFIG_KVM) += hyp/
 
+CFLAGS_sys_regs.o += -Wno-override-init
+CFLAGS_handle_exit.o += -Wno-override-init
+
 kvm-y += arm.o mmu.o mmio.o psci.o hypercalls.o pvtime.o \
  inject_fault.o va_layout.o handle_exit.o \
  guest.o debug.o reset.o sys_regs.o stacktrace.o \

arch/arm64/kvm/arm.c

@@ -164,6 +164,7 @@ static int kvm_arm_default_max_vcpus(void)
 /**
  * kvm_arch_init_vm - initializes a VM data structure
  * @kvm: pointer to the KVM struct
+ * @type: kvm device type
  */
 int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 {
@@ -521,10 +522,10 @@ void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu)
 
 static void vcpu_set_pauth_traps(struct kvm_vcpu *vcpu)
 {
- if (vcpu_has_ptrauth(vcpu)) {
+ if (vcpu_has_ptrauth(vcpu) && !is_protected_kvm_enabled()) {
  /*
- * Either we're running running an L2 guest, and the API/APK
- * bits come from L1's HCR_EL2, or API/APK are both set.
+ * Either we're running an L2 guest, and the API/APK bits come
+ * from L1's HCR_EL2, or API/APK are both set.
  */
  if (unlikely(vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu))) {
  u64 val;
@@ -541,16 +542,10 @@ static void vcpu_set_pauth_traps(struct kvm_vcpu *vcpu)
  * Save the host keys if there is any chance for the guest
  * to use pauth, as the entry code will reload the guest
  * keys in that case.
- * Protected mode is the exception to that rule, as the
- * entry into the EL2 code eagerly switch back and forth
- * between host and hyp keys (and kvm_hyp_ctxt is out of
- * reach anyway).
  */
- if (is_protected_kvm_enabled())
- return;
-
  if (vcpu->arch.hcr_el2 & (HCR_API | HCR_APK)) {
  struct kvm_cpu_context *ctxt;
+
  ctxt = this_cpu_ptr_hyp_sym(kvm_hyp_ctxt);
  ptrauth_save_keys(ctxt);
  }

arch/arm64/kvm/hyp/include/hyp/switch.h

@@ -27,7 +27,6 @@
 #include <asm/kvm_hyp.h>
 #include <asm/kvm_mmu.h>
 #include <asm/kvm_nested.h>
-#include <asm/kvm_ptrauth.h>
 #include <asm/fpsimd.h>
 #include <asm/debug-monitors.h>
 #include <asm/processor.h>

arch/arm64/kvm/hyp/nvhe/Makefile

@@ -20,6 +20,8 @@ HOST_EXTRACFLAGS += -I$(objtree)/include
 lib-objs := clear_page.o copy_page.o memcpy.o memset.o
 lib-objs := $(addprefix ../../../lib/, $(lib-objs))
 
+CFLAGS_switch.nvhe.o += -Wno-override-init
+
 hyp-obj-y := timer-sr.o sysreg-sr.o debug-sr.o switch.o tlb.o hyp-init.o host.o \
  hyp-main.o hyp-smp.o psci-relay.o early_alloc.o page_alloc.o \
  cache.o setup.o mm.o mem_protect.o sys_regs.o pkvm.o stacktrace.o ffa.o

arch/arm64/kvm/hyp/nvhe/switch.c

@@ -173,9 +173,8 @@ static void __pmu_switch_to_host(struct kvm_vcpu *vcpu)
 static bool kvm_handle_pvm_sys64(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
  /*
- * Make sure we handle the exit for workarounds and ptrauth
- * before the pKVM handling, as the latter could decide to
- * UNDEF.
+ * Make sure we handle the exit for workarounds before the pKVM
+ * handling, as the latter could decide to UNDEF.
  */
  return (kvm_hyp_handle_sysreg(vcpu, exit_code) ||
  kvm_handle_pvm_sysreg(vcpu, exit_code));

arch/arm64/kvm/hyp/vhe/Makefile

@@ -6,6 +6,8 @@
 asflags-y := -D__KVM_VHE_HYPERVISOR__
 ccflags-y := -D__KVM_VHE_HYPERVISOR__
 
+CFLAGS_switch.o += -Wno-override-init
+
 obj-y := timer-sr.o sysreg-sr.o debug-sr.o switch.o tlb.o
 obj-y += ../vgic-v3-sr.o ../aarch32.o ../vgic-v2-cpuif-proxy.o ../entry.o \
  ../fpsimd.o ../hyp-entry.o ../exception.o

arch/arm64/kvm/nested.c

@@ -786,7 +786,7 @@ void kvm_arch_flush_shadow_all(struct kvm *kvm)
  if (!WARN_ON(atomic_read(&mmu->refcnt)))
  kvm_free_stage2_pgd(mmu);
  }
- kfree(kvm->arch.nested_mmus);
+ kvfree(kvm->arch.nested_mmus);
  kvm->arch.nested_mmus = NULL;
  kvm->arch.nested_mmus_size = 0;
  kvm_uninit_stage2_mmu(kvm);

arch/arm64/kvm/vgic/vgic-debug.c

@@ -45,7 +45,8 @@ static void iter_next(struct kvm *kvm, struct vgic_state_iter *iter)
  * Let the xarray drive the iterator after the last SPI, as the iterator
  * has exhausted the sequentially-allocated INTID space.
  */
- if (iter->intid >= (iter->nr_spis + VGIC_NR_PRIVATE_IRQS - 1)) {
+ if (iter->intid >= (iter->nr_spis + VGIC_NR_PRIVATE_IRQS - 1) &&
+ iter->nr_lpis) {
  if (iter->lpi_idx < iter->nr_lpis)
  xa_find_after(&dist->lpi_xa, &iter->intid,
  VGIC_LPI_MAX_INTID,
@@ -112,7 +113,7 @@ static bool end_of_vgic(struct vgic_state_iter *iter)
  return iter->dist_id > 0 &&
  iter->vcpu_id == iter->nr_cpus &&
  iter->intid >= (iter->nr_spis + VGIC_NR_PRIVATE_IRQS) &&
- iter->lpi_idx > iter->nr_lpis;
+ (!iter->nr_lpis || iter->lpi_idx > iter->nr_lpis);
 }
 
 static void *vgic_debug_start(struct seq_file *s, loff_t *pos)

arch/arm64/kvm/vgic/vgic-init.c

@@ -438,14 +438,13 @@ void kvm_vgic_destroy(struct kvm *kvm)
  unsigned long i;
 
  mutex_lock(&kvm->slots_lock);
+ mutex_lock(&kvm->arch.config_lock);
 
  vgic_debug_destroy(kvm);
 
  kvm_for_each_vcpu(i, vcpu, kvm)
  __kvm_vgic_vcpu_destroy(vcpu);
 
- mutex_lock(&kvm->arch.config_lock);
-
  kvm_vgic_dist_destroy(kvm);
 
  mutex_unlock(&kvm->arch.config_lock);

arch/arm64/kvm/vgic/vgic-irqfd.c

@@ -9,7 +9,7 @@
 #include <kvm/arm_vgic.h>
 #include "vgic.h"
 
-/**
+/*
  * vgic_irqfd_set_irq: inject the IRQ corresponding to the
  * irqchip routing entry
  *
@@ -75,7 +75,8 @@ static void kvm_populate_msi(struct kvm_kernel_irq_routing_entry *e,
  msi->flags = e->msi.flags;
  msi->devid = e->msi.devid;
 }
-/**
+
+/*
  * kvm_set_msi: inject the MSI corresponding to the
  * MSI routing entry
  *
@@ -98,7 +99,7 @@ int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
  return vgic_its_inject_msi(kvm, &msi);
 }
 
-/**
+/*
  * kvm_arch_set_irq_inatomic: fast-path for irqfd injection
  */
 int kvm_arch_set_irq_inatomic(struct kvm_kernel_irq_routing_entry *e,

arch/arm64/kvm/vgic/vgic-its.c

@@ -2040,6 +2040,7 @@ typedef int (*entry_fn_t)(struct vgic_its *its, u32 id, void *entry,
  * @start_id: the ID of the first entry in the table
  * (non zero for 2d level tables)
  * @fn: function to apply on each entry
+ * @opaque: pointer to opaque data
  *
  * Return: < 0 on error, 0 if last element was identified, 1 otherwise
  * (the last element may not be found on second level tables)
@@ -2079,7 +2080,7 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz,
  return 1;
 }
 
-/**
+/*
  * vgic_its_save_ite - Save an interrupt translation entry at @gpa
  */
 static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
@@ -2099,6 +2100,8 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
 
 /**
  * vgic_its_restore_ite - restore an interrupt translation entry
+ *
+ * @its: its handle
  * @event_id: id used for indexing
  * @ptr: pointer to the ITE entry
  * @opaque: pointer to the its_device
@@ -2231,6 +2234,7 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
  * @its: ITS handle
  * @dev: ITS device
  * @ptr: GPA
+ * @dte_esz: device table entry size
  */
 static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
  gpa_t ptr, int dte_esz)
@@ -2313,7 +2317,7 @@ static int vgic_its_device_cmp(void *priv, const struct list_head *a,
  return 1;
 }
 
-/**
+/*
  * vgic_its_save_device_tables - Save the device table and all ITT
  * into guest RAM
  *
@@ -2386,7 +2390,7 @@ static int handle_l1_dte(struct vgic_its *its, u32 id, void *addr,
  return ret;
 }
 
-/**
+/*
  * vgic_its_restore_device_tables - Restore the device table and all ITT
  * from guest RAM to internal data structs
  */
@@ -2478,7 +2482,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
  return 1;
 }
 
-/**
+/*
  * vgic_its_save_collection_table - Save the collection table into
  * guest RAM
  */
@@ -2518,7 +2522,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
  return ret;
 }
 
-/**
+/*
  * vgic_its_restore_collection_table - reads the collection table
  * in guest memory and restores the ITS internal state. Requires the
  * BASER registers to be restored before.
@@ -2556,7 +2560,7 @@ static int vgic_its_restore_collection_table(struct vgic_its *its)
  return ret;
 }
 
-/**
+/*
  * vgic_its_save_tables_v0 - Save the ITS tables into guest ARM
  * according to v0 ABI
  */
@@ -2571,7 +2575,7 @@ static int vgic_its_save_tables_v0(struct vgic_its *its)
  return vgic_its_save_collection_table(its);
 }
 
-/**
+/*
  * vgic_its_restore_tables_v0 - Restore the ITS tables from guest RAM
  * to internal data structs according to V0 ABI
  *

arch/arm64/kvm/vgic/vgic-v3.c

@@ -370,7 +370,7 @@ static void map_all_vpes(struct kvm *kvm)
  dist->its_vm.vpes[i]->irq));
 }
 
-/**
+/*
  * vgic_v3_save_pending_tables - Save the pending tables into guest RAM
  * kvm lock and all vcpu lock must be held
  */

arch/arm64/kvm/vgic/vgic.c

@@ -313,7 +313,7 @@ static bool vgic_validate_injection(struct vgic_irq *irq, bool level, void *owne
  * with all locks dropped.
  */
 bool vgic_queue_irq_unlock(struct kvm *kvm, struct vgic_irq *irq,
- unsigned long flags)
+ unsigned long flags) __releases(&irq->irq_lock)
 {
  struct kvm_vcpu *vcpu;
 

arch/arm64/kvm/vgic/vgic.h

@@ -186,7 +186,7 @@ bool vgic_get_phys_line_level(struct vgic_irq *irq);
 void vgic_irq_set_phys_pending(struct vgic_irq *irq, bool pending);
 void vgic_irq_set_phys_active(struct vgic_irq *irq, bool active);
 bool vgic_queue_irq_unlock(struct kvm *kvm, struct vgic_irq *irq,
- unsigned long flags);
+ unsigned long flags) __releases(&irq->irq_lock);
 void vgic_kick_vcpus(struct kvm *kvm);
 void vgic_irq_handle_resampling(struct vgic_irq *irq,
  bool lr_deactivated, bool lr_pending);

tools/testing/selftests/kvm/aarch64/get-reg-list.c

@@ -32,13 +32,13 @@ static struct feature_id_reg feat_id_regs[] = {
  {
  ARM64_SYS_REG(3, 0, 10, 2, 2), /* PIRE0_EL1 */
  ARM64_SYS_REG(3, 0, 0, 7, 3), /* ID_AA64MMFR3_EL1 */
- 4,
+ 8,
  1
  },
  {
  ARM64_SYS_REG(3, 0, 10, 2, 3), /* PIR_EL1 */
  ARM64_SYS_REG(3, 0, 0, 7, 3), /* ID_AA64MMFR3_EL1 */
- 4,
+ 8,
  1
  }
 };