linux-kernel - Re: [PATCH 2/2] RISC-V: KVM: Restrict the extensions that can be disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Apr 2022 00:42:50 -0700
From:   Atish Patra <atishp@...shpatra.org>
To:     Atish Patra <atishp@...osinc.com>
Cc:     KVM General <kvm@...r.kernel.org>,
        Anup Patel <anup@...infault.org>,
        Damien Le Moal <damien.lemoal@....com>,
        devicetree <devicetree@...r.kernel.org>,
        Jisheng Zhang <jszhang@...nel.org>,
        Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com>,
        "linux-kernel@...r.kernel.org List" <linux-kernel@...r.kernel.org>,
        linux-riscv <linux-riscv@...ts.infradead.org>,
        Palmer Dabbelt <palmer@...belt.com>,
        Paul Walmsley <paul.walmsley@...ive.com>,
        Rob Herring <robh+dt@...nel.org>, kvm-riscv@...ts.infradead.org
Subject: Re: [PATCH 2/2] RISC-V: KVM: Restrict the extensions that can be disabled

On Tue, Apr 19, 2022 at 6:33 PM Atish Patra <atishp@...osinc.com> wrote:
>
> Currently, the config reg register allows to disable all allowed
> single letter ISA extensions. It shouldn't be the case as vmm
> shouldn't be able disable base extensions (imac).

/s/able/able to/

> These extensions should always be enabled as long as they are enabled
> in the host ISA.
>
> Signed-off-by: Atish Patra <atishp@...osinc.com>
> ---
>  arch/riscv/kvm/vcpu.c | 21 +++++++++++++--------
>  1 file changed, 13 insertions(+), 8 deletions(-)
>
> diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
> index 2e25a7b83a1b..14dd801651e5 100644
> --- a/arch/riscv/kvm/vcpu.c
> +++ b/arch/riscv/kvm/vcpu.c
> @@ -38,12 +38,16 @@ const struct kvm_stats_header kvm_vcpu_stats_header = {
>                        sizeof(kvm_vcpu_stats_desc),
>  };
>
> -#define KVM_RISCV_ISA_ALLOWED  (riscv_isa_extension_mask(a) | \
> -                                riscv_isa_extension_mask(c) | \
> -                                riscv_isa_extension_mask(d) | \
> -                                riscv_isa_extension_mask(f) | \
> -                                riscv_isa_extension_mask(i) | \
> -                                riscv_isa_extension_mask(m))
> +#define KVM_RISCV_ISA_DISABLE_ALLOWED  (riscv_isa_extension_mask(d) | \
> +                                       riscv_isa_extension_mask(f))
> +
> +#define KVM_RISCV_ISA_DISABLE_NOT_ALLOWED      (riscv_isa_extension_mask(a) | \
> +                                               riscv_isa_extension_mask(c) | \
> +                                               riscv_isa_extension_mask(i) | \
> +                                               riscv_isa_extension_mask(m))
> +
> +#define KVM_RISCV_ISA_ALLOWED (KVM_RISCV_ISA_DISABLE_ALLOWED | \
> +                              KVM_RISCV_ISA_DISABLE_NOT_ALLOWED)
>
>  static void kvm_riscv_reset_vcpu(struct kvm_vcpu *vcpu)
>  {
> @@ -217,9 +221,10 @@ static int kvm_riscv_vcpu_set_reg_config(struct kvm_vcpu *vcpu,
>         switch (reg_num) {
>         case KVM_REG_RISCV_CONFIG_REG(isa):
>                 if (!vcpu->arch.ran_atleast_once) {
> -                       vcpu->arch.isa = reg_val;
> +                       /* Ignore the disable request for these extensions */
> +                       vcpu->arch.isa = reg_val | KVM_RISCV_ISA_DISABLE_NOT_ALLOWED;
>                         vcpu->arch.isa &= riscv_isa_extension_base(NULL);
> -                       vcpu->arch.isa &= KVM_RISCV_ISA_ALLOWED;
> +                       vcpu->arch.isa &= KVM_RISCV_ISA_DISABLE_ALLOWED;
>                         kvm_riscv_vcpu_fp_reset(vcpu);
>                 } else {
>                         return -EOPNOTSUPP;
> --
> 2.25.1
>

Sorry. I forgot to add the fixes tag.

Fixes: 92ad82002c39 (RISC-V: KVM: Implement
KVM_GET_ONE_REG/KVM_SET_ONE_REG ioctls)

-- 
Regards,
Atish