From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A0C92F36 for ; Wed, 25 Jan 2023 14:14:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9458C433D2; Wed, 25 Jan 2023 14:14:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1674656071; bh=/Vnpkso8mckCxGmyhVYzF2vn9Lk2POBSVUnWGWIl6DE=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=W2vMBkDG5DOYhGg3hBI/GsFDxV4pBam6zX2r4AqmxDnjZFLrbyai2OHgo9OfcVttR IQOv4Xx2lxjfZOF66WZJHc9xkIkq+OVgwV92yhgie8yuKl2Vm+sGZ07jV2SIQfGbJN jScLIyTHj7FS+0CDNj35hilEdxrrTmRaOgGZVqG5s/3gmMIme7zVbqdJ+m9yS8HHGW nHTH7ECVx/4XfN4/e7+/b9oc8Z5ihX4JhdTgpZHDudoHwrdA2yId4XeklwmV8NDSrc aVZ4PQTZHiCbigH0tSRhvHXq8I/3Gmlrspz+On0fy4CVCQuTx1RGaZFtdJEwLIqbtj qdvXL/kTsOKaA== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1pKgXl-004YD8-M1; Wed, 25 Jan 2023 14:14:29 +0000 Date: Wed, 25 Jan 2023 14:14:29 +0000 Message-ID: <86357yn1kq.wl-maz@kernel.org> From: Marc Zyngier To: Ricardo Koller Cc: Oliver Upton , kvm@vger.kernel.org, kvmarm@lists.linux.dev, andrew.jones@linux.dev, pbonzini@redhat.com, alexandru.elisei@arm.com, eric.auger@redhat.com, yuzenghui@huawei.com Subject: Re: [PATCH 4/4] KVM: selftests: aarch64: Test read-only PT memory regions In-Reply-To: References: <20230110022432.330151-1-ricarkol@google.com> <20230110022432.330151-5-ricarkol@google.com> <864jsen6li.wl-maz@kernel.org> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/28.2 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) Precedence: bulk X-Mailing-List: kvmarm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: ricarkol@google.com, oliver.upton@linux.dev, kvm@vger.kernel.org, kvmarm@lists.linux.dev, andrew.jones@linux.dev, pbonzini@redhat.com, alexandru.elisei@arm.com, eric.auger@redhat.com, yuzenghui@huawei.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false On Wed, 25 Jan 2023 14:02:18 +0000, Ricardo Koller wrote: > > On Wed, Jan 25, 2023 at 12:26:01PM +0000, Marc Zyngier wrote: > > On Tue, 24 Jan 2023 19:54:57 +0000, > > Oliver Upton wrote: > > > > > > On Tue, Jan 24, 2023 at 08:26:02AM -0800, Ricardo Koller wrote: > > > > On Mon, Jan 23, 2023 at 11:36:52PM +0000, Oliver Upton wrote: > > > > > On Tue, Jan 10, 2023 at 02:24:32AM +0000, Ricardo Koller wrote: > > > > > > Extend the read-only memslot tests in page_fault_test to test read-only PT > > > > > > (Page table) memslots. Note that this was not allowed before commit "KVM: > > > > > > arm64: Fix handling of S1PTW S2 fault on RO memslots" as all S1PTW faults > > > > > > were treated as writes which resulted in an (unrecoverable) exception > > > > > > inside the guest. > > > > > > > > > > Do we need an additional test that the guest gets nuked if TCR_EL1.HA = > > > > > 0b1 and AF is clear in one of the stage-1 PTEs? > > > > > > > > > > > > > That should be easy to add. The only issue is whether that's also a case > > > > of checking for very specific KVM behavior that could change in the > > > > future. > > > > > > From the perspective of the guest I believe this to match the > > > architecture. An external abort is appropriate if the hardware update to > > > a descriptor failed. > > > > > > I believe that the current implementation of this in KVM is slightly > > > wrong, though. AFAICT, we encode the abort with an FSC of 0x10, which > > > indicates an SEA occurred outside of a table walk. The other nuance of > > > reporting SEAs due to a TTW is that the FSC encodes the level at which > > > the external abort occurred. Nonetheless, I think we can hide behind > > > R_BGPQR of DDI0487I.a and always encode a level of 0: > > > > > > """ > > > If a synchronous External abort is generated due to a TLB or > > > intermediate TLB caching structure, including parity or ECC errors, > > > then all of the following are permitted: > > > - If the PE cannot precisely determine the translation stage at which > > > the error occurred, then it is reported and prioritized as a stage 1 > > > fault. > > > - If the PE cannot precisely determine the lookup level at which the > > > error occurred, then the lookup level is reported and prioritized > > > as one of the following: > > > - The lowest-numbered lookup level that could have caused the error. > > > - If the PE cannot determine any information about the lookup level, > > > then level 0. > > > """ > > > > > > Thoughts? > > > > Indeed, the abort injection has always been on the dodgy side of > > things. I remember Christoffer and I writing this, saying that it was > > something we'd have to eventually fix. 10 years down the line, this > > code is, unsurprisingly, still dodgy. > > > > My vote would be to slightly extend the API to take a set of > > KVM-specific flags to give context to the injection helpers (such as > > SEA during a TTW), and bring the KVM behaviour in line with the > > architecture. > > > > Reporting 0 in the FSC is probably OK, but we should also be able to > > determine which level this fails at: > > > > - Sample FAR_EL2[55] to derive which TTBR this translates from (n) > > - From TCR_EL1.{TnSZ,TGn}, you can determine the number of levels > > > > There is a bunch of tables for this in the ARM ARM, and it is possible > > to come up with a decent formula that encompass all the possible > > combinations. > > > > But as I said, 0 is probably fine... ;-) > > > > M. > > > > -- > > Without deviation from the norm, progress is not possible. > > > > Thank you both. > > So, what about the following? I can send a series after this that > includes a KVM fix to report level 0 in the FSC in this S1PTW case, and > an extra test that checks that the exception comes with some sane values > (like a sane level in the FSC). Then, getting the actual lookup level > can be added as an improvement (with less priority than the first fix). Works for me. You could also fold the level-0 fix in this series, and only add the lookup level fix later, if ever. Thanks, M. -- Without deviation from the norm, progress is not possible.