From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 38737C433EF for ; Thu, 28 Apr 2022 15:24:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Subject:Cc:To:From:Message-ID:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=zDamp+73Hpv2bx3g7ilujRHBLmvNKWD2jduSP/sTV9c=; b=lcnh3Np2iCM/wI uu2WjVw6ieOYX7VtkYK4TCdiWfB3JHBcuoVyxxPwpbTOQThrMFijtY3wkwT+OsITiP2KM+uhdfgrb heOBKF2UuLmW0vfYAMCpd2IeowFDYhdoNfXHOOKe6nlRm9FhnbL8wxOtosyErGG4+JllN7wi4Bb+4 0kUQHikHqG/uamhdo/otfMYwUytQe0TIuYvkjRQEpCEIy4plfMRCafYn0zlIFdhDilkeZXz+GTb6f m0NCVXBx1lqFrll3bg7mMMtACsMLkm4rNzINN6kmjJzMl6eZhO0Z2KaXfyt41Fude47zxFMDPI5ND 6moCT2QU5kKvy5AG5bJg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nk5z4-007di2-DH; Thu, 28 Apr 2022 15:23:10 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nk5z1-007dhb-Mp for linux-arm-kernel@lists.infradead.org; Thu, 28 Apr 2022 15:23:09 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B6C7161F71; Thu, 28 Apr 2022 15:23:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89E8CC385AA; Thu, 28 Apr 2022 15:23:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1651159385; bh=a+g7kB1z4KoOUj5wf8DAfU3CDt6Jxq6eIpCUJLbn5n4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=PbSACN0rbItX49rjK7eSne4lvayB2pyOPyuARhcjXZK/g1FU3CCGTF9Kee2tVT8H4 Y9NUNSqkKqVNgiCj3tXSa9Rhg16RqouOXyJIvSHlDRdwIZXQSwYWijMCfDNTP8HOH6 YglNhEQTFGx/43Hh6LNu4bzv7c2Q3bl010WiE4djB6fFpCloYBh0xhkGBp1SJTyDqi BITDyDBZqbkGv+c8EDnobZGUE3AN6mWCukrk0pUM7UidGff0oFNVuv57Lpydouz+Xg 5ZgBypNRBZpcnxZnqv+Q4bvMBGqFCSHdY0cpg1+8GzNQ7XnJ+vtZMOEQcTsey0cNOi lCQp2O1ew26eQ== Received: from [104.133.9.104] (helo=billy-the-mountain.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nk5yw-007huq-MB; Thu, 28 Apr 2022 16:23:03 +0100 Date: Thu, 28 Apr 2022 16:22:58 +0100 Message-ID: <87zgk5b5bh.wl-maz@kernel.org> From: Marc Zyngier To: Alexandru Elisei Cc: kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, James Morse , Suzuki K Poulose , kernel-team@android.com, Quentin Perret , Will Deacon , Christoffer Dall Subject: Re: [PATCH v2] KVM: arm64: Inject exception on out-of-IPA-range translation fault In-Reply-To: References: <20220427220434.3097449-1-maz@kernel.org> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/27.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-SA-Exim-Connect-IP: 104.133.9.104 X-SA-Exim-Rcpt-To: alexandru.elisei@arm.com, kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, james.morse@arm.com, suzuki.poulose@arm.com, kernel-team@android.com, qperret@google.com, will@kernel.org, christoffer.dall@arm.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220428_082307_856213_89B2E23A X-CRM114-Status: GOOD ( 36.38 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, 28 Apr 2022 09:46:21 +0100, Alexandru Elisei wrote: > > Hi, > > On Wed, Apr 27, 2022 at 11:04:34PM +0100, Marc Zyngier wrote: > > When taking a translation fault for an IPA that is outside of > > the range defined by the hypervisor (between the HW PARange and > > the IPA range), we stupidly treat it as an IO and forward the access > > to userspace. Of course, userspace can't do much with it, and things > > end badly. > > > > Arguably, the guest is braindead, but we should at least catch the > > case and inject an exception. > > > > Check the faulting IPA against: > > - the sanitised PARange: inject an address size fault > > - the IPA size: inject an abort > > > > Reported-by: Christoffer Dall > > Signed-off-by: Marc Zyngier > > --- > > arch/arm64/include/asm/kvm_emulate.h | 1 + > > arch/arm64/kvm/inject_fault.c | 28 ++++++++++++++++++++++++++++ > > arch/arm64/kvm/mmu.c | 19 +++++++++++++++++++ > > 3 files changed, 48 insertions(+) > > > > diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h > > index 7496deab025a..f71358271b71 100644 > > --- a/arch/arm64/include/asm/kvm_emulate.h > > +++ b/arch/arm64/include/asm/kvm_emulate.h > > @@ -40,6 +40,7 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu); > > void kvm_inject_vabt(struct kvm_vcpu *vcpu); > > void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); > > void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); > > +void kvm_inject_size_fault(struct kvm_vcpu *vcpu); > > > > void kvm_vcpu_wfi(struct kvm_vcpu *vcpu); > > > > diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c > > index b47df73e98d7..ba20405d2dc2 100644 > > --- a/arch/arm64/kvm/inject_fault.c > > +++ b/arch/arm64/kvm/inject_fault.c > > @@ -145,6 +145,34 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr) > > inject_abt64(vcpu, true, addr); > > } > > > > +void kvm_inject_size_fault(struct kvm_vcpu *vcpu) > > +{ > > + unsigned long addr, esr; > > + > > + addr = kvm_vcpu_get_fault_ipa(vcpu); > > + addr |= kvm_vcpu_get_hfar(vcpu) & GENMASK(11, 0); > > + > > + if (kvm_vcpu_trap_is_iabt(vcpu)) > > + kvm_inject_pabt(vcpu, addr); > > + else > > + kvm_inject_dabt(vcpu, addr); > > + > > + /* > > + * If AArch64 or LPAE, set FSC to 0 to indicate an Address > > + * Size Fault at level 0, as if exceeding PARange. > > + * > > + * Non-LPAE guests will only get the external abort, as there > > + * is no way to to describe the ASF. > > + */ > > + if (vcpu_el1_is_32bit(vcpu) && > > + !(vcpu_read_sys_reg(vcpu, TCR_EL1) & TTBCR_EAE)) > > + return; > > + > > + esr = vcpu_read_sys_reg(vcpu, ESR_EL1); > > + esr &= ~GENMASK_ULL(5, 0); > > + vcpu_write_sys_reg(vcpu, esr, ESR_EL1); > > +} > > + > > /** > > * kvm_inject_undefined - inject an undefined instruction into the guest > > * @vcpu: The vCPU in which to inject the exception > > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c > > index 53ae2c0640bc..5400fc020164 100644 > > --- a/arch/arm64/kvm/mmu.c > > +++ b/arch/arm64/kvm/mmu.c > > @@ -1337,6 +1337,25 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu) > > fault_ipa = kvm_vcpu_get_fault_ipa(vcpu); > > is_iabt = kvm_vcpu_trap_is_iabt(vcpu); > > > > + if (fault_status == FSC_FAULT) { > > + /* Beyond sanitised PARange (which is the IPA limit) */ > > + if (fault_ipa >= BIT_ULL(get_kvm_ipa_limit())) { > > + kvm_inject_size_fault(vcpu); > > + return 1; > > + } > > + > > + /* Falls between the IPA range and the PARange? */ > > + if (fault_ipa >= BIT_ULL(vcpu->arch.hw_mmu->pgt->ia_bits)) { > > + fault_ipa |= kvm_vcpu_get_hfar(vcpu) & GENMASK(11, 0); > > + > > + if (is_iabt) > > + kvm_inject_pabt(vcpu, fault_ipa); > > + else > > + kvm_inject_dabt(vcpu, fault_ipa); > > + return 1; > > + } > > Doesn't KVM treat faults outside a valid memslot (aka guest RAM) as MMIO > aborts? From the guest's point of view, the IPA is valid because it's > inside the HW PARange, so it's not entirely impossible that the VMM put a > device there. Sure. But the generated IPA is outside of the range the VMM has asked to handle. The IPA space describes the whole of the guest address space, and there shouldn't be anything outside of it. We actually state in the documentation that the IPA Size limit *is* the physical address size for the VM. If the VMM places something outside if the IPA space and still expect something to be reported to it, we have a problem (in some cases, we may want to actually put page tables in place even for MMIO that traps to userspace -- see my earlier work on MMIO guard). Does it make sense to you? M. -- Without deviation from the norm, progress is not possible. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel