[PATCH 0/2] KVM: MIPS/Emulate: TLBWR & TLBR fixes for T&E

[PATCH 0/2] KVM: MIPS/Emulate: TLBWR & TLBR fixes for T&E

[James Hogan]

These two patches fix TLBWR and TLBR instruction emulation for Trap &
Emulate guests, so that wired entries are properly preserved and so that
the entries can be read back by the guest itself.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Cc: stable@vger.kernel.org

James Hogan (2):
  KVM: MIPS/Emulate: Fix TLBWR with wired for T&E
  KVM: MIPS/Emulate: Properly implement TLBR for T&E

 arch/mips/kvm/emulate.c | 103 ++++++++++++++++++++++-------------------
 1 file changed, 56 insertions(+), 47 deletions(-)

-- 
git-series 0.8.10

[PATCH 1/2] KVM: MIPS/Emulate: Fix TLBWR with wired for T&E

[James Hogan]

The implementation of the TLBWR instruction for Trap & Emulate does not
take the CP0_Wired register into account, allowing the guest's wired
entries to be easily overwritten during normal guest TLB refill
operation.

Offset the random TLB index by CP0_Wired and keep it in the range of
valid non-wired entries with a modulo operation instead of a mask. This
allows wired TLB entries to be properly preserved.

Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target ...")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Cc: <stable@vger.kernel.org> # 3.10.x-
---
 arch/mips/kvm/emulate.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index 4833ebad89d9..dd47f2bda01b 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -1094,10 +1094,12 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu)
 	struct mips_coproc *cop0 = vcpu->arch.cop0;
 	struct kvm_mips_tlb *tlb = NULL;
 	unsigned long pc = vcpu->arch.pc;
+	unsigned int wired;
 	int index;
 
 	get_random_bytes(&index, sizeof(index));
-	index &= (KVM_MIPS_GUEST_TLB_SIZE - 1);
+	wired = kvm_read_c0_guest_wired(cop0) & (KVM_MIPS_GUEST_TLB_SIZE - 1);
+	index = wired + index % (KVM_MIPS_GUEST_TLB_SIZE - wired);
 
 	tlb = &vcpu->arch.guest_tlb[index];
 
-- 
git-series 0.8.10

Re: [PATCH 1/2] KVM: MIPS/Emulate: Fix TLBWR with wired for T&E

[Ralf Baechle]

On Tue, Mar 14, 2017 at 05:00:07PM +0000, James Hogan wrote:

> The implementation of the TLBWR instruction for Trap & Emulate does not
> take the CP0_Wired register into account, allowing the guest's wired
> entries to be easily overwritten during normal guest TLB refill
> operation.
> 
> Offset the random TLB index by CP0_Wired and keep it in the range of
> valid non-wired entries with a modulo operation instead of a mask. This
> allows wired TLB entries to be properly preserved.
> 
> Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target ...")
> Signed-off-by: James Hogan <james.hogan@imgtec.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: "Radim Krčmář" <rkrcmar@redhat.com>
> Cc: Ralf Baechle <ralf@linux-mips.org>
> Cc: linux-mips@linux-mips.org
> Cc: kvm@vger.kernel.org
> Cc: <stable@vger.kernel.org> # 3.10.x-
> ---
>  arch/mips/kvm/emulate.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
> index 4833ebad89d9..dd47f2bda01b 100644
> --- a/arch/mips/kvm/emulate.c
> +++ b/arch/mips/kvm/emulate.c
> @@ -1094,10 +1094,12 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu)
>  	struct mips_coproc *cop0 = vcpu->arch.cop0;
>  	struct kvm_mips_tlb *tlb = NULL;
>  	unsigned long pc = vcpu->arch.pc;
> +	unsigned int wired;
>  	int index;
>  
>  	get_random_bytes(&index, sizeof(index));
> -	index &= (KVM_MIPS_GUEST_TLB_SIZE - 1);
> +	wired = kvm_read_c0_guest_wired(cop0) & (KVM_MIPS_GUEST_TLB_SIZE - 1);
> +	index = wired + index % (KVM_MIPS_GUEST_TLB_SIZE - wired);

FWIW, the "random" register is just a counter on all MIPS CPUs which will
wrap around to the value of the wired register rsp. 8 on some R3000-class
CPUs once it reaches the number of TLB entries, so get_random_bytes isn't
strictly correct.  I however can't see any problem with this implementatio
other than get_random_bytes might be a a bit heavier than necessary.

Acked-by: Ralf Baechle <ralf@linux-mips.org>

  Ralf