mbox series

[v2,0/2] KVM: arm64: Fix handling of S1PTW

Message ID 20200915104218.1284701-1-maz@kernel.org (mailing list archive)
Headers show
Series KVM: arm64: Fix handling of S1PTW | expand

Message

Marc Zyngier Sept. 15, 2020, 10:42 a.m. UTC
I recently managed to trigger an interesting failure mode, where a
guest would be stuck on an instruction abort due to a permission
fault. Interestingly enough, this IABT had S1PTW set in the ESR,
indicating that it was trying to *write* to the PT. We fix it by
adding the execute permission (it's an IABT, after all...), and going
nowhere fast.

Note that it can only happen on a system that can perform automatic
updates of the page table flags.

This small series fixes the issue by revamping the S1PTW handling in
the context of execution faults. The first patch fixes the bug, and is
definitely a stable candidate. The second patch is merely a cleanup,
which can wait.

Tested on an A55-based board.

* From v1:
  - Rename kvm_vcpu_dabt_iss1tw() to kvm_vcpu_abt_iss1tw()
  - Don't overload kvm_vcpu_trap_is_iabt()
  - Introduce kvm_vcpu_trap_is_exec_fault()

Marc Zyngier (2):
  KVM: arm64: Assume write fault on S1PTW permission fault on
    instruction fetch
  KVM: arm64: Remove S1PTW check from kvm_vcpu_dabt_iswrite()

 arch/arm64/include/asm/kvm_emulate.h    | 14 +++++++++++---
 arch/arm64/kvm/hyp/include/hyp/switch.h |  2 +-
 arch/arm64/kvm/mmu.c                    |  4 ++--
 3 files changed, 14 insertions(+), 6 deletions(-)

Comments

Will Deacon Sept. 18, 2020, 1:37 p.m. UTC | #1
On Tue, Sep 15, 2020 at 11:42:16AM +0100, Marc Zyngier wrote:
> I recently managed to trigger an interesting failure mode, where a
> guest would be stuck on an instruction abort due to a permission
> fault. Interestingly enough, this IABT had S1PTW set in the ESR,
> indicating that it was trying to *write* to the PT. We fix it by
> adding the execute permission (it's an IABT, after all...), and going
> nowhere fast.
> 
> Note that it can only happen on a system that can perform automatic
> updates of the page table flags.
> 
> This small series fixes the issue by revamping the S1PTW handling in
> the context of execution faults. The first patch fixes the bug, and is
> definitely a stable candidate. The second patch is merely a cleanup,
> which can wait.
> 
> Tested on an A55-based board.
> 
> * From v1:
>   - Rename kvm_vcpu_dabt_iss1tw() to kvm_vcpu_abt_iss1tw()
>   - Don't overload kvm_vcpu_trap_is_iabt()
>   - Introduce kvm_vcpu_trap_is_exec_fault()

For both patches:

Reviewed-by: Will Deacon <will@kernel.org>

Cheers,

Will