From patchwork Fri Jul 24 14:35:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Will Deacon X-Patchwork-Id: 11683451 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 00A4A618 for ; Fri, 24 Jul 2020 14:37:28 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CBC81206D8 for ; Fri, 24 Jul 2020 14:37:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="V9ryF2iD"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="qh8oWoBa" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CBC81206D8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=8F1tx56HGsKJczkIulw0ZusWS7T8YgHKIgnedu8ErbE=; b=V9ryF2iDgPO5t/jfz6gnSzgav /WhJaoUO1UY0Uubkrwl38Pu0GDVyGuSwrJBflIBHiewyhIjoCOe/d64CC0MLzLOBfeZe2iqP1m9jK Qw0tL41Vom/3uT9cfwTHB2ol9DlGxiEMCP1vItHI0PCGnIOyAUoRmNm3Ea+AdVIV9NrD85wTiIeSX 728k2sqwrodp383oCpVn3iWPOhnpeU7tAMmtBXhXKPxa6mlIPJkW7bY+aew7mDYAp1qjFlTY3d0nn nzMzFhcG0mZS0hX8ZGXZFWTBV19idiAQ1DWHPz82u2mBRh6Ge6O3ztFhwJFnPVn6wPBCvdiBQU4sx G/Lq4QPCg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jyynj-0003MT-R8; Fri, 24 Jul 2020 14:35:56 +0000 Received: from mail.kernel.org ([198.145.29.99]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1jyynG-0003FK-8o for linux-arm-kernel@lists.infradead.org; Fri, 24 Jul 2020 14:35:28 +0000 Received: from localhost.localdomain (236.31.169.217.in-addr.arpa [217.169.31.236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4ECBB2065C; Fri, 24 Jul 2020 14:35:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1595601325; bh=aH6+b9S0bxa9/SN+80CrqBVkxawU3zO7lLnHFqJKx/Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qh8oWoBa5d97kv/5Ec1xVKnU0c7jbVGRWvECJktcuh03XdNewjxMcBYP3kJZeQap5 ze1Ac6uT4dw0xZJk4hqEQvVSlsoVcdUlBCG1E99K3NqUPXc8Umc+42BEThUIAKNZCd ewtLa8hzzMldYszFp+8yn/9Fcf8wbqkfer26IgrA= From: Will Deacon To: kvmarm@lists.cs.columbia.edu Subject: [PATCH 7/7] KVM: arm64: Separate write faults on read-only memslots from MMIO Date: Fri, 24 Jul 2020 15:35:06 +0100 Message-Id: <20200724143506.17772-8-will@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200724143506.17772-1-will@kernel.org> References: <20200724143506.17772-1-will@kernel.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200724_103526_524280_FCC4AF01 X-CRM114-Status: GOOD ( 19.68 ) X-Spam-Score: -5.2 (-----) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-5.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/, high trust [198.145.29.99 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.0 DKIMWL_WL_HIGH DKIMwl.org - Whitelisted High sender X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Quentin Perret , kernel-team@android.com, Suzuki Poulose , James Morse , Marc Zyngier , Will Deacon , linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org Although taking a write-fault on a read-only memslot triggers an MMIO exit back to userspace, lumping the handling together in kvm_handle_guest_abort() causes some of the early triage to have weird effects on userspace. For example, if a guest generates a stage-2 fault on a stage-1 translation fault when trying to fetch an instruction from a read-only memslot, it will be mistakenly treated as an attempt to execute from MMIO and a prefetch abort will be re-injected into the guest. Separate the MMIO handling from the read-only memslot handling, so that the latter is left entirely up to userspace. Note that this _will_ result in more exits than before for read-only memslots, since userspace will now see some cache maintenance and instruction-side aborts. Cc: Marc Zyngier Cc: Quentin Perret Signed-off-by: Will Deacon --- arch/arm64/kvm/mmu.c | 45 ++++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index 9e72e7f4a2c2..2edc6f2412dc 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -2117,9 +2117,30 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) memslot = gfn_to_memslot(vcpu->kvm, gfn); hva = gfn_to_hva_memslot_prot(memslot, gfn, &writable); write_fault = kvm_is_write_fault(vcpu); - if (kvm_is_error_hva(hva) || (write_fault && !writable)) { + + /* + * The IPA is reported as [MAX:12], so we need to complement it with + * the bottom 12 bits from the faulting VA. This is always 12 bits, + * irrespective of the page size. + */ + fault_ipa |= kvm_vcpu_get_hfar(vcpu) & ((1 << 12) - 1); + + /* + * We can perform some early fault triage based purely on the memslot + * information: + * + * Faults on IPAs falling outside of any memslot are re-injected + * into the guest as external aborts if they were either signalled as + * instruction aborts or as a stage-2 fault on a translation table walk. + * If the instruction was a cache maintenance instruction then it is + * quietly skipped, otherwise we exit to userspace for MMIO emulation. + * + * Write faults on IPAs falling within a read-only memslot are reported + * to userspace as MMIO exits. This includes cache maintenance and + * stage-2 faults on translation table walks, + */ + if (kvm_is_error_hva(hva)) { if (kvm_vcpu_trap_is_iabt(vcpu)) { - /* Prefetch Abort on I/O address */ ret = -ENOEXEC; goto out; } @@ -2129,30 +2150,12 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) goto out; } - /* - * Check for a cache maintenance operation. Since we - * ended-up here, we know it is outside of any memory - * slot. But we can't find out if that is for a device, - * or if the guest is just being stupid. The only thing - * we know for sure is that this range cannot be cached. - * - * So let's assume that the guest is just being - * cautious, and skip the instruction. - */ if (kvm_vcpu_dabt_is_cm(vcpu)) { kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); ret = 1; goto out_unlock; } - /* - * The IPA is reported as [MAX:12], so we need to - * complement it with the bottom 12 bits from the - * faulting VA. This is always 12 bits, irrespective - * of the page size. - */ - fault_ipa |= kvm_vcpu_get_hfar(vcpu) & ((1 << 12) - 1); - /* * No valid syndrome? Ask userspace for help if it has * volunteered to do so, and bail out otherwise. @@ -2161,7 +2164,9 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) ret = handle_error_invalid_dabt(vcpu, run, fault_ipa); goto out_unlock; } + } + if (kvm_is_error_hva(hva) || (write_fault && !writable)) { ret = io_mem_abort(vcpu, run, fault_ipa); goto out_unlock; }