From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 634F1C5DF62 for ; Wed, 26 Jan 2022 20:32:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230459AbiAZUcr (ORCPT ); Wed, 26 Jan 2022 15:32:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59232 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230423AbiAZUcq (ORCPT ); Wed, 26 Jan 2022 15:32:46 -0500 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 732FEC06161C for ; Wed, 26 Jan 2022 12:32:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 3C6BBCE1D80 for ; Wed, 26 Jan 2022 20:32:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51CD9C340E3; Wed, 26 Jan 2022 20:32:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1643229162; bh=XYaD/d6SG1smVMloGRMNQs4F/FTP6XnZyqHQfV/Y6qc=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=CWweYOovpuFowzu36L+FAi8D2Rn6Lp6LJe8LkfoiefCD5cUtFglqbCRiiTQSvSRPt fR8Gs01Tbm/hHv4l3KakRvxWhp8TJKtW+KHu2y1WAOCA8/wFFXMUOPkx3008Ez3The oTmrOI4AM3jIxNF+EyUnKgLVxcXkRuvsORGhXU9E10qQuye9cG7OOYXtUrQq7+4rC8 uR5U9UUZAeyFn8EWJqtD5R6i5DKliStzGT+WBJYll4i7UG1cp14DmJmbwMtaQJoHjr tZz59C0ZZdC3suBD7w6bgVEO/0ttF6VDWbEtLM+b9OOCqXA069+MU6K5EWB8kFK/GV v6ul+deRh5kCw== Received: from sofa.misterjones.org ([185.219.108.64] helo=why.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nCoy7-003KRq-T5; Wed, 26 Jan 2022 20:32:40 +0000 Date: Wed, 26 Jan 2022 20:32:39 +0000 Message-ID: <875yq66xw8.wl-maz@kernel.org> From: Marc Zyngier To: "Russell King (Oracle)" Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, Andre Przywara , Christoffer Dall , Jintack Lim , Haibo Xu , Ganapatrao Kulkarni , James Morse , Suzuki K Poulose , Alexandru Elisei , kernel-team@android.com Subject: Re: [PATCH v5 14/69] KVM: arm64: nv: Support virtual EL2 exceptions In-Reply-To: References: <20211129200150.351436-1-maz@kernel.org> <20211129200150.351436-15-maz@kernel.org> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/27.1 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: linux@armlinux.org.uk, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, andre.przywara@arm.com, christoffer.dall@arm.com, jintack@cs.columbia.edu, haibo.xu@linaro.org, gankulkarni@os.amperecomputing.com, james.morse@arm.com, suzuki.poulose@arm.com, alexandru.elisei@arm.com, kernel-team@android.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Tue, 18 Jan 2022 16:02:28 +0000, "Russell King (Oracle)" wrote: > > On Mon, Nov 29, 2021 at 08:00:55PM +0000, Marc Zyngier wrote: > > From: Jintack Lim > > > > Support injecting exceptions and performing exception returns to and > > from virtual EL2. This must be done entirely in software except when > > taking an exception from vEL0 to vEL2 when the virtual HCR_EL2.{E2H,TGE} > > == {1,1} (a VHE guest hypervisor). > > > > Signed-off-by: Jintack Lim > > Signed-off-by: Christoffer Dall > > [maz: switch to common exception injection framework] > > Signed-off-by: Marc Zyngier > > --- > ... > > +void kvm_emulate_nested_eret(struct kvm_vcpu *vcpu) > > +{ > > + u64 spsr, elr, mode; > > + bool direct_eret; > > + > > + /* > > + * Going through the whole put/load motions is a waste of time > > + * if this is a VHE guest hypervisor returning to its own > > + * userspace, or the hypervisor performing a local exception > > + * return. No need to save/restore registers, no need to > > + * switch S2 MMU. Just do the canonical ERET. > > + */ > > + spsr = vcpu_read_sys_reg(vcpu, SPSR_EL2); > > + mode = spsr & (PSR_MODE_MASK | PSR_MODE32_BIT); > > + > > + direct_eret = (mode == PSR_MODE_EL0t && > > + vcpu_el2_e2h_is_set(vcpu) && > > + vcpu_el2_tge_is_set(vcpu)); > > + direct_eret |= (mode == PSR_MODE_EL2h || mode == PSR_MODE_EL2t); > > There are excessive parens on the RHS of the above two. I guess this is my personal taste, and this is the kind of cosmetic things that help me reason about the code. Some people use syntax highlighting, I use bracketing. I don't think this really matters in the grand scheme of things. [...] > > +/* > > + * Emulate taking an exception to EL2. > > + * See ARM ARM J8.1.2 AArch64.TakeException() > > + */ > > +static int kvm_inject_nested(struct kvm_vcpu *vcpu, u64 esr_el2, > > + enum exception_type type) > > +{ > > + u64 pstate, mode; > > + bool direct_inject; > > + > > + if (!nested_virt_in_use(vcpu)) { > > + kvm_err("Unexpected call to %s for the non-nesting configuration\n", > > + __func__); > > Too much indentation. I'm guessing this "unexpected" condition isn't > something that can be caused by a rogue guest? If it can, doesn't this > need to be rate limited? If we end-up here, this is very much a hypervisor logic bug. [...] > > + > > + /* If not nesting, EL1 is the only possible exception target */ > > + if (likely(!nested_virt_in_use(vcpu))) { > > + vcpu->arch.flags |= KVM_ARM64_EXCEPT_AA64_EL1; > > + return; > > + } > > + > > + /* > > + * With NV, we need to pick between EL1 and EL2. Note that we > > + * never deal with a nesting exception here, hence never > > + * changing context, and the exception itself can be delayed > > + * until the next entry. > > + */ > > + switch(*vcpu_cpsr(vcpu) & PSR_MODE_MASK) { > > + case PSR_MODE_EL2h: > > + case PSR_MODE_EL2t: > > + vcpu->arch.flags |= KVM_ARM64_EXCEPT_AA64_EL2; > > + break; > > + case PSR_MODE_EL1h: > > + case PSR_MODE_EL1t: > > + vcpu->arch.flags |= KVM_ARM64_EXCEPT_AA64_EL1; > > + break; > > + case PSR_MODE_EL0t: > > + if (vcpu_el2_tge_is_set(vcpu) & HCR_TGE) > > + vcpu->arch.flags |= KVM_ARM64_EXCEPT_AA64_EL2; > > + else > > + vcpu->arch.flags |= KVM_ARM64_EXCEPT_AA64_EL1; > > + break; > > + default: > > + BUG(); > > Is taking out the host really appropriate here? Is this something a > rogue guest could trigger? This switch is supposed to cover all the NS exception levels, in either stack configuration. If we suddenly find ourselves with a non-architectural state, we have horribly messed up. And no, a guest shouldn't be able to affect this. If it can, that's even more of a reason to take everything down ASAP. Thanks, M. -- Without deviation from the norm, progress is not possible.