From: Will Deacon <will@kernel.org> To: linux-arm-kernel@lists.infradead.org Cc: linux-arch@vger.kernel.org, Will Deacon <will@kernel.org>, Catalin Marinas <catalin.marinas@arm.com>, Marc Zyngier <maz@kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Peter Zijlstra <peterz@infradead.org>, Morten Rasmussen <morten.rasmussen@arm.com>, Qais Yousef <qais.yousef@arm.com>, Suren Baghdasaryan <surenb@google.com>, kernel-team@android.com, James Morse <james.morse@arm.com> Subject: [PATCH 1/6] KVM: arm64: Handle Asymmetric AArch32 systems Date: Tue, 27 Oct 2020 21:51:13 +0000 [thread overview] Message-ID: <20201027215118.27003-2-will@kernel.org> (raw) In-Reply-To: <20201027215118.27003-1-will@kernel.org> From: Qais Yousef <qais.yousef@arm.com> On a system without uniform support for AArch32 at EL0, it is possible for the guest to force run AArch32 at EL0 and potentially cause an illegal exception if running on a core without AArch32. Add an extra check so that if we catch the guest doing that, then we prevent it from running again by resetting vcpu->arch.target and return ARM_EXCEPTION_IL. We try to catch this misbehaviour as early as possible and not rely on an illegal exception occuring to signal the problem. Attempting to run a 32bit app in the guest will produce an error from QEMU if the guest exits while running in AArch32 EL0. Tested on Juno by instrumenting the host to fake asym aarch32 and instrumenting KVM to make the asymmetry visible to the guest. Cc: James Morse <james.morse@arm.com> Cc: Marc Zyngier <maz@kernel.org> Signed-off-by: Qais Yousef <qais.yousef@arm.com> [will: Incorporated feedback from Marc] Link: https://lore.kernel.org/r/20201021104611.2744565-2-qais.yousef@arm.com Signed-off-by: Will Deacon <will@kernel.org> --- arch/arm64/kvm/arm.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index f56122eedffc..a3b32df1afb0 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -808,6 +808,25 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) preempt_enable(); + /* + * The ARMv8 architecture doesn't give the hypervisor + * a mechanism to prevent a guest from dropping to AArch32 EL0 + * if implemented by the CPU. If we spot the guest in such + * state and that we decided it wasn't supposed to do so (like + * with the asymmetric AArch32 case), return to userspace with + * a fatal error. + */ + if (!system_supports_32bit_el0() && vcpu_mode_is_32bit(vcpu)) { + /* + * As we have caught the guest red-handed, decide that + * it isn't fit for purpose anymore by making the vcpu + * invalid. The VMM can try and fix it by issuing a + * KVM_ARM_VCPU_INIT if it really wants to. + */ + vcpu->arch.target = -1; + ret = ARM_EXCEPTION_IL; + } + ret = handle_exit(vcpu, ret); } -- 2.29.0.rc2.309.g374f81d7ae-goog
WARNING: multiple messages have this Message-ID (diff)
From: Will Deacon <will@kernel.org> To: linux-arm-kernel@lists.infradead.org Cc: linux-arch@vger.kernel.org, Marc Zyngier <maz@kernel.org>, kernel-team@android.com, Peter Zijlstra <peterz@infradead.org>, Catalin Marinas <catalin.marinas@arm.com>, Qais Yousef <qais.yousef@arm.com>, Suren Baghdasaryan <surenb@google.com>, James Morse <james.morse@arm.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Will Deacon <will@kernel.org>, Morten Rasmussen <morten.rasmussen@arm.com> Subject: [PATCH 1/6] KVM: arm64: Handle Asymmetric AArch32 systems Date: Tue, 27 Oct 2020 21:51:13 +0000 [thread overview] Message-ID: <20201027215118.27003-2-will@kernel.org> (raw) In-Reply-To: <20201027215118.27003-1-will@kernel.org> From: Qais Yousef <qais.yousef@arm.com> On a system without uniform support for AArch32 at EL0, it is possible for the guest to force run AArch32 at EL0 and potentially cause an illegal exception if running on a core without AArch32. Add an extra check so that if we catch the guest doing that, then we prevent it from running again by resetting vcpu->arch.target and return ARM_EXCEPTION_IL. We try to catch this misbehaviour as early as possible and not rely on an illegal exception occuring to signal the problem. Attempting to run a 32bit app in the guest will produce an error from QEMU if the guest exits while running in AArch32 EL0. Tested on Juno by instrumenting the host to fake asym aarch32 and instrumenting KVM to make the asymmetry visible to the guest. Cc: James Morse <james.morse@arm.com> Cc: Marc Zyngier <maz@kernel.org> Signed-off-by: Qais Yousef <qais.yousef@arm.com> [will: Incorporated feedback from Marc] Link: https://lore.kernel.org/r/20201021104611.2744565-2-qais.yousef@arm.com Signed-off-by: Will Deacon <will@kernel.org> --- arch/arm64/kvm/arm.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index f56122eedffc..a3b32df1afb0 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -808,6 +808,25 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) preempt_enable(); + /* + * The ARMv8 architecture doesn't give the hypervisor + * a mechanism to prevent a guest from dropping to AArch32 EL0 + * if implemented by the CPU. If we spot the guest in such + * state and that we decided it wasn't supposed to do so (like + * with the asymmetric AArch32 case), return to userspace with + * a fatal error. + */ + if (!system_supports_32bit_el0() && vcpu_mode_is_32bit(vcpu)) { + /* + * As we have caught the guest red-handed, decide that + * it isn't fit for purpose anymore by making the vcpu + * invalid. The VMM can try and fix it by issuing a + * KVM_ARM_VCPU_INIT if it really wants to. + */ + vcpu->arch.target = -1; + ret = ARM_EXCEPTION_IL; + } + ret = handle_exit(vcpu, ret); } -- 2.29.0.rc2.309.g374f81d7ae-goog _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-10-27 21:51 UTC|newest] Thread overview: 96+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-10-27 21:51 [PATCH 0/6] An alternative series for asymmetric AArch32 systems Will Deacon 2020-10-27 21:51 ` Will Deacon 2020-10-27 21:51 ` Will Deacon [this message] 2020-10-27 21:51 ` [PATCH 1/6] KVM: arm64: Handle Asymmetric " Will Deacon 2020-10-27 21:51 ` [PATCH 2/6] arm64: Allow mismatched 32-bit EL0 support Will Deacon 2020-10-27 21:51 ` Will Deacon 2020-10-28 11:12 ` Catalin Marinas 2020-10-28 11:12 ` Catalin Marinas 2020-10-28 11:17 ` Will Deacon 2020-10-28 11:17 ` Will Deacon 2020-10-28 11:22 ` Catalin Marinas 2020-10-28 11:22 ` Catalin Marinas 2020-10-28 11:23 ` Will Deacon 2020-10-28 11:23 ` Will Deacon 2020-10-28 11:49 ` Catalin Marinas 2020-10-28 11:49 ` Catalin Marinas 2020-10-28 12:40 ` Will Deacon 2020-10-28 12:40 ` Will Deacon 2020-10-28 18:56 ` Catalin Marinas 2020-10-28 18:56 ` Catalin Marinas 2020-10-29 22:20 ` Will Deacon 2020-10-29 22:20 ` Will Deacon 2020-10-30 11:18 ` Catalin Marinas 2020-10-30 11:18 ` Catalin Marinas 2020-10-30 16:13 ` Will Deacon 2020-10-30 16:13 ` Will Deacon 2020-11-02 11:44 ` Catalin Marinas 2020-11-02 11:44 ` Catalin Marinas 2020-11-05 21:38 ` Will Deacon 2020-11-05 21:38 ` Will Deacon 2020-11-06 12:54 ` Qais Yousef 2020-11-06 12:54 ` Qais Yousef 2020-11-06 13:00 ` Will Deacon 2020-11-06 13:00 ` Will Deacon 2020-11-06 14:48 ` Qais Yousef 2020-11-06 14:48 ` Qais Yousef 2020-11-09 13:52 ` Will Deacon 2020-11-09 13:52 ` Will Deacon 2020-11-11 16:27 ` Qais Yousef 2020-11-11 16:27 ` Qais Yousef 2020-11-12 10:24 ` Will Deacon 2020-11-12 10:24 ` Will Deacon 2020-11-12 11:55 ` Qais Yousef 2020-11-12 11:55 ` Qais Yousef 2020-11-12 16:49 ` Qais Yousef 2020-11-12 16:49 ` Qais Yousef 2020-11-12 17:06 ` Marc Zyngier 2020-11-12 17:06 ` Marc Zyngier 2020-11-12 17:36 ` Qais Yousef 2020-11-12 17:36 ` Qais Yousef 2020-11-12 17:44 ` Will Deacon 2020-11-12 17:44 ` Will Deacon 2020-11-12 17:36 ` Will Deacon 2020-11-12 17:36 ` Will Deacon 2020-11-13 10:45 ` Qais Yousef 2020-11-13 10:45 ` Qais Yousef 2020-11-06 14:30 ` Catalin Marinas 2020-11-06 14:30 ` Catalin Marinas 2020-10-28 11:18 ` Catalin Marinas 2020-10-28 11:18 ` Catalin Marinas 2020-10-28 11:21 ` Will Deacon 2020-10-28 11:21 ` Will Deacon 2020-10-27 21:51 ` [PATCH 3/6] KVM: arm64: Kill 32-bit vCPUs on systems with mismatched " Will Deacon 2020-10-27 21:51 ` Will Deacon 2020-10-27 21:51 ` [PATCH 4/6] arm64: Kill 32-bit applications scheduled on 64-bit-only CPUs Will Deacon 2020-10-27 21:51 ` Will Deacon 2020-10-28 12:10 ` Catalin Marinas 2020-10-28 12:10 ` Catalin Marinas 2020-10-28 12:36 ` Will Deacon 2020-10-28 12:36 ` Will Deacon 2020-10-27 21:51 ` [PATCH 5/6] arm64: Advertise CPUs capable of running 32-bit applcations in sysfs Will Deacon 2020-10-27 21:51 ` Will Deacon 2020-10-28 8:37 ` Greg Kroah-Hartman 2020-10-28 8:37 ` Greg Kroah-Hartman 2020-10-28 9:51 ` Will Deacon 2020-10-28 9:51 ` Will Deacon 2020-10-28 12:15 ` Catalin Marinas 2020-10-28 12:15 ` Catalin Marinas 2020-10-28 12:27 ` Will Deacon 2020-10-28 12:27 ` Will Deacon 2020-10-28 15:14 ` Catalin Marinas 2020-10-28 15:14 ` Catalin Marinas 2020-10-28 15:35 ` Will Deacon 2020-10-28 15:35 ` Will Deacon 2020-10-27 21:51 ` [PATCH 6/6] arm64: Hook up cmdline parameter to allow mismatched 32-bit EL0 Will Deacon 2020-10-27 21:51 ` Will Deacon 2020-10-29 18:42 ` [PATCH 0/6] An alternative series for asymmetric AArch32 systems Suren Baghdasaryan 2020-10-29 18:42 ` Suren Baghdasaryan 2020-10-29 22:17 ` Will Deacon 2020-10-29 22:17 ` Will Deacon 2020-10-30 16:16 ` Marc Zyngier 2020-10-30 16:16 ` Marc Zyngier 2020-10-30 16:24 ` Will Deacon 2020-10-30 16:24 ` Will Deacon 2020-10-30 17:04 ` Marc Zyngier 2020-10-30 17:04 ` Marc Zyngier
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20201027215118.27003-2-will@kernel.org \ --to=will@kernel.org \ --cc=catalin.marinas@arm.com \ --cc=gregkh@linuxfoundation.org \ --cc=james.morse@arm.com \ --cc=kernel-team@android.com \ --cc=linux-arch@vger.kernel.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=maz@kernel.org \ --cc=morten.rasmussen@arm.com \ --cc=peterz@infradead.org \ --cc=qais.yousef@arm.com \ --cc=surenb@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.