From: Fuad Tabba <tabba@google.com>
To: Marc Zyngier <maz@kernel.org>
Cc: kvmarm@lists.cs.columbia.edu, will@kernel.org,
james.morse@arm.com, alexandru.elisei@arm.com,
suzuki.poulose@arm.com, mark.rutland@arm.com,
christoffer.dall@arm.com, pbonzini@redhat.com,
drjones@redhat.com, oupton@google.com, qperret@google.com,
kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
kernel-team@android.com
Subject: Re: [PATCH v8 11/11] KVM: arm64: Handle protected guests at 32 bits
Date: Mon, 11 Oct 2021 14:36:06 +0100 [thread overview]
Message-ID: <CA+EHjTxKn7Ff7zOCnoVR+L-qKg7OE81EerkO-SgcXVUZxJjbug@mail.gmail.com> (raw)
In-Reply-To: <87o87vpuze.wl-maz@kernel.org>
Hi Marc,
On Mon, Oct 11, 2021 at 2:11 PM Marc Zyngier <maz@kernel.org> wrote:
>
> On Sun, 10 Oct 2021 15:56:36 +0100,
> Fuad Tabba <tabba@google.com> wrote:
> >
> > Protected KVM does not support protected AArch32 guests. However,
> > it is possible for the guest to force run AArch32, potentially
> > causing problems. Add an extra check so that if the hypervisor
> > catches the guest doing that, it can prevent the guest from
> > running again by resetting vcpu->arch.target and returning
> > ARM_EXCEPTION_IL.
> >
> > If this were to happen, The VMM can try and fix it by re-
> > initializing the vcpu with KVM_ARM_VCPU_INIT, however, this is
> > likely not possible for protected VMs.
> >
> > Adapted from commit 22f553842b14 ("KVM: arm64: Handle Asymmetric
> > AArch32 systems")
> >
> > Signed-off-by: Fuad Tabba <tabba@google.com>
> > ---
> > arch/arm64/kvm/hyp/nvhe/switch.c | 34 ++++++++++++++++++++++++++++++++
> > 1 file changed, 34 insertions(+)
> >
> > diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c
> > index 2c72c31e516e..f25b6353a598 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/switch.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/switch.c
> > @@ -232,6 +232,37 @@ static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm *kvm)
> > return hyp_exit_handlers;
> > }
> >
> > +/*
> > + * Some guests (e.g., protected VMs) are not be allowed to run in AArch32.
> > + * The ARMv8 architecture does not give the hypervisor a mechanism to prevent a
> > + * guest from dropping to AArch32 EL0 if implemented by the CPU. If the
> > + * hypervisor spots a guest in such a state ensure it is handled, and don't
> > + * trust the host to spot or fix it. The check below is based on the one in
> > + * kvm_arch_vcpu_ioctl_run().
> > + *
> > + * Returns false if the guest ran in AArch32 when it shouldn't have, and
> > + * thus should exit to the host, or true if a the guest run loop can continue.
> > + */
> > +static bool handle_aarch32_guest(struct kvm_vcpu *vcpu, u64 *exit_code)
> > +{
> > + struct kvm *kvm = kern_hyp_va(vcpu->kvm);
> > +
> > + if (kvm_vm_is_protected(kvm) && vcpu_mode_is_32bit(vcpu)) {
> > + /*
> > + * As we have caught the guest red-handed, decide that it isn't
> > + * fit for purpose anymore by making the vcpu invalid. The VMM
> > + * can try and fix it by re-initializing the vcpu with
> > + * KVM_ARM_VCPU_INIT, however, this is likely not possible for
> > + * protected VMs.
> > + */
> > + vcpu->arch.target = -1;
> > + *exit_code = ARM_EXCEPTION_IL;
>
> Aren't we losing a potential SError here, which the original commit
> doesn't need to handle? I'd expect something like:
>
> *exit_code &= BIT(ARM_EXIT_WITH_SERROR_BIT);
> *exit_code |= ARM_EXCEPTION_IL;
Yes, you're right. That would ensure the SError is preserved.
Thanks,
/fuad
> > + return false;
> > + }
> > +
> > + return true;
> > +}
> > +
> > /* Switch to the guest for legacy non-VHE systems */
> > int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
> > {
> > @@ -294,6 +325,9 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
> > /* Jump in the fire! */
> > exit_code = __guest_enter(vcpu);
> >
> > + if (unlikely(!handle_aarch32_guest(vcpu, &exit_code)))
> > + break;
> > +
> > /* And we're baaack! */
> > } while (fixup_guest_exit(vcpu, &exit_code));
> >
>
> Thanks,
>
> M.
>
> --
> Without deviation from the norm, progress is not possible.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2021-10-11 13:40 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-10 14:56 [PATCH v8 00/11] KVM: arm64: Fixed features for protected VMs Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 01/11] KVM: arm64: Move __get_fault_info() and co into their own include file Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 02/11] KVM: arm64: Don't include switch.h into nvhe/kvm-main.c Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 03/11] KVM: arm64: Move early handlers to per-EC handlers Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 04/11] KVM: arm64: Pass struct kvm " Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 05/11] KVM: arm64: Add missing field descriptor for MDCR_EL2 Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 06/11] KVM: arm64: Simplify masking out MTE in feature id reg Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 07/11] KVM: arm64: Add handlers for protected VM System Registers Fuad Tabba
2021-10-11 11:39 ` Marc Zyngier
2021-10-11 11:52 ` Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 08/11] KVM: arm64: Initialize trap registers for protected VMs Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 09/11] KVM: arm64: Move sanitized copies of CPU features Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 10/11] KVM: arm64: Trap access to pVM restricted features Fuad Tabba
2021-10-10 14:56 ` [PATCH v8 11/11] KVM: arm64: Handle protected guests at 32 bits Fuad Tabba
2021-10-11 13:11 ` Marc Zyngier
2021-10-11 13:36 ` Fuad Tabba [this message]
2021-10-13 12:03 ` [PATCH v9 00/22] KVM: arm64: Fixed features for protected VMs Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 12/22] KVM: arm64: Fix early exit ptrauth handling Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 13/22] KVM: arm64: pkvm: Use a single function to expose all id-regs Marc Zyngier
2021-10-14 9:04 ` Andrew Jones
2021-10-13 12:03 ` [PATCH v9 14/22] KVM: arm64: pkvm: Make the ERR/ERX*_EL1 registers RAZ/WI Marc Zyngier
2021-10-14 9:32 ` Andrew Jones
2021-10-14 16:09 ` Marc Zyngier
2021-10-14 16:20 ` Andrew Jones
2021-10-13 12:03 ` [PATCH v9 15/22] KVM: arm64: pkvm: Drop AArch32-specific registers Marc Zyngier
2021-10-14 9:33 ` Andrew Jones
2021-10-13 12:03 ` [PATCH v9 16/22] KVM: arm64: pkvm: Drop sysregs that should never be routed to the host Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 17/22] KVM: arm64: pkvm: Handle GICv3 traps as required Marc Zyngier
2021-10-14 9:46 ` Andrew Jones
2021-10-14 16:06 ` Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 18/22] KVM: arm64: pkvm: Preserve pending SError on exit from AArch32 Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 19/22] KVM: arm64: pkvm: Consolidate include files Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 20/22] KVM: arm64: pkvm: Move kvm_handle_pvm_restricted around Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 21/22] KVM: arm64: pkvm: Pass vpcu instead of kvm to kvm_get_exit_handler_array() Marc Zyngier
2021-10-13 12:03 ` [PATCH v9 22/22] KVM: arm64: pkvm: Give priority to standard traps over pvm handling Marc Zyngier
2021-10-18 9:51 ` [PATCH v9 00/22] KVM: arm64: Fixed features for protected VMs Fuad Tabba
2021-10-18 10:45 ` Andrew Jones
2021-10-18 12:33 ` Fuad Tabba
2021-10-18 16:37 ` Marc Zyngier
2021-10-18 16:39 ` [PATCH v8 00/11] " Marc Zyngier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CA+EHjTxKn7Ff7zOCnoVR+L-qKg7OE81EerkO-SgcXVUZxJjbug@mail.gmail.com \
--to=tabba@google.com \
--cc=alexandru.elisei@arm.com \
--cc=christoffer.dall@arm.com \
--cc=drjones@redhat.com \
--cc=james.morse@arm.com \
--cc=kernel-team@android.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=oupton@google.com \
--cc=pbonzini@redhat.com \
--cc=qperret@google.com \
--cc=suzuki.poulose@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).