From: Oliver Upton <oupton@google.com>
To: Fuad Tabba <tabba@google.com>
Cc: kvmarm@lists.cs.columbia.edu, maz@kernel.org, will@kernel.org,
james.morse@arm.com, Alexandru.Elisei@arm.com,
suzuki.poulose@arm.com, mark.rutland@arm.com,
christoffer.dall@arm.com, pbonzini@redhat.com,
drjones@redhat.com, qperret@google.com, kvm@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, kernel-team@android.com
Subject: Re: [PATCH v4 15/15] KVM: arm64: Handle protected guests at 32 bits
Date: Thu, 19 Aug 2021 01:10:06 -0700 [thread overview]
Message-ID: <CAOQ_QsgSfHVjJkSJku5DwUe0_=ds4GduPbJ7vC-t+4_=fPVFBQ@mail.gmail.com> (raw)
In-Reply-To: <20210817081134.2918285-16-tabba@google.com>
Hi Fuad,
On Tue, Aug 17, 2021 at 1:12 AM Fuad Tabba <tabba@google.com> wrote:
>
> Protected KVM does not support protected AArch32 guests. However,
> it is possible for the guest to force run AArch32, potentially
> causing problems. Add an extra check so that if the hypervisor
> catches the guest doing that, it can prevent the guest from
> running again by resetting vcpu->arch.target and returning
> ARM_EXCEPTION_IL.
>
> If this were to happen, The VMM can try and fix it by re-
> initializing the vcpu with KVM_ARM_VCPU_INIT, however, this is
> likely not possible for protected VMs.
>
> Adapted from commit 22f553842b14 ("KVM: arm64: Handle Asymmetric
> AArch32 systems")
>
> Signed-off-by: Fuad Tabba <tabba@google.com>
> ---
> arch/arm64/kvm/hyp/nvhe/switch.c | 37 ++++++++++++++++++++++++++++++++
> 1 file changed, 37 insertions(+)
>
> diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c
> index 398e62098898..0c24b7f473bf 100644
> --- a/arch/arm64/kvm/hyp/nvhe/switch.c
> +++ b/arch/arm64/kvm/hyp/nvhe/switch.c
> @@ -20,6 +20,7 @@
> #include <asm/kprobes.h>
> #include <asm/kvm_asm.h>
> #include <asm/kvm_emulate.h>
> +#include <asm/kvm_fixed_config.h>
> #include <asm/kvm_hyp.h>
> #include <asm/kvm_mmu.h>
> #include <asm/fpsimd.h>
> @@ -195,6 +196,39 @@ exit_handle_fn kvm_get_nvhe_exit_handler(struct kvm_vcpu *vcpu)
> return NULL;
> }
>
> +/*
> + * Some guests (e.g., protected VMs) might not be allowed to run in AArch32. The
> + * check below is based on the one in kvm_arch_vcpu_ioctl_run().
> + * The ARMv8 architecture does not give the hypervisor a mechanism to prevent a
> + * guest from dropping to AArch32 EL0 if implemented by the CPU. If the
> + * hypervisor spots a guest in such a state ensure it is handled, and don't
> + * trust the host to spot or fix it.
> + *
> + * Returns true if the check passed and the guest run loop can continue, or
> + * false if the guest should exit to the host.
> + */
> +static bool check_aarch32_guest(struct kvm_vcpu *vcpu, u64 *exit_code)
This does a bit more than just check & return, so maybe call it
handle_aarch32_guest()?
> +{
> + if (kvm_vm_is_protected(kern_hyp_va(vcpu->kvm)) &&
maybe initialize a local with a hyp pointer to the kvm structure.
> + vcpu_mode_is_32bit(vcpu) &&
> + FIELD_GET(ARM64_FEATURE_MASK(ID_AA64PFR0_EL0),
> + PVM_ID_AA64PFR0_RESTRICT_UNSIGNED) <
> + ID_AA64PFR0_ELx_32BIT_64BIT) {
It may be more readable to initialize a local variable with this
feature check, i.e:
bool aarch32_allowed = FIELD_GET(...) == ID_AA64PFR0_ELx_32BIT_64BIT;
and then:
if (kvm_vm_is_protected(kvm) && vcpu_mode_is_32bit(vcpu) &&
!aarch32_allowed) {
> + /*
> + * As we have caught the guest red-handed, decide that it isn't
> + * fit for purpose anymore by making the vcpu invalid. The VMM
> + * can try and fix it by re-initializing the vcpu with
> + * KVM_ARM_VCPU_INIT, however, this is likely not possible for
> + * protected VMs.
> + */
> + vcpu->arch.target = -1;
> + *exit_code = ARM_EXCEPTION_IL;
> + return false;
> + }
> +
> + return true;
> +}
> +
> /* Switch to the guest for legacy non-VHE systems */
> int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
> {
> @@ -255,6 +289,9 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
> /* Jump in the fire! */
> exit_code = __guest_enter(vcpu);
>
> + if (unlikely(!check_aarch32_guest(vcpu, &exit_code)))
> + break;
> +
> /* And we're baaack! */
> } while (fixup_guest_exit(vcpu, &exit_code));
>
> --
> 2.33.0.rc1.237.g0d66db33f3-goog
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2021-08-19 8:12 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-17 8:11 [PATCH v4 00/15] KVM: arm64: Fixed features for protected VMs Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 01/15] KVM: arm64: placeholder to check if VM is protected Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 02/15] KVM: arm64: Remove trailing whitespace in comment Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 03/15] KVM: arm64: MDCR_EL2 is a 64-bit register Fuad Tabba
2021-08-18 14:32 ` Marc Zyngier
2021-08-17 8:11 ` [PATCH v4 04/15] KVM: arm64: Fix names of config register fields Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 05/15] KVM: arm64: Refactor sys_regs.h,c for nVHE reuse Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 06/15] KVM: arm64: Restore mdcr_el2 from vcpu Fuad Tabba
2021-08-18 13:13 ` Will Deacon
2021-08-18 14:42 ` Marc Zyngier
2021-08-17 8:11 ` [PATCH v4 07/15] KVM: arm64: Keep mdcr_el2's value as set by __init_el2_debug Fuad Tabba
2021-08-18 13:17 ` Will Deacon
2021-08-17 8:11 ` [PATCH v4 08/15] KVM: arm64: Track value of cptr_el2 in struct kvm_vcpu_arch Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 09/15] KVM: arm64: Add feature register flag definitions Fuad Tabba
2021-08-18 13:21 ` Will Deacon
2021-08-17 8:11 ` [PATCH v4 10/15] KVM: arm64: Add config register bit definitions Fuad Tabba
2021-08-18 15:16 ` Marc Zyngier
2021-08-17 8:11 ` [PATCH v4 11/15] KVM: arm64: Guest exit handlers for nVHE hyp Fuad Tabba
2021-08-18 16:45 ` Marc Zyngier
2021-08-19 14:35 ` Marc Zyngier
2021-08-23 10:21 ` Fuad Tabba
2021-08-23 12:10 ` Marc Zyngier
2021-08-17 8:11 ` [PATCH v4 12/15] KVM: arm64: Add trap handlers for protected VMs Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 13/15] KVM: arm64: Move sanitized copies of CPU features Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 14/15] KVM: arm64: Trap access to pVM restricted features Fuad Tabba
2021-08-17 8:11 ` [PATCH v4 15/15] KVM: arm64: Handle protected guests at 32 bits Fuad Tabba
2021-08-19 8:10 ` Oliver Upton [this message]
2021-08-23 10:25 ` Fuad Tabba
2021-08-20 10:34 ` [PATCH v4 00/15] KVM: arm64: Fixed features for protected VMs Marc Zyngier
2021-08-23 10:23 ` Fuad Tabba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAOQ_QsgSfHVjJkSJku5DwUe0_=ds4GduPbJ7vC-t+4_=fPVFBQ@mail.gmail.com' \
--to=oupton@google.com \
--cc=Alexandru.Elisei@arm.com \
--cc=christoffer.dall@arm.com \
--cc=drjones@redhat.com \
--cc=james.morse@arm.com \
--cc=kernel-team@android.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=pbonzini@redhat.com \
--cc=qperret@google.com \
--cc=suzuki.poulose@arm.com \
--cc=tabba@google.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).