Commit 85ea6b1e authored by Marc Zyngier's avatar Marc Zyngier
Browse files

KVM: arm64: Inject exception on out-of-IPA-range translation fault 



When taking a translation fault for an IPA that is outside of
the range defined by the hypervisor (between the HW PARange and
the IPA range), we stupidly treat it as an IO and forward the access
to userspace. Of course, userspace can't do much with it, and things
end badly.

Arguably, the guest is braindead, but we should at least catch the
case and inject an exception.

Check the faulting IPA against:
- the sanitised PARange: inject an address size fault
- the IPA size: inject an abort

Reported-by: default avatarChristoffer Dall <christoffer.dall@arm.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
parent 8f6379e2

arch/arm64/include/asm/kvm_emulate.h

+1 −0
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu); 
void kvm_inject_vabt(struct kvm_vcpu *vcpu);

void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);

void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);

void kvm_inject_size_fault(struct kvm_vcpu *vcpu);



void kvm_vcpu_wfi(struct kvm_vcpu *vcpu);

arch/arm64/kvm/inject_fault.c

+28 −0
Original line number Diff line number Diff line
@@ -145,6 +145,34 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr) 
		inject_abt64(vcpu, true, addr);

}



void kvm_inject_size_fault(struct kvm_vcpu *vcpu)

{

	unsigned long addr, esr;



	addr  = kvm_vcpu_get_fault_ipa(vcpu);

	addr |= kvm_vcpu_get_hfar(vcpu) & GENMASK(11, 0);



	if (kvm_vcpu_trap_is_iabt(vcpu))

		kvm_inject_pabt(vcpu, addr);

	else

		kvm_inject_dabt(vcpu, addr);



	/*

	 * If AArch64 or LPAE, set FSC to 0 to indicate an Address

	 * Size Fault at level 0, as if exceeding PARange.

	 *

	 * Non-LPAE guests will only get the external abort, as there

	 * is no way to to describe the ASF.

	 */

	if (vcpu_el1_is_32bit(vcpu) &&

	    !(vcpu_read_sys_reg(vcpu, TCR_EL1) & TTBCR_EAE))

		return;



	esr = vcpu_read_sys_reg(vcpu, ESR_EL1);

	esr &= ~GENMASK_ULL(5, 0);

	vcpu_write_sys_reg(vcpu, esr, ESR_EL1);

}



/**

 * kvm_inject_undefined - inject an undefined instruction into the guest

 * @vcpu: The vCPU in which to inject the exception

arch/arm64/kvm/mmu.c

+19 −0
Original line number Diff line number Diff line
@@ -1337,6 +1337,25 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu) 
	fault_ipa = kvm_vcpu_get_fault_ipa(vcpu);

	is_iabt = kvm_vcpu_trap_is_iabt(vcpu);



	if (fault_status == FSC_FAULT) {

		/* Beyond sanitised PARange (which is the IPA limit) */

		if (fault_ipa >= BIT_ULL(get_kvm_ipa_limit())) {

			kvm_inject_size_fault(vcpu);

			return 1;

		}



		/* Falls between the IPA range and the PARange? */

		if (fault_ipa >= BIT_ULL(vcpu->arch.hw_mmu->pgt->ia_bits)) {

			fault_ipa |= kvm_vcpu_get_hfar(vcpu) & GENMASK(11, 0);



			if (is_iabt)

				kvm_inject_pabt(vcpu, fault_ipa);

			else

				kvm_inject_dabt(vcpu, fault_ipa);

			return 1;

		}

	}



	/* Synchronous External Abort? */

	if (kvm_vcpu_abt_issea(vcpu)) {

		/*