KVM: arm64: Inject exception on out-of-IPA-range translation fault

When taking a translation fault for an IPA that is outside of
the range defined by the hypervisor (between the HW PARange and
the IPA range), we stupidly treat it as an IO and forward the access
to userspace. Of course, userspace can't do much with it, and things
end badly.

Arguably, the guest is braindead, but we should at least catch the
case and inject an exception.

Check the faulting IPA against:
- the sanitised PARange: inject an address size fault
- the IPA size: inject an abort

Reported-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 7496deab025ad3397780be02e295a41b95d73505..f71358271b71c1387db4874afae7d7504a90c879 100644 (file)
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -40,6 +40,7 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu);
 void kvm_inject_vabt(struct kvm_vcpu *vcpu);
 void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
 void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
+void kvm_inject_size_fault(struct kvm_vcpu *vcpu);
 
 void kvm_vcpu_wfi(struct kvm_vcpu *vcpu);
 

diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index b47df73e98d782a55192051c9f3e537ddfd10941..ba20405d2dc2fdfd312f580b12cdda297d092f85 100644 (file)
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -145,6 +145,34 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr)
                inject_abt64(vcpu, true, addr);
 }
 
+void kvm_inject_size_fault(struct kvm_vcpu *vcpu)
+{
+       unsigned long addr, esr;
+
+       addr  = kvm_vcpu_get_fault_ipa(vcpu);
+       addr |= kvm_vcpu_get_hfar(vcpu) & GENMASK(11, 0);
+
+       if (kvm_vcpu_trap_is_iabt(vcpu))
+               kvm_inject_pabt(vcpu, addr);
+       else
+               kvm_inject_dabt(vcpu, addr);
+
+       /*
+        * If AArch64 or LPAE, set FSC to 0 to indicate an Address
+        * Size Fault at level 0, as if exceeding PARange.
+        *
+        * Non-LPAE guests will only get the external abort, as there
+        * is no way to to describe the ASF.
+        */
+       if (vcpu_el1_is_32bit(vcpu) &&
+           !(vcpu_read_sys_reg(vcpu, TCR_EL1) & TTBCR_EAE))
+               return;
+
+       esr = vcpu_read_sys_reg(vcpu, ESR_EL1);
+       esr &= ~GENMASK_ULL(5, 0);
+       vcpu_write_sys_reg(vcpu, esr, ESR_EL1);
+}
+
 /**
  * kvm_inject_undefined - inject an undefined instruction into the guest
  * @vcpu: The vCPU in which to inject the exception

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 53ae2c0640bc2ab1458b26863c6ba7388fbf635a..5400fc020164e827c89b68f3b972fc55940fd519 100644 (file)
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1337,6 +1337,25 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu)
        fault_ipa = kvm_vcpu_get_fault_ipa(vcpu);
        is_iabt = kvm_vcpu_trap_is_iabt(vcpu);
 
+       if (fault_status == FSC_FAULT) {
+               /* Beyond sanitised PARange (which is the IPA limit) */
+               if (fault_ipa >= BIT_ULL(get_kvm_ipa_limit())) {
+                       kvm_inject_size_fault(vcpu);
+                       return 1;
+               }
+
+               /* Falls between the IPA range and the PARange? */
+               if (fault_ipa >= BIT_ULL(vcpu->arch.hw_mmu->pgt->ia_bits)) {
+                       fault_ipa |= kvm_vcpu_get_hfar(vcpu) & GENMASK(11, 0);
+
+                       if (is_iabt)
+                               kvm_inject_pabt(vcpu, fault_ipa);
+                       else
+                               kvm_inject_dabt(vcpu, fault_ipa);
+                       return 1;
+               }
+       }
+
        /* Synchronous External Abort? */
        if (kvm_vcpu_abt_issea(vcpu)) {
                /*