On 2022-04-21 16:39, Marc Zyngier wrote:
When taking an translation fault for an IPA that is outside of
the range defined by the hypervisor (between the HW PARange and
that exposed to the guest), we stupidly treat it as an IO and
forward the access to userspace. Of course, userspace can't do
much with it, and things end badly.
Arguably, the guest is braindead, but we should at least catch the
case and inject an exception.
Check the faulting IPA against the IPA size the VM has, and
inject an Address Size Fault at level 0 if the access fails the
check.
I'm having second thoughts about this last point.
t
As it turns out, we do no override the PARange exposed to the guest,
and it sees the sanitised HW version. Which makes sense, as the
IPA range is much more fine grained than the PARange (1 bit for
IPA range, 4 bits for PARange).
So a fault can fall into a number of "don't do that" categories:
- outside of the *physical* PARange: the HW injects an AS fault
- outside of the *sanitised* PARange: KVM must inject an AS fault
- between IPA range and PARange: KVM must inject a external abort
This patch merges the last two cases, which is a bit wrong.
I'll repost an updated version and queue it for 5.18.
M.
--
Jazz is not dead. It just smells funny...
