Thread (90 messages) 90 messages, 5 authors, 2025-02-10

Re: [PATCH v6 30/43] arm64: rme: Prevent Device mappings for Realms

From: Steven Price <steven.price@arm.com>
Date: 2025-02-07 17:08:30
Also in: kvm, kvmarm, linux-coco, lkml

On 02/02/2025 07:12, Gavin Shan wrote:
On 12/13/24 1:55 AM, Steven Price wrote:
quoted
Physical device assignment is not yet supported by the RMM, so it
doesn't make much sense to allow device mappings within the realm.
Prevent them when the guest is a realm.

Signed-off-by: Steven Price <steven.price@arm.com>
---
Changes from v5:
  * Also prevent accesses in user_mem_abort()
---
  arch/arm64/kvm/mmu.c | 12 ++++++++++++
  1 file changed, 12 insertions(+)
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 9ede143ccef1..cef7c3dcbf99 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1149,6 +1149,10 @@ int kvm_phys_addr_ioremap(struct kvm *kvm,
phys_addr_t guest_ipa,
      if (is_protected_kvm_enabled())
          return -EPERM;
  +    /* We don't support mapping special pages into a Realm */
+    if (kvm_is_realm(kvm))
+        return -EINVAL;
+
        return -EPERM;
quoted
      size += offset_in_page(guest_ipa);
      guest_ipa &= PAGE_MASK;
  @@ -1725,6 +1729,14 @@ static int user_mem_abort(struct kvm_vcpu
*vcpu, phys_addr_t fault_ipa,
      if (exec_fault && device)
          return -ENOEXEC;
  +    /*
+     * Don't allow device accesses to protected memory as we don't (yet)
+     * support protected devices.
+     */
+    if (device && kvm_is_realm(kvm) &&
+        kvm_gpa_from_fault(kvm, fault_ipa) == fault_ipa)
+        return -EINVAL;
+
s/kvm_is_realm/vcpu_is_rec

I don't understand the check very well. What I understood is mem_abort()
is called
only when kvm_gpa_from_fault(kvm, fault_ipa) != fault_ipa, meaning only
the page
faults in the shared address space is handled by mem_abort(). So I guess
we perhaps
need something like below.
private_memslot_fault() is only when the memslot is a private
guest_memfd(). So there's also the situation of a 'normal' memslot which
can still end up in user_mem_abort().

As things currently stand we can't really deal with this (the bottom
part of the IPA is protected, and therefore must come from
guest_memfd()). But in the future we are expecting to be able to support
protected devices.

So I think really the correct solution for now is to drop the "device"
check and update the comment to reflect the fact that
private_memslot_fault() should be handling all protected address until
we get support for assigning devices.

Thanks,
Steve
    if (vcpu_is_rec(vcpu) && device)
        return -EPERM;

kvm_handle_guest_abort
  kvm_slot_can_be_private
    private_memslot_fault    // page fault in the private space is
handled here
  io_mem_abort            // MMIO emulation is handled here
  user_mem_abort                // page fault in the shared space is
handled here
quoted
      /*
       * Potentially reduce shadow S2 permissions to match the guest's
own
       * S2. For exec faults, we'd only reach this point if the guest
Thanks,
Gavin
  
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help