Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755210AbdIGLu2 (ORCPT ); Thu, 7 Sep 2017 07:50:28 -0400 Received: from szxga05-in.huawei.com ([45.249.212.191]:5571 "EHLO szxga05-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754727AbdIGLu0 (ORCPT ); Thu, 7 Sep 2017 07:50:26 -0400 Subject: Re: [PATCH] arm64: KVM: VHE: reset PSTATE.UAO when switch to host To: Marc Zyngier , James Morse References: <1504763684-30128-1-git-send-email-gengdongjiu@huawei.com> <59B10F52.9010400@arm.com> CC: , , , , , , , , , , From: gengdongjiu Message-ID: Date: Thu, 7 Sep 2017 19:49:43 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.142.68.147] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090204.59B13271.00E3,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: d79aa3ffdbfe3823a77530b4628e2356 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1980 Lines: 62 On 2017/9/7 18:13, Marc Zyngier wrote: > On 07/09/17 11:05, gengdongjiu wrote: >> Hi James, >> >> On 2017/9/7 17:20, James Morse wrote: >>> Hi Dongjiu Geng, >>> >>> On 07/09/17 06:54, Dongjiu Geng wrote: >>>> In VHE mode, host kernel runs in the EL2 and can enable >>>> 'User Access Override' when fs==KERNEL_DS so that it can >>>> access kernel memory. However, PSTATE.UAO is set to 0 on >>>> an exception taken from EL1 to EL2. Thus when VHE is used >>>> and exception taken from a guest UAO will be disabled and >>>> host will use the incorrect PSTATE.UAO. So check and reset >>>> the PSTATE.UAO when switching to host. >>> >>> This would only be a problem if KVM were calling into world-switch with >>> fs==KERNEL_DS. I can't see where this happens. >> Not only KVM, may also kernel sets the fs == KERNEL_DS before calling into world-switch > > How? Please describe the exact sequence of event that lead to this > situation with the current code base. Hi Marc, Different tasks have different fs, such as USER_DS or KERNEL_DS. In the context switch, it will restore the task's fs. Thus, that depends on task itself, as shown below code. UAO is different with PAN, PAN will be always enabled if hardware CPU supports PAN feature, but UAO is dynamical change. /* * Thread switching. */ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, struct task_struct *next) { struct task_struct *last; fpsimd_thread_switch(next); tls_thread_switch(next); hw_breakpoint_thread_switch(next); contextidr_thread_switch(next); entry_task_switch(next); uao_thread_switch(next); .......... } /* Restore the UAO state depending on next's addr_limit */ void uao_thread_switch(struct task_struct *next) { if (IS_ENABLED(CONFIG_ARM64_UAO)) { if (task_thread_info(next)->addr_limit == KERNEL_DS) asm(ALTERNATIVE("nop", SET_PSTATE_UAO(1), ARM64_HAS_UAO)); else asm(ALTERNATIVE("nop", SET_PSTATE_UAO(0), ARM64_HAS_UAO)); } } > > M. >