linux-kernel - Re: [RFC PATCH v1] KVM: arm64: Introduce KVM_CAP_ARM_SIGBUS_ON

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zz2TyC9-zNQ3D-KB@linux.dev>
Date: Wed, 20 Nov 2024 07:46:16 +0000
From: Oliver Upton <oliver.upton@...ux.dev>
To: Jiaqi Yan <jiaqiyan@...gle.com>
Cc: Marc Zyngier <maz@...nel.org>, joey.gouly@....com,
	suzuki.poulose@....com, yuzenghui@...wei.com,
	catalin.marinas@....com, will@...nel.org, pbonzini@...hat.com,
	linux-arm-kernel@...ts.infradead.org, kvmarm@...ts.linux.dev,
	kvm@...r.kernel.org, duenwen@...gle.com, rananta@...gle.com,
	James Houghton <jthoughton@...gle.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH v1] KVM: arm64: Introduce KVM_CAP_ARM_SIGBUS_ON_SEA

On Tue, Nov 19, 2024 at 03:57:46PM -0800, Jiaqi Yan wrote:
>
> While continuing the discussion here, I think it may make sense I sent
> out a V2 with 2 major updates:
>   - add documentation for new SIGBUS feature
>   - remove KVM_CAP_ARM_SIGBUS_ON_SEA

Just wanted to add that QEMU already has a functioning "MCE" injection
implemenation based on signals that deals with the sloppy mess of
coordinating w/ vCPU threads [*].

I completely agree with Marc that the UAPI around using signals for this
sort of thing is a giant pile of crap, but it seems to be a semi-understood
pile of crap. And from that perspective, wiring unclaimed SEAs into the
existing infrastructure at least makes the UAPI consistent.

[*]: https://elixir.bootlin.com/qemu/v9.1.1/C/ident/kvm_on_sigbus_vcpu

> On Tue, Nov 12, 2024 at 12:51 AM Marc Zyngier <maz@...nel.org> wrote:
> > > Do you mean a CAP that VMM can tell KVM the VM guest has RAS ability?
> > > I don't know if there is one for arm64. On x86 there is
> > > KVM_X86_SETUP_MCE. KVM_CAP_ARM_INJECT_EXT_DABT maybe a revelant one
> > > but I don't think it is exactly the one for "RAS ability".
> >
> > Having though about this a bit more, I now think this is independent
> > of the guest supporting RAS. This really is about the VMM asking to be
> > made aware of RAS errors affecting the guest, and it is the signalling
> > back to the guest that needs to be gated by ID_AA64PFR0_EL1.RAS.
> 
> Just to make sure I fully catch you. I think ID_AA64PFR0_EL1.RAS
> translates to ARM64_HAS_RAS_EXTN in the kernel. If VMM signals RAS
> error back to the guest with SEA, are you suggesting
> __kvm_arm_vcpu_set_events should check
> cpus_have_final_cap(ARM64_HAS_RAS_EXTN) before it
> kvm_inject_dabt(vcpu)?
> 
> If so, how could __kvm_arm_vcpu_set_events know if the error is about
> RAS (e.g. memory error) vs about accessing memory not in a memslot
> (i.e. KVM_EXIT_ARM_NISV)? I guess KVM needs to look at ESR_EL2 again
> (e.g. kvm_vcpu_abt_issea vs kvm_vcpu_dabt_isvalid)?

Good point. I don't think we can lock down this UAPI after the fact
given the existing use cases. It is ultimately up to the VMM what to do.

I don't see anything that would stop an implementation without FEAT_RAS
from generating an SEA in this situation. The lack of FEAT_RAS (to me at
least) implies:

 - No ESR injection for vSErrors (already enforced in UAPI)
 - No deferral of SErrors / ESBs
 - No error record registers in the PE

Of course, it is very likely you've thought about this more than I have,
Marc.

-- 
Thanks,
Oliver