Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 85e84ba3 authored by Marc Zyngier's avatar Marc Zyngier
Browse files

arm: KVM: force execution of HCPTR access on VM exit 



On VM entry, we disable access to the VFP registers in order to
perform a lazy save/restore of these registers.

On VM exit, we restore access, test if we did enable them before,
and save/restore the guest/host registers if necessary. In this
sequence, the FPEXC register is always accessed, irrespective
of the trapping configuration.

If the guest didn't touch the VFP registers, then the HCPTR access
has now enabled such access, but we're missing a barrier to ensure
architectural execution of the new HCPTR configuration. If the HCPTR
access has been delayed/reordered, the subsequent access to FPEXC
will cause a trap, which we aren't prepared to handle at all.

The same condition exists when trapping to enable VFP for the guest.

The fix is to introduce a barrier after enabling VFP access. In the
vmexit case, it can be relaxed to only takes place if the guest hasn't
accessed its view of the VFP registers, making the access to FPEXC safe.

The set_hcptr macro is modified to deal with both vmenter/vmexit and
vmtrap operations, and now takes an optional label that is branched to
when the guest hasn't touched the VFP registers.

Reported-by: default avatarVikram Sethi <vikrams@codeaurora.org>
Cc: stable@kernel.org	# v3.9+
Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
parent c11b5329

arch/arm/kvm/interrupts.S

+4 −6
Original line number Original line Diff line number Diff line
@@ -170,13 +170,9 @@ __kvm_vcpu_return: 
	@ Don't trap coprocessor accesses for host kernel

	@ Don't trap coprocessor accesses for host kernel

	set_hstr vmexit

	set_hstr vmexit

	set_hdcr vmexit

	set_hdcr vmexit

	set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))

	set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore





#ifdef CONFIG_VFPv3

#ifdef CONFIG_VFPv3

	@ Save floating point registers we if let guest use them.

	tst	r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))

	bne	after_vfp_restore



	@ Switch VFP/NEON hardware state to the host's

	@ Switch VFP/NEON hardware state to the host's

	add	r7, vcpu, #VCPU_VFP_GUEST

	add	r7, vcpu, #VCPU_VFP_GUEST

	store_vfp_state r7

	store_vfp_state r7
@@ -188,6 +184,8 @@ after_vfp_restore: 
	@ Restore FPEXC_EN which we clobbered on entry

	@ Restore FPEXC_EN which we clobbered on entry

	pop	{r2}

	pop	{r2}

	VFPFMXR FPEXC, r2

	VFPFMXR FPEXC, r2

#else

after_vfp_restore:

#endif

#endif





	@ Reset Hyp-role

	@ Reset Hyp-role
@@ -483,7 +481,7 @@ switch_to_guest_vfp: 
	push	{r3-r7}

	push	{r3-r7}





	@ NEON/VFP used.  Turn on VFP access.

	@ NEON/VFP used.  Turn on VFP access.

	set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))

	set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))





	@ Switch VFP/NEON hardware state to the guest's

	@ Switch VFP/NEON hardware state to the guest's

	add	r7, r0, #VCPU_VFP_HOST

	add	r7, r0, #VCPU_VFP_HOST

arch/arm/kvm/interrupts_head.S

+18 −2
Original line number Original line Diff line number Diff line
@@ -591,8 +591,13 @@ ARM_BE8(rev r6, r6 ) 
.endm

.endm





/* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return

/* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return

 * (hardware reset value is 0). Keep previous value in r2. */

 * (hardware reset value is 0). Keep previous value in r2.

.macro set_hcptr operation, mask

 * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if

 * VFP wasn't already enabled (always executed on vmtrap).

 * If a label is specified with vmexit, it is branched to if VFP wasn't

 * enabled.

 */

.macro set_hcptr operation, mask, label = none

	mrc	p15, 4, r2, c1, c1, 2

	mrc	p15, 4, r2, c1, c1, 2

	ldr	r3, =\mask

	ldr	r3, =\mask

	.if \operation == vmentry

	.if \operation == vmentry
@@ -601,6 +606,17 @@ ARM_BE8(rev r6, r6 ) 
	bic	r3, r2, r3		@ Don't trap defined coproc-accesses

	bic	r3, r2, r3		@ Don't trap defined coproc-accesses

	.endif

	.endif

	mcr	p15, 4, r3, c1, c1, 2

	mcr	p15, 4, r3, c1, c1, 2

	.if \operation != vmentry

	.if \operation == vmexit

	tst	r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))

	beq	1f

	.endif

	isb

	.if \label != none

	b	\label

	.endif

1:

	.endif

.endm

.endm





/* Configures the HDCR (Hyp Debug Configuration Register) on entry/return

/* Configures the HDCR (Hyp Debug Configuration Register) on entry/return