s390x/tcg: LAP support using immediate TLB invalidation

This is a neat way to implement low address protection, whereby only the first 512 bytes of the first two pages (each 4096 bytes) of every address space are protected.

Store a tec of 0 for the access exception, this is what is defined by Enhanced Suppression on Protection in case of a low address protection (Bit 61 set to 0, rest undefined).

We have to make sure to to pass the access address, not the masked page address into mmu_translate*().

Drop the check from testblock. So we can properly test this via kvm-unit-tests.

This will check every access going through one of the MMUs.

Reviewed-by Richard Henderson <[email protected]>

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/excp_helper.c |  3 +-
 target/s390x/mem_helper.c  |  8 ----
 target/s390x/mmu_helper.c  | 94 +++++++++++++++++++++++++++++-----------------
 3 files changed, 60 insertions(+), 45 deletions(-)

target/s390x/mmu_helper.c +10 -0

+/* check whether Low-Address Protection is enabled for mmu_translate() */
+static bool lowprot_enabled(const CPUS390XState *env, uint64_t asc)
+{
+    if (!(env->cregs[0] & CR0_LOWPROT)) {
+        return false;
+    }
+    if (!(env->psw.mask & PSW_MASK_DAT)) {
+        return true;
+    }
+

target/s390x/mmu_helper.c +21 -15

+    }
+}
+
 /**
  * Translate real address to absolute (= physical)
  * address by taking care of the prefix mapping.

@@ -323,6 +352,24 @@ int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
     }
 
     *flags = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+    if (is_low_address(vaddr & TARGET_PAGE_MASK) && lowprot_enabled(env, asc)) {
+        /*
+         * If any part of this page is currently protected, make sure the
+         * TLB entry will not be reused.
+         *
+         * As the protected range is always the first 512 bytes of the
+         * two first pages, we are able to catch all writes to these areas
+         * just by looking at the start address (triggering the tlb miss).
+         */
+        *flags |= PAGE_WRITE_INV;
+        if (is_low_address(vaddr) && rw == MMU_DATA_STORE) {
+            if (exc) {
+                trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
+            }
+            return -EACCES;
+        }
+    }
+
     vaddr &= TARGET_PAGE_MASK;
 
     if (!(env->psw.mask & PSW_MASK_DAT)) {

@@ -392,50 +439,17 @@ int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
 }
 
 /**
- * lowprot_enabled: Check whether low-address protection is enabled
- */
-static bool lowprot_enabled(const CPUS390XState *env)
-{
-    if (!(env->cregs[0] & CR0_LOWPROT)) {
-        return false;
-    }
-    if (!(env->psw.mask & PSW_MASK_DAT)) {
-        return true;
-    }
-
-    /* Check the private-space control bit */
-    switch (env->psw.mask & PSW_MASK_ASC) {
-    case PSW_ASC_PRIMARY:
-        return !(env->cregs[1] & _ASCE_PRIVATE_SPACE);

Quoted 23 lines · David Hildenbrand

This is a neat way to implement low address protection, whereby only the first 512 bytes of the first two pages (each 4096 bytes) of every address space are protected.

Store a tec of 0 for the access exception, this is what is defined by Enhanced Suppression on Protection in case of a low address protection (Bit 61 set to 0, rest undefined).

We have to make sure to to pass the access address, not the masked page address into mmu_translate*().

Drop the check from testblock. So we can properly test this via kvm-unit-tests.

This will check every access going through one of the MMUs.

Reviewed-by Richard Henderson <[email protected]>

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/excp_helper.c |  3 +-
 target/s390x/mem_helper.c  |  8 ----
 target/s390x/mmu_helper.c  | 94 +++++++++++++++++++++++++++++-----------------
 3 files changed, 60 insertions(+), 45 deletions(-)

[...]

target/s390x/mmu_helper.c static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr, · line 113

Quoted 13 lines

target/s390x/mmu_helper.c +5 -0

index 9daa0fd8e2..9806685bee 100644
@@ -106,6 +106,35 @@ static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,
     trigger_access_exception(env, type, ilen, tec);
 }
 
+/* check whether the address would be proteted by Low-Address Protection */
+static bool is_low_address(uint64_t addr)
+{
+    return addr < 512 || (addr >= 4096 && addr <= 4607);
+}

Just cosmetic, but I'd rather either use "<=" or "<" both times, so:

   return addr <= 511 || (addr >= 4096 && addr <= 4607);

target/s390x/mmu_helper.c static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr, · line 134

Quoted 10 lines

target/s390x/mmu_helper.c +10 -0

+    /* Check the private-space control bit */
+    switch (asc) {
+    case PSW_ASC_PRIMARY:
+        return !(env->cregs[1] & _ASCE_PRIVATE_SPACE);
+    case PSW_ASC_SECONDARY:
+        return !(env->cregs[7] & _ASCE_PRIVATE_SPACE);
+    case PSW_ASC_HOME:
+        return !(env->cregs[13] & _ASCE_PRIVATE_SPACE);
+    default:
+        g_assert_not_reached();

Well, this is certainly reachable - if the guest was running in access register mode. So it might be nicer to the user if you keep the error_report() here?

Quoted 41 lines · Thomas Huth

Quoted 23 lines · David Hildenbrand

This is a neat way to implement low address protection, whereby only the first 512 bytes of the first two pages (each 4096 bytes) of every address space are protected.

Store a tec of 0 for the access exception, this is what is defined by Enhanced Suppression on Protection in case of a low address protection (Bit 61 set to 0, rest undefined).

We have to make sure to to pass the access address, not the masked page address into mmu_translate*().

Drop the check from testblock. So we can properly test this via kvm-unit-tests.

This will check every access going through one of the MMUs.

Reviewed-by Richard Henderson <[email protected]>

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/excp_helper.c |  3 +-
 target/s390x/mem_helper.c  |  8 ----
 target/s390x/mmu_helper.c  | 94 +++++++++++++++++++++++++++++-----------------
 3 files changed, 60 insertions(+), 45 deletions(-)  

[...]

target/s390x/mmu_helper.c static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr, · line 113

Quoted 13 lines

target/s390x/mmu_helper.c +5 -0

index 9daa0fd8e2..9806685bee 100644
@@ -106,6 +106,35 @@ static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,
     trigger_access_exception(env, type, ilen, tec);
 }
 
+/* check whether the address would be proteted by Low-Address Protection */
+static bool is_low_address(uint64_t addr)
+{
+    return addr < 512 || (addr >= 4096 && addr <= 4607);
+}  

Just cosmetic, but I'd rather either use "<=" or "<" both times, so:

Quoted 2 lines

   return addr <= 511 || (addr >= 4096 && addr <= 4607);

That one then, as it matches the wording in the PoP.

Quoted 11 lines

Quoted 10 lines

target/s390x/mmu_helper.c +10 -0

+    /* Check the private-space control bit */
+    switch (asc) {
+    case PSW_ASC_PRIMARY:
+        return !(env->cregs[1] & _ASCE_PRIVATE_SPACE);
+    case PSW_ASC_SECONDARY:
+        return !(env->cregs[7] & _ASCE_PRIVATE_SPACE);
+    case PSW_ASC_HOME:
+        return !(env->cregs[13] & _ASCE_PRIVATE_SPACE);
+    default:
+        g_assert_not_reached();  

Quoted 3 lines

Well, this is certainly reachable - if the guest was running in access register mode. So it might be nicer to the user if you keep the error_report() here?

Right, this would be reachable via translate_pages(), but not via the tlb. Although unlikely to hit it at that point, we can keep the error.

Conny, can you fix these two up or do you want me to resend?

git://github.com/cohuck/qemu lap

Details about Low-Address Protection can be found in description of patch 1 and 2. It is basically a subpage protection of the first two pages of every address space (for which it is enabled).

We can achieve this by simply directly invalidating the TLB entry and therefore forcing every write accesses onto these two pages into the slow path.

With this patch, I can boot Linux just fine (which uses LAP). This also makes all related kvm-unit-tests that we have pass.

RFC -> v1:
- fix LAP range check (Thomas)
- SIGP fix got picked up

Based on: https://github.com/cohuck/qemu.git s390-next Available on: https://github.com/dhildenb/qemu.git s390x_lap

David Hildenbrand (2):
accel/tcg: allow to invalidate a write TLB entry immediately s390x/tcg: low-address protection support

 accel/tcg/cputlb.c           |  5 ++-
 accel/tcg/softmmu_template.h |  4 +-
 include/exec/cpu-all.h       |  3 ++
 target/s390x/excp_helper.c   |  3 +-
 target/s390x/mem_helper.c    |  8 ----
 target/s390x/mmu_helper.c    | 94 +++++++++++++++++++++++++++-----------------
 6 files changed, 69 insertions(+), 48 deletions(-)

Quoted 8 lines · On Mon, 16 Oct 2017 22:23:56 +0200 David Hildenbrand <[email protected]> wrote:

Details about Low-Address Protection can be found in description of patch 1 and 2. It is basically a subpage protection of the first two pages of every address space (for which it is enabled).

We can achieve this by simply directly invalidating the TLB entry and therefore forcing every write accesses onto these two pages into the slow path.

Quoted 2 lines

With this patch, I can boot Linux just fine (which uses LAP). This also makes all related kvm-unit-tests that we have pass.

Tested with a kernel based on the s390/features branch (4.14-rc2 + s390 patches) and the initrd from the debian installer, had udevd shot down by the oomkiller. That happened only once, so it was probably an unrelated fluke, but that combination worked well before.

[More config data + logs available on request.]

Quoted 11 lines · Cornelia Huck

Quoted 8 lines · On Mon, 16 Oct 2017 22:23:56 +0200 David Hildenbrand <[email protected]> wrote:

Details about Low-Address Protection can be found in description of patch 1 and 2. It is basically a subpage protection of the first two pages of every address space (for which it is enabled).

We can achieve this by simply directly invalidating the TLB entry and therefore forcing every write accesses onto these two pages into the slow path.

Quoted 8 lines

Quoted 2 lines

With this patch, I can boot Linux just fine (which uses LAP). This also makes all related kvm-unit-tests that we have pass.

Tested with a kernel based on the s390/features branch (4.14-rc2 + s390 patches) and the initrd from the debian installer, had udevd shot down by the oomkiller. That happened only once, so it was probably an unrelated fluke, but that combination worked well before.

Very unlikely, on invalid programming exceptions you would get a kernel panic, not run oom. (not saying it isn't possible, rather that it is very unlikely).

Can you reproduce with more memory? Have you enabled SMP? (little higher memory consumption)

I am running (almost) the same setup with 500M and haven't observed any such thing.

Details about Low-Address Protection can be found in description of patch 1 and 2. It is basically a subpage protection of the first two pages of every address space (for which it is enabled).

We can achieve this by simply directly invalidating the TLB entry and therefore forcing every write accesses onto these two pages into the slow path.

With this patch, I can boot Linux just fine (which uses LAP). This also makes all related kvm-unit-tests that we have pass.

RFC -> v1:
- fix LAP range check (Thomas)
- SIGP fix got picked up

Based on: https://github.com/cohuck/qemu.git s390-next Available on: https://github.com/dhildenb/qemu.git s390x_lap

David Hildenbrand (2):
accel/tcg: allow to invalidate a write TLB entry immediately s390x/tcg: low-address protection support

 accel/tcg/cputlb.c           |  5 ++-
 accel/tcg/softmmu_template.h |  4 +-
 include/exec/cpu-all.h       |  3 ++
 target/s390x/excp_helper.c   |  3 +-
 target/s390x/mem_helper.c    |  8 ----
 target/s390x/mmu_helper.c    | 94 +++++++++++++++++++++++++++-----------------
 6 files changed, 69 insertions(+), 48 deletions(-)

Quoted 24 lines · On Mon, 16 Oct 2017 22:23:56 +0200 David Hildenbrand <[email protected]> wrote:

Details about Low-Address Protection can be found in description of patch 1 and 2. It is basically a subpage protection of the first two pages of every address space (for which it is enabled).

We can achieve this by simply directly invalidating the TLB entry and therefore forcing every write accesses onto these two pages into the slow path.

With this patch, I can boot Linux just fine (which uses LAP). This also makes all related kvm-unit-tests that we have pass.

RFC -> v1:
- fix LAP range check (Thomas)
- SIGP fix got picked up

Based on: https://github.com/cohuck/qemu.git s390-next Available on: https://github.com/dhildenb/qemu.git s390x_lap

David Hildenbrand (2):
accel/tcg: allow to invalidate a write TLB entry immediately s390x/tcg: low-address protection support

Quoted 8 lines

 accel/tcg/cputlb.c           |  5 ++-
 accel/tcg/softmmu_template.h |  4 +-
 include/exec/cpu-all.h       |  3 ++
 target/s390x/excp_helper.c   |  3 +-
 target/s390x/mem_helper.c    |  8 ----
 target/s390x/mmu_helper.c    | 94 +++++++++++++++++++++++++++-----------------
 6 files changed, 69 insertions(+), 48 deletions(-)

As the oom was not reproducible (and seems to be only a problem of the machine being run with barely enough memory), I'm inclined to queue this to s390-next after I got some acks/r-bs for patch 1.