KVM: arm64: Correct BTYPE/SS in host SMC emulation
Marc Zyngier
maintainerPATCH 1/1 KVM: arm64: Correct BTYPE/SS in host SMC emulation
When taking a trap for an SMC instruction on the host, we must stau true to the letter of the architecture and perform all the actions that the CPU would otherwise do. Among those are clearing the BTYPE and SS bits.
Just do that.
--- arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h +6 -0
@@ -47,7 +47,13 @@ static inline void __kvm_skip_instr(struct kvm_vcpu *vcpu)*/ static inline void kvm_skip_host_instr (void ) { +u64 spsr =read_sysreg_el2 (SYS_SPSR ); +write_sysreg_el2 (read_sysreg_el2 (SYS_ELR ) +4 ,SYS_ELR ); + + spsr &= ~(PSR_BTYPE_MASK |DBG_SPSR_SS ); + +write_sysreg_el2 (spsr,SYS_SPSR ); }#endif
Signature · 1 line
2.39.2
Will Deacon
maintainerQuoted 2 lines · Marc Zyngier
When taking a trap for an SMC instruction on the host, we must stau true to the letter of the architecture and perform all the
typo: stay
Quoted 16 lines
actions that the CPU would otherwise do. Among those are clearing the BTYPE and SS bits.
Just do that.
Fixes a805e1fb3099 ("KVM: arm64: Add SMC handler in nVHE EL2")Signed-off-by Marc Zyngier <[email protected]>--- arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 6 ++++++ 1 file changed, 6 insertions(+)arch/arm64/kvm/hyp/include/hyp/adjust_pc.h +0
-0
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h static inline void __kvm_skip_instr(struct kvm_vcpu *vcpu) · line 56
Quoted 10 lines
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h +6
-0@@ -47,7 +47,13 @@ static inline void __kvm_skip_instr(struct kvm_vcpu *vcpu)*/ static inline void kvm_skip_host_instr (void ) { +u64 spsr =read_sysreg_el2 (SYS_SPSR ); +write_sysreg_el2 (read_sysreg_el2 (SYS_ELR ) +4 ,SYS_ELR ); + + spsr &= ~(PSR_BTYPE_MASK |DBG_SPSR_SS ); + +write_sysreg_el2 (spsr,SYS_SPSR );
The handling of SS looks correct to me, but I think the BTYPE manipulation could do with a little more commentary as it looks quite subtle when the SMC is in a guarded page. Am I right in thinking:
* If the SMC is in a guarded page, the Branch Target exception is higher priority (12) than the trap to EL2 and so the host will handle it.
* Therefore if a trapping SMC is in a guarded page, BTYPE must be zero and we don't have to worry about injecting a Branch Target exception.
* Otherwise, if the SMC is in a non-guarded page, we should clear it to 0 per the architecture (R_YWFHD).
?
Having said that, I can't actually find the priority of an SMC trapped to EL2 by HCR_EL2.TSC in the Arm ARM. Trapped HVCs are priority 15 and SMCs trapped to EL3 are priority 23.
Will
Marc Zyngier
maintainerQuoted 42 lines · Will Deacon
Quoted 2 lines · Marc Zyngier
When taking a trap for an SMC instruction on the host, we must stau true to the letter of the architecture and perform all the
typo: stay
Quoted 16 lines
actions that the CPU would otherwise do. Among those are clearing the BTYPE and SS bits.
Just do that.
Fixes a805e1fb3099 ("KVM: arm64: Add SMC handler in nVHE EL2")Signed-off-by Marc Zyngier <[email protected]>--- arch/arm64/kvm/hyp/include/hyp/adjust_pc.h | 6 ++++++ 1 file changed, 6 insertions(+)arch/arm64/kvm/hyp/include/hyp/adjust_pc.h +0
-0arch/arm64/kvm/hyp/include/hyp/adjust_pc.h static inline void __kvm_skip_instr(struct kvm_vcpu *vcpu) · line 56
Quoted 10 lines
arch/arm64/kvm/hyp/include/hyp/adjust_pc.h +6
-0@@ -47,7 +47,13 @@ static inline void __kvm_skip_instr(struct kvm_vcpu *vcpu)*/ static inline void kvm_skip_host_instr (void ) { +u64 spsr =read_sysreg_el2 (SYS_SPSR ); +write_sysreg_el2 (read_sysreg_el2 (SYS_ELR ) +4 ,SYS_ELR ); + + spsr &= ~(PSR_BTYPE_MASK |DBG_SPSR_SS ); + +write_sysreg_el2 (spsr,SYS_SPSR );The handling of SS looks correct to me, but I think the BTYPE manipulation could do with a little more commentary as it looks quite subtle when the SMC is in a guarded page. Am I right in thinking:
* If the SMC is in a guarded page, the Branch Target exception is higher priority (12) than the trap to EL2 and so the host will handle it.
Quoted 8 lines
* Therefore if a trapping SMC is in a guarded page, BTYPE must be zero and we don't have to worry about injecting a Branch Target exception.
* Otherwise, if the SMC is in a non-guarded page, we should clear it to 0 per the architecture (
R_YWFHD).?
This is all correct. If we get to emulate the SMC by trapping to EL2, it is that the instruction already satisfied the more basic execution requirements such as having an acceptable BTYPE at that PC.
If that's OK with you, I'll nick that write-up and stick it into the next revision of the patch.
Quoted 3 lines
Having said that, I can't actually find the priority of an SMC trapped to EL2 by HCR_EL2.TSC in the Arm ARM. Trapped HVCs are priority 15 and SMCs trapped to EL3 are priority 23.
My understanding is that this falls into the catch-all priority 22 of R_ZFGJP ("Other than an exception defined by priorities 4-21 inclusive, any exception that is the result of a configurable access to instructions, where the exception is taken to EL2.").
Thanks,
M.
Signature · 1 line
Without deviation from the norm, progress is not possible.