Re: [PATCH v3] xen/arm: Convert runstate address during hypcall

[Julien Grall <julien@xxxxxxx>]

Hi Bertrand,

On 31/07/2020 14:09, Bertrand Marquis wrote:
> > On 31 Jul 2020, at 14:19, Jan Beulich <jbeulich@xxxxxxxx> wrote:
> >
> > On 30.07.2020 22:50, Julien Grall wrote:
> > > On 30/07/2020 11:24, Bertrand Marquis wrote:
> > > > At the moment on Arm, a Linux guest running with KTPI enabled will
> > > > cause the following error when a context switch happens in user mode:
> > > > (XEN) p2m.c:1890: d1v0: Failed to walk page-table va 0xffffff837ebe0cd0
> > > >
> > > > The error is caused by the virtual address for the runstate area
> > > > registered by the guest only being accessible when the guest is running
> > > > in kernel space when KPTI is enabled.
> > > >
> > > > To solve this issue, this patch is doing the translation from virtual
> > > > address to physical address during the hypercall and mapping the
> > > > required pages using vmap. This is removing the conversion from virtual
> > > > to physical address during the context switch which is solving the
> > > > problem with KPTI.
> > > To echo what Jan said on the previous version, this is a change in a
> > > stable ABI and therefore may break existing guest. FAOD, I agree in
> > > principle with the idea. However, we want to explain why breaking the
> > > ABI is the *only* viable solution.
> > >
> > >  From my understanding, it is not possible to fix without an ABI
> > > breakage because the hypervisor doesn't know when the guest will switch
> > > back from userspace to kernel space.
> > And there's also no way to know on Arm, by e.g. enabling a suitable
> > intercept?
There is no easy way to do it. You might be able to route all EL0 
exceptions to EL2 using HCR_EL2.TGE, but this is basically disable EL1 
(kernel space). The amount of work required and the overhead is likely 
not worth it.
> An intercept would mean that Xen gets a notice whenever a guest is switching
> from kernel mode to user mode.
> There is nothing in this process which could be intercepted by Xen, appart from
> maybe trapping all access to MMU registers which would be very complex and
> slow.
I agree. Although, even if it wasn't slow, there is no guarantee that 
any of those registers would be accessed during the switch.
You could implement a "dumb" KPTI by just removing the mappings from the 
page-tables.
Cheers,

--
Julien Grall