KVM: arm64: Inject exception on out-of-IPA-range translation fault
authorMarc Zyngier <maz@kernel.org>
Thu, 21 Apr 2022 14:38:10 +0000 (15:38 +0100)
committerMarc Zyngier <maz@kernel.org>
Wed, 27 Apr 2022 22:02:23 +0000 (23:02 +0100)
commit85ea6b1ec915c9dd90caf3674b203999d8c7e062
treedc832521b9ca39b8d727161fa8e53bf884622007
parent8f6379e207e7d834065a080f407a60d67349d961
KVM: arm64: Inject exception on out-of-IPA-range translation fault

When taking a translation fault for an IPA that is outside of
the range defined by the hypervisor (between the HW PARange and
the IPA range), we stupidly treat it as an IO and forward the access
to userspace. Of course, userspace can't do much with it, and things
end badly.

Arguably, the guest is braindead, but we should at least catch the
case and inject an exception.

Check the faulting IPA against:
- the sanitised PARange: inject an address size fault
- the IPA size: inject an abort

Reported-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
arch/arm64/include/asm/kvm_emulate.h
arch/arm64/kvm/inject_fault.c
arch/arm64/kvm/mmu.c