From patchwork Mon Oct 30 02:56:03 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christoffer Dall X-Patchwork-Id: 10031909 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0AA32603B5 for ; Mon, 30 Oct 2017 02:56:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EA68E28716 for ; Mon, 30 Oct 2017 02:56:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DF26A2871D; Mon, 30 Oct 2017 02:56:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 80FC028716 for ; Mon, 30 Oct 2017 02:56:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752097AbdJ3C4Y (ORCPT ); Sun, 29 Oct 2017 22:56:24 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:51922 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752046AbdJ3C4V (ORCPT ); Sun, 29 Oct 2017 22:56:21 -0400 Received: by mail-wm0-f66.google.com with SMTP id b9so13466991wmh.0 for ; Sun, 29 Oct 2017 19:56:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Lv+oW2M1w9qOsFDBqWSa2SZnvrTc94qbUVRqvLySRqQ=; b=M7A4KSUE56rQrX4UEHcK0oKGwCODilgjIY5FGrG2qGEU6BIi8ifzsskjLDGcfcBZgV cUzrFZ4xIKdcMjIB/cRKckUv7xFRRQBrCfmj6vnVO+iRU13qnEGvEflC0g7ctBfn1WFC i9IbhJbXeGGO1PLp+yKAEUFa7qxmgzRbgkN0M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Lv+oW2M1w9qOsFDBqWSa2SZnvrTc94qbUVRqvLySRqQ=; b=iCFlgFmoa4EFeIMpBRbcmBMubqgVzoJsqkKbvqtGnEZrTdNTOLUKoHBgRACPx4n18D Tb3DYD3JLDc+ZLiTaJ3gz2oWFoB745uwshco1/0YFPzqqsjR7mJC9NM7rrsqgWCKT3gk FAS0O2WofilCLvONjea0OsAS0cePVHSvVM3qELSbdp+igyS7keclsfNg5MCGt5zQBGoG IlRj8ZD49jFXySziQX1i/BtOM5hYNuar5tqGbdgEn8Rh5649f+hQr1qSSOI+NKK+qKtg 6zp57rJ6v299cOKdTHnImtzOtfYtYI7xSWutTfzfzs0HFNkT1xb/OJJ7dPmLkBWfuW6h 7wkg== X-Gm-Message-State: AMCzsaU/h+PFdpD2Gx+mnKtFpY80NIAhvVoTaWXZp7DI/2Qg2sMScd0C pR8zEydTBbXaFISH8vkCUWCQ/Q== X-Google-Smtp-Source: ABhQp+TNLeOTdTKhp7RHmEQ6qtaqc9+gToO2GLaq6Xx8sKXhWG21dZ0whHi2ZBnM5nSyS5g/eNPfQg== X-Received: by 10.80.141.141 with SMTP id r13mr9857589edh.107.1509332180180; Sun, 29 Oct 2017 19:56:20 -0700 (PDT) Received: from localhost.localdomain (xd93dd96b.cust.hiper.dk. [217.61.217.107]) by smtp.gmail.com with ESMTPSA id u14sm7856415edd.47.2017.10.29.19.56.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 29 Oct 2017 19:56:19 -0700 (PDT) From: Christoffer Dall To: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= Cc: Marc Zyngier , kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Eric Auger , Christoffer Dall Subject: [PULL 8/8] KVM: arm/arm64: vgic-its: Check GITS_BASER Valid bit before saving tables Date: Mon, 30 Oct 2017 03:56:03 +0100 Message-Id: <20171030025603.23550-9-christoffer.dall@linaro.org> X-Mailer: git-send-email 2.14.2 In-Reply-To: <20171030025603.23550-1-christoffer.dall@linaro.org> References: <20171030025603.23550-1-christoffer.dall@linaro.org> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Eric Auger At the moment we don't properly check the GITS_BASER.Valid bit before saving the collection and device tables. On vgic_its_save_collection_table() we use the GITS_BASER gpa field whereas the Valid bit should be used. On vgic_its_save_device_tables() there is no check. This can cause various bugs, among which a subsequent fault when accessing the table in guest memory. Let's systematically check the Valid bit before doing anything. We also uniformize the code between save and restore. Signed-off-by: Eric Auger Reviewed-by: Andre Przywara Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier Signed-off-by: Christoffer Dall --- virt/kvm/arm/vgic/vgic-its.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index e69ef7d27fde..547f12dc4d54 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -2067,11 +2067,12 @@ static int vgic_its_device_cmp(void *priv, struct list_head *a, static int vgic_its_save_device_tables(struct vgic_its *its) { const struct vgic_its_abi *abi = vgic_its_get_abi(its); + u64 baser = its->baser_device_table; struct its_device *dev; int dte_esz = abi->dte_esz; - u64 baser; - baser = its->baser_device_table; + if (!(baser & GITS_BASER_VALID)) + return 0; list_sort(NULL, &its->device_list, vgic_its_device_cmp); @@ -2215,17 +2216,17 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) static int vgic_its_save_collection_table(struct vgic_its *its) { const struct vgic_its_abi *abi = vgic_its_get_abi(its); + u64 baser = its->baser_coll_table; + gpa_t gpa = BASER_ADDRESS(baser); struct its_collection *collection; u64 val; - gpa_t gpa; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; - gpa = BASER_ADDRESS(its->baser_coll_table); - if (!gpa) + if (!(baser & GITS_BASER_VALID)) return 0; - max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K; + max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K; list_for_each_entry(collection, &its->collection_list, coll_list) { ret = vgic_its_save_cte(its, collection, gpa, cte_esz); @@ -2256,17 +2257,18 @@ static int vgic_its_save_collection_table(struct vgic_its *its) static int vgic_its_restore_collection_table(struct vgic_its *its) { const struct vgic_its_abi *abi = vgic_its_get_abi(its); + u64 baser = its->baser_coll_table; int cte_esz = abi->cte_esz; size_t max_size, read = 0; gpa_t gpa; int ret; - if (!(its->baser_coll_table & GITS_BASER_VALID)) + if (!(baser & GITS_BASER_VALID)) return 0; - gpa = BASER_ADDRESS(its->baser_coll_table); + gpa = BASER_ADDRESS(baser); - max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K; + max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K; while (read < max_size) { ret = vgic_its_restore_cte(its, gpa, cte_esz);