From patchwork Mon Oct 30 02:56:03 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christoffer Dall X-Patchwork-Id: 10031921 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 53EE2603B5 for ; Mon, 30 Oct 2017 03:00:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3FF9C28720 for ; Mon, 30 Oct 2017 03:00:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 34E1428727; Mon, 30 Oct 2017 03:00:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id B228D28720 for ; Mon, 30 Oct 2017 03:00:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=4QGVVXkxHe+uWm0MHgi0PMKZ4+1ZiiY1WdZ8ybE0tJM=; b=Ef927k5v8aWCi8gVotSyCHjU9q n6dGMXDA79QLN0vTZms9YrIOe6gigeyS5EIzEWjmzFO3QXvFaR0gK8RiE2g77izgAtLP3xt2Rjqvi 4rDO1/7Xx5JtepxfNU4D/ruSw4ms04A7qOnoyyiVqyxx2FEKKx7NC2V9uEgBiBL7hLQdcG5qYr042 7fRDeOV5rqSMVQM+lNWORkgzNcBofYELxNLO8eYkgbP6zEQWd6xxXu5Ev4rlqhznL2Hf8WQXpMRAf LQmzf85PGwtXq4+XpCo+waQ/bOeCd55aeGePcUJG1XlpZmxK1MUmU1g8stjsexAgTK+FARBufY1rB Eu40dtow==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1e90Jd-0001Ks-Fm; Mon, 30 Oct 2017 03:00:41 +0000 Received: from mail-wm0-x244.google.com ([2a00:1450:400c:c09::244]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1e90Fh-00060g-IE for linux-arm-kernel@lists.infradead.org; Mon, 30 Oct 2017 02:56:48 +0000 Received: by mail-wm0-x244.google.com with SMTP id b9so13466990wmh.0 for ; Sun, 29 Oct 2017 19:56:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Lv+oW2M1w9qOsFDBqWSa2SZnvrTc94qbUVRqvLySRqQ=; b=M7A4KSUE56rQrX4UEHcK0oKGwCODilgjIY5FGrG2qGEU6BIi8ifzsskjLDGcfcBZgV cUzrFZ4xIKdcMjIB/cRKckUv7xFRRQBrCfmj6vnVO+iRU13qnEGvEflC0g7ctBfn1WFC i9IbhJbXeGGO1PLp+yKAEUFa7qxmgzRbgkN0M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Lv+oW2M1w9qOsFDBqWSa2SZnvrTc94qbUVRqvLySRqQ=; b=Acv7oLokCdPgithCuzy9nsiaK5yQyYQwd/QJmu+c5YAzWo9y5zaOgPmk6HlzSmUiiJ tqoTZSK5zlLzJRfJR+pJM2nn60IE8NxfLMezBywgormPGpFfYFPDl6LPi8gLxGS8foV3 9PmHWk+EWNNVsBe/0HVfC1BpFBXgK+TXO46CjkOq8IRxWKFWADt/DBn89Am3E/jXqboQ katZeZdutBppDYVJ/nHNe1krLHaSZ/zyQBL/VsuhSBseXnE1R9YpQ5EluL+1phzi6yqc PcAt2LXTcA+3qN4+ZQRIIYpmXYJvTUnfZIl0DrSh5z3SxsWeRdrf+x0jNeYic10w2qbo Lhfg== X-Gm-Message-State: AMCzsaXvWp2/SCZSjj5aDbs0jX89XueIlyHJRCs97+DJZFlYfh1rT1DN VxIDmPM3dflL4joq3LA/EorHIjV0tvs= X-Google-Smtp-Source: ABhQp+TNLeOTdTKhp7RHmEQ6qtaqc9+gToO2GLaq6Xx8sKXhWG21dZ0whHi2ZBnM5nSyS5g/eNPfQg== X-Received: by 10.80.141.141 with SMTP id r13mr9857589edh.107.1509332180180; Sun, 29 Oct 2017 19:56:20 -0700 (PDT) Received: from localhost.localdomain (xd93dd96b.cust.hiper.dk. [217.61.217.107]) by smtp.gmail.com with ESMTPSA id u14sm7856415edd.47.2017.10.29.19.56.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 29 Oct 2017 19:56:19 -0700 (PDT) From: Christoffer Dall To: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= Subject: [PULL 8/8] KVM: arm/arm64: vgic-its: Check GITS_BASER Valid bit before saving tables Date: Mon, 30 Oct 2017 03:56:03 +0100 Message-Id: <20171030025603.23550-9-christoffer.dall@linaro.org> X-Mailer: git-send-email 2.14.2 In-Reply-To: <20171030025603.23550-1-christoffer.dall@linaro.org> References: <20171030025603.23550-1-christoffer.dall@linaro.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20171029_195637_883257_CD61AAAA X-CRM114-Status: GOOD ( 14.42 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kvm@vger.kernel.org, Marc Zyngier , Eric Auger , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, Christoffer Dall MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Eric Auger At the moment we don't properly check the GITS_BASER.Valid bit before saving the collection and device tables. On vgic_its_save_collection_table() we use the GITS_BASER gpa field whereas the Valid bit should be used. On vgic_its_save_device_tables() there is no check. This can cause various bugs, among which a subsequent fault when accessing the table in guest memory. Let's systematically check the Valid bit before doing anything. We also uniformize the code between save and restore. Signed-off-by: Eric Auger Reviewed-by: Andre Przywara Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier Signed-off-by: Christoffer Dall --- virt/kvm/arm/vgic/vgic-its.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index e69ef7d27fde..547f12dc4d54 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -2067,11 +2067,12 @@ static int vgic_its_device_cmp(void *priv, struct list_head *a, static int vgic_its_save_device_tables(struct vgic_its *its) { const struct vgic_its_abi *abi = vgic_its_get_abi(its); + u64 baser = its->baser_device_table; struct its_device *dev; int dte_esz = abi->dte_esz; - u64 baser; - baser = its->baser_device_table; + if (!(baser & GITS_BASER_VALID)) + return 0; list_sort(NULL, &its->device_list, vgic_its_device_cmp); @@ -2215,17 +2216,17 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) static int vgic_its_save_collection_table(struct vgic_its *its) { const struct vgic_its_abi *abi = vgic_its_get_abi(its); + u64 baser = its->baser_coll_table; + gpa_t gpa = BASER_ADDRESS(baser); struct its_collection *collection; u64 val; - gpa_t gpa; size_t max_size, filled = 0; int ret, cte_esz = abi->cte_esz; - gpa = BASER_ADDRESS(its->baser_coll_table); - if (!gpa) + if (!(baser & GITS_BASER_VALID)) return 0; - max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K; + max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K; list_for_each_entry(collection, &its->collection_list, coll_list) { ret = vgic_its_save_cte(its, collection, gpa, cte_esz); @@ -2256,17 +2257,18 @@ static int vgic_its_save_collection_table(struct vgic_its *its) static int vgic_its_restore_collection_table(struct vgic_its *its) { const struct vgic_its_abi *abi = vgic_its_get_abi(its); + u64 baser = its->baser_coll_table; int cte_esz = abi->cte_esz; size_t max_size, read = 0; gpa_t gpa; int ret; - if (!(its->baser_coll_table & GITS_BASER_VALID)) + if (!(baser & GITS_BASER_VALID)) return 0; - gpa = BASER_ADDRESS(its->baser_coll_table); + gpa = BASER_ADDRESS(baser); - max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K; + max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K; while (read < max_size) { ret = vgic_its_restore_cte(its, gpa, cte_esz);