From patchwork Wed Dec 11 16:56:48 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marc Zyngier X-Patchwork-Id: 11285743 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0B0CB1593 for ; Wed, 11 Dec 2019 16:57:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DD952214AF for ; Wed, 11 Dec 2019 16:57:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576083431; bh=GcFpvt75Xp6DJ4rGymnbWlL6+QOGJHhpt4xnoVMl6UE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Lt9iAsRAXUYJ5V+sixf/CSZY8kUeAvih9j0ABdxnLuu5qtzSdTq8Nv+5xyaqfHKm3 09HXFEmh9AyTX5BUVBrbQZFwWCqBePK8fJafVLMMAunjX8MHHLLrtprOvJ8P1HQ5IX 4ddlEtPnzZxWKbzAIM/pPH8Hg4eodxaOuEF98zAM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730591AbfLKQ5L (ORCPT ); Wed, 11 Dec 2019 11:57:11 -0500 Received: from inca-roads.misterjones.org ([213.251.177.50]:36508 "EHLO inca-roads.misterjones.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726444AbfLKQ5K (ORCPT ); Wed, 11 Dec 2019 11:57:10 -0500 Received: from 78.163-31-62.static.virginmediabusiness.co.uk ([62.31.163.78] helo=why.lan) by cheepnis.misterjones.org with esmtpsa (TLSv1.2:DHE-RSA-AES128-GCM-SHA256:128) (Exim 4.80) (envelope-from ) id 1if5IO-00076q-HF; Wed, 11 Dec 2019 17:57:04 +0100 From: Marc Zyngier To: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org Cc: James Morse , Julien Thierry , Suzuki K Poulose , Christoffer Dall , Alexandru Elisei , stable@vger.kernel.org Subject: [PATCH 1/3] KVM: arm/arm64: Properly handle faulting of device mappings Date: Wed, 11 Dec 2019 16:56:48 +0000 Message-Id: <20191211165651.7889-2-maz@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191211165651.7889-1-maz@kernel.org> References: <20191211165651.7889-1-maz@kernel.org> MIME-Version: 1.0 X-SA-Exim-Connect-IP: 62.31.163.78 X-SA-Exim-Rcpt-To: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, Christoffer.Dall@arm.com, alexandru.elisei@arm.com, stable@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on cheepnis.misterjones.org); SAEximRunCond expanded to false Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org A device mapping is normally always mapped at Stage-2, since there is very little gain in having it faulted in. Nonetheless, it is possible to end-up in a situation where the device mapping has been removed from Stage-2 (userspace munmaped the VFIO region, and the MMU notifier did its job), but present in a userspace mapping (userpace has mapped it back at the same address). In such a situation, the device mapping will be demand-paged as the guest performs memory accesses. This requires to be careful when dealing with mapping size, cache management, and to handle potential execution of a device mapping. Cc: stable@vger.kernel.org Reported-by: Alexandru Elisei Signed-off-by: Marc Zyngier Tested-by: Alexandru Elisei Reviewed-by: James Morse --- virt/kvm/arm/mmu.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c index a48994af70b8..0b32a904a1bb 100644 --- a/virt/kvm/arm/mmu.c +++ b/virt/kvm/arm/mmu.c @@ -38,6 +38,11 @@ static unsigned long io_map_base; #define KVM_S2PTE_FLAG_IS_IOMAP (1UL << 0) #define KVM_S2_FLAG_LOGGING_ACTIVE (1UL << 1) +static bool is_iomap(unsigned long flags) +{ + return flags & KVM_S2PTE_FLAG_IS_IOMAP; +} + static bool memslot_is_logging(struct kvm_memory_slot *memslot) { return memslot->dirty_bitmap && !(memslot->flags & KVM_MEM_READONLY); @@ -1698,6 +1703,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, vma_pagesize = vma_kernel_pagesize(vma); if (logging_active || + (vma->vm_flags & VM_PFNMAP) || !fault_supports_stage2_huge_mapping(memslot, hva, vma_pagesize)) { force_pte = true; vma_pagesize = PAGE_SIZE; @@ -1760,6 +1766,9 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, writable = false; } + if (exec_fault && is_iomap(flags)) + return -ENOEXEC; + spin_lock(&kvm->mmu_lock); if (mmu_notifier_retry(kvm, mmu_seq)) goto out_unlock; @@ -1781,7 +1790,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, if (writable) kvm_set_pfn_dirty(pfn); - if (fault_status != FSC_PERM) + if (fault_status != FSC_PERM && !is_iomap(flags)) clean_dcache_guest_page(pfn, vma_pagesize); if (exec_fault) @@ -1948,9 +1957,8 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) if (kvm_is_error_hva(hva) || (write_fault && !writable)) { if (is_iabt) { /* Prefetch Abort on I/O address */ - kvm_inject_pabt(vcpu, kvm_vcpu_get_hfar(vcpu)); - ret = 1; - goto out_unlock; + ret = -ENOEXEC; + goto out; } /* @@ -1992,6 +2000,11 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu, struct kvm_run *run) ret = user_mem_abort(vcpu, fault_ipa, memslot, hva, fault_status); if (ret == 0) ret = 1; +out: + if (ret == -ENOEXEC) { + kvm_inject_pabt(vcpu, kvm_vcpu_get_hfar(vcpu)); + ret = 1; + } out_unlock: srcu_read_unlock(&vcpu->kvm->srcu, idx); return ret; From patchwork Wed Dec 11 16:56:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marc Zyngier X-Patchwork-Id: 11285739 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E19C215AB for ; Wed, 11 Dec 2019 16:57:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B719B24653 for ; Wed, 11 Dec 2019 16:57:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576083429; bh=uyyE3bSlDt57D2A7xQNH6i03OILq8S2hiC9MtefoA8Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=BS5VFC7EHyifoHD+D+pGwRu/Q0nJEYiFEbN2T1DrUyb2jkhe82IVKsMNOflTt8/7+ E8dF10CJZj4n6tHmDwJqdbiDyDcZyqyDH9qoWiX51DTVahktquRqcJkHvPV+q1Pmkv HGf7Txm6V/Ll44GgipUyH/2So0ZjoROWOBKATJ3c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730363AbfLKQ5I (ORCPT ); Wed, 11 Dec 2019 11:57:08 -0500 Received: from inca-roads.misterjones.org ([213.251.177.50]:40525 "EHLO inca-roads.misterjones.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726444AbfLKQ5H (ORCPT ); Wed, 11 Dec 2019 11:57:07 -0500 Received: from 78.163-31-62.static.virginmediabusiness.co.uk ([62.31.163.78] helo=why.lan) by cheepnis.misterjones.org with esmtpsa (TLSv1.2:DHE-RSA-AES128-GCM-SHA256:128) (Exim 4.80) (envelope-from ) id 1if5IP-00076q-7X; Wed, 11 Dec 2019 17:57:05 +0100 From: Marc Zyngier To: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org Cc: James Morse , Julien Thierry , Suzuki K Poulose , Christoffer Dall , Alexandru Elisei Subject: [PATCH 2/3] KVM: arm/arm64: Re-check VMA on detecting a poisoned page Date: Wed, 11 Dec 2019 16:56:49 +0000 Message-Id: <20191211165651.7889-3-maz@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191211165651.7889-1-maz@kernel.org> References: <20191211165651.7889-1-maz@kernel.org> MIME-Version: 1.0 X-SA-Exim-Connect-IP: 62.31.163.78 X-SA-Exim-Rcpt-To: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, Christoffer.Dall@arm.com, alexandru.elisei@arm.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on cheepnis.misterjones.org); SAEximRunCond expanded to false Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org When we check for a poisoned page, we use the VMA to tell userspace about the looming disaster. But we pass a pointer to this VMA after having released the mmap_sem, which isn't a good idea. Instead, re-check that we have still have a VMA, and that this VMA still points to a poisoned page. If the VMA isn't there, userspace is playing with our nerves, so lety's give it a -EFAULT (it deserves it). If the PFN isn't poisoned anymore, let's restart from the top and handle the fault again. Signed-off-by: Marc Zyngier --- virt/kvm/arm/mmu.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c index 0b32a904a1bb..f73393f5ddb7 100644 --- a/virt/kvm/arm/mmu.c +++ b/virt/kvm/arm/mmu.c @@ -1741,9 +1741,30 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, pfn = gfn_to_pfn_prot(kvm, gfn, write_fault, &writable); if (pfn == KVM_PFN_ERR_HWPOISON) { - kvm_send_hwpoison_signal(hva, vma); - return 0; + /* + * Search for the VMA again, as it may have been + * removed in the interval... + */ + down_read(¤t->mm->mmap_sem); + vma = find_vma_intersection(current->mm, hva, hva + 1); + if (vma) { + /* + * Recheck for a poisoned page. If something changed + * behind our back, don't do a thing and take the + * fault again. + */ + pfn = gfn_to_pfn_prot(kvm, gfn, write_fault, &writable); + if (pfn == KVM_PFN_ERR_HWPOISON) + kvm_send_hwpoison_signal(hva, vma); + + ret = 0; + } else { + ret = -EFAULT; + } + up_read(¤t->mm->mmap_sem); + return ret; } + if (is_error_noslot_pfn(pfn)) return -EFAULT; From patchwork Wed Dec 11 16:56:50 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marc Zyngier X-Patchwork-Id: 11285737 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9ED7F1593 for ; Wed, 11 Dec 2019 16:57:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7D05522527 for ; Wed, 11 Dec 2019 16:57:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576083428; bh=qah1AMgfkt7WeXzxd/MF2CEkgJ0RWDhRqFDfDBqEDTU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=XbZ9APbTPfMF8nDxCIBkOSSxQwVLHRTn2P3LpnYZNk7osbqYEArvlhOrCg1UoCccl bWDq/1Mjy6F565UHfiheR32bQ48stONPQ0eKNvTmq0vQak0JpoFPVbmFf8Xc/EEVix X4Qw1t3z3sNmcMfP2O2qpZN3QryTK5Tnqoa3Rbrs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730276AbfLKQ5H (ORCPT ); Wed, 11 Dec 2019 11:57:07 -0500 Received: from inca-roads.misterjones.org ([213.251.177.50]:37984 "EHLO inca-roads.misterjones.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730158AbfLKQ5H (ORCPT ); Wed, 11 Dec 2019 11:57:07 -0500 Received: from 78.163-31-62.static.virginmediabusiness.co.uk ([62.31.163.78] helo=why.lan) by cheepnis.misterjones.org with esmtpsa (TLSv1.2:DHE-RSA-AES128-GCM-SHA256:128) (Exim 4.80) (envelope-from ) id 1if5IP-00076q-Nw; Wed, 11 Dec 2019 17:57:05 +0100 From: Marc Zyngier To: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org Cc: James Morse , Julien Thierry , Suzuki K Poulose , Christoffer Dall , Alexandru Elisei Subject: [PATCH 3/3] KVM: arm/arm64: Drop spurious message when faulting on a non-existent mapping Date: Wed, 11 Dec 2019 16:56:50 +0000 Message-Id: <20191211165651.7889-4-maz@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191211165651.7889-1-maz@kernel.org> References: <20191211165651.7889-1-maz@kernel.org> MIME-Version: 1.0 X-SA-Exim-Connect-IP: 62.31.163.78 X-SA-Exim-Rcpt-To: kvm@vger.kernel.org, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, Christoffer.Dall@arm.com, alexandru.elisei@arm.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on cheepnis.misterjones.org); SAEximRunCond expanded to false Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Should userspace unmap memory whilst the guest is running, we exit with a -EFAULT, but also having spat a useless message on the console. Get rid of it. Signed-off-by: Marc Zyngier Acked-by: Christoffer Dall --- virt/kvm/arm/mmu.c | 1 - 1 file changed, 1 deletion(-) diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c index f73393f5ddb7..fbfdffb8fe8e 100644 --- a/virt/kvm/arm/mmu.c +++ b/virt/kvm/arm/mmu.c @@ -1696,7 +1696,6 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, down_read(¤t->mm->mmap_sem); vma = find_vma_intersection(current->mm, hva, hva + 1); if (unlikely(!vma)) { - kvm_err("Failed to find VMA for hva 0x%lx\n", hva); up_read(¤t->mm->mmap_sem); return -EFAULT; }