From patchwork Thu Jun 20 13:06:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kunkun Jiang X-Patchwork-Id: 13705469 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 083BFC27C79 for ; Thu, 20 Jun 2024 13:07:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date :Subject:CC:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=O0hi9SFgtMvBT2A7B9aD8yLJCNTxGMm4IULnwdUko8M=; b=hpGnPqT5Z3Tncl1/uWgulcD8gD MkPAs1p9/8ohJnOkxK6TNQQZHdz4VUXBzAgl6Yfkr9QTQDG2ZwBxp3pq/kd5zQwaZ8U6be/XzHVol tANxDzxiAQYVi0bt4GkA82B2Rde0OwVieCdHjy/nLb5sq4SMuaIkOuUcREJHVsAaY0GUF0lUyqYGS d3ghNHG6Aid1/hGRPvUDT9aYYkQsbmxxAgpWB1c6cYwABpDXCwHTIrMVD2AQAZj8dp8MU25dltFuM MEEuh/aarZ/0wKvyjRpelIJD6lBvUVh7E7/n59+VSxfdc4UpMNIYdgPo+COilJ7hjiDMtMT8dM3Mw ji3wQ1oQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKHVh-000000055sV-1LG7; Thu, 20 Jun 2024 13:07:29 +0000 Received: from szxga01-in.huawei.com ([45.249.212.187]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKHVW-000000055mM-1NUX for linux-arm-kernel@lists.infradead.org; Thu, 20 Jun 2024 13:07:21 +0000 Received: from mail.maildlp.com (unknown [172.19.163.252]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4W4gdX3y3MzwTtF; Thu, 20 Jun 2024 21:02:56 +0800 (CST) Received: from kwepemm600007.china.huawei.com (unknown [7.193.23.208]) by mail.maildlp.com (Postfix) with ESMTPS id 08B2C18007E; Thu, 20 Jun 2024 21:07:13 +0800 (CST) Received: from DESKTOP-6NKE0BC.china.huawei.com (10.174.185.210) by kwepemm600007.china.huawei.com (7.193.23.208) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.39; Thu, 20 Jun 2024 21:07:11 +0800 From: Kunkun Jiang To: Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , Randy Dunlap , Eric Auger CC: , , , Kunkun Jiang , Subject: [PATCH 1/3] KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* Date: Thu, 20 Jun 2024 21:06:48 +0800 Message-ID: <20240620130650.1279-2-jiangkunkun@huawei.com> X-Mailer: git-send-email 2.26.2.windows.1 In-Reply-To: <20240620130650.1279-1-jiangkunkun@huawei.com> References: <20240620130650.1279-1-jiangkunkun@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.174.185.210] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemm600007.china.huawei.com (7.193.23.208) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240620_060718_556289_01CA6510 X-CRM114-Status: UNSURE ( 9.94 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org In all the vgic_its_save_*() functinos, it does not check whether the data length is larger than 8 bytes before calling vgic_write_guest_lock. This patch add the check. Link: https://lore.kernel.org/kvmarm/86v82ckimh.wl-maz@kernel.org/ Signed-off-by: Kunkun Jiang --- arch/arm64/kvm/vgic/vgic-its.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 40bb43f20bf3..060605fba3b6 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -2094,6 +2094,7 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev, ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); + BUG_ON(ite_esz > sizeof(val)); return vgic_write_guest_lock(kvm, gpa, &val, ite_esz); } @@ -2246,6 +2247,7 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev, (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); + BUG_ON(dte_esz > sizeof(dte_esz)); return vgic_write_guest_lock(kvm, ptr, &val, dte_esz); } @@ -2433,6 +2435,7 @@ static int vgic_its_save_cte(struct vgic_its *its, ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); + BUG_ON(esz > sizeof(val)); return vgic_write_guest_lock(its->dev->kvm, gpa, &val, esz); } From patchwork Thu Jun 20 13:06:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kunkun Jiang X-Patchwork-Id: 13705470 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8EC9FC2BA1A for ; Thu, 20 Jun 2024 13:07:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date :Subject:CC:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=jDfVUQNhwpEymq8ovec4oLiCDc3IwtKhUdBm8iKU0JE=; b=rYS/YtU8aehuSRObgqX1ZJfIE2 0XhNDGe9HwLmYDG3CQGI7zUrOOMtcqQqSnaEddBt+QDkZjgnzCM4EkqPd26lTK0BpoqtnOGs1kayC VoQSwXK7nKCrCfkyhRuyx02Bl0OlM414aiVZQ6TKsTox/juOVewRGOaVb28BSpf6bdfYDFxb4mxRF qZyoSrWQtv1cCGekeUg9rESW7m8SuIk5KfMhvTa7PsI5cbWR0N3bp13aCzdpJkLJxbFgfxLXhPoJf j34KUawixVAQVL/JgeX065PJoZyuUmzxIt/ubZG0kMKLsq2YUALK7/clmKVJ3wZ850DQ6cCwpDaB5 ZGy3F1lA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKHVg-000000055s2-33Qw; Thu, 20 Jun 2024 13:07:28 +0000 Received: from szxga02-in.huawei.com ([45.249.212.188]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKHVV-000000055mR-1JR5 for linux-arm-kernel@lists.infradead.org; Thu, 20 Jun 2024 13:07:20 +0000 Received: from mail.maildlp.com (unknown [172.19.163.252]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4W4gcp010rznW77; Thu, 20 Jun 2024 21:02:17 +0800 (CST) Received: from kwepemm600007.china.huawei.com (unknown [7.193.23.208]) by mail.maildlp.com (Postfix) with ESMTPS id 1DF7518007E; Thu, 20 Jun 2024 21:07:14 +0800 (CST) Received: from DESKTOP-6NKE0BC.china.huawei.com (10.174.185.210) by kwepemm600007.china.huawei.com (7.193.23.208) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.39; Thu, 20 Jun 2024 21:07:12 +0800 From: Kunkun Jiang To: Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , Randy Dunlap , Eric Auger CC: , , , Kunkun Jiang , Subject: [PATCH 2/3] KVM: arm64: vgic-its: Clear dte when mapd unmaps a device Date: Thu, 20 Jun 2024 21:06:49 +0800 Message-ID: <20240620130650.1279-3-jiangkunkun@huawei.com> X-Mailer: git-send-email 2.26.2.windows.1 In-Reply-To: <20240620130650.1279-1-jiangkunkun@huawei.com> References: <20240620130650.1279-1-jiangkunkun@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.174.185.210] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemm600007.china.huawei.com (7.193.23.208) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240620_060717_567919_7B3FEE38 X-CRM114-Status: GOOD ( 12.97 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org vgic_its_save_device_tables will traverse its->device_list to save dte for each device. vgic_its_restore_device_tables will traverse each entry of device table and check if it is valid. Restore if valid. But when mapd unmaps a devices, we do not invalidate the corresponding dte. In the scenario of continuous save and restore, there may be a situation where a device's dte is not saved but is restored. This is unreasonable and may cause restore to fail. This patch clears the corresponding dte when mapd unmaps a device. Singed-off-by: Shusen Li Co-developed-by: Shusen Li Signed-off-by: Kunkun Jiang --- arch/arm64/kvm/vgic/vgic-its.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 060605fba3b6..8e11859ff803 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -1140,8 +1140,9 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its, u8 num_eventid_bits = its_cmd_get_size(its_cmd); gpa_t itt_addr = its_cmd_get_ittaddr(its_cmd); struct its_device *device; + gpa_t gpa; - if (!vgic_its_check_id(its, its->baser_device_table, device_id, NULL)) + if (!vgic_its_check_id(its, its->baser_device_table, device_id, &gpa)) return E_ITS_MAPD_DEVICE_OOR; if (valid && num_eventid_bits > VITS_TYPER_IDBITS) @@ -1161,8 +1162,14 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its, * The spec does not say whether unmapping a not-mapped device * is an error, so we are done in any case. */ - if (!valid) + if (!valid) { + int dte_esz = vgic_its_get_abi(its)->dte_esz; + u64 val = 0; + + BUG_ON(dte_esz > sizeof(val)); + vgic_write_guest_lock(kvm, gpa, &val, dte_esz); return 0; + } device = vgic_its_alloc_device(its, device_id, itt_addr, num_eventid_bits); From patchwork Thu Jun 20 13:06:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kunkun Jiang X-Patchwork-Id: 13705471 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DCAE6C27C79 for ; Thu, 20 Jun 2024 13:07:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date :Subject:CC:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=8G0onaMl61RCKeEFOvlO76TZ4qI/5zNE9Jkvyco6z/Y=; b=xvnv6LDkPQpKJhPP/4ov16/ZwV AASF5cY+TGsikshboYZaU96oijlWuzl5xmWPp2/Lc691U8oS0y/wZ8znt856FmtKqSfqHoln+FPvx qcrLnDPvX9iGQTLdiflYbv03RW/70d9ChP4N4lrppzOt+3NFQFF8AiYLgz09WgZ+waSt5J0nPMEaT TBESdsXYRAXM4j8/sXu2/XhvImNJmD4YmTHBGdOx6U9B/0neiOT5tA9JaHQdsMY6NY3+qe/PGGFTm kk3zpwsdvAVn7fAoa58PGca/lHckB7AYueK6o7YixTtzHMhEoThIrTxU8sEz6VebKNtvvfccuogbu lNdOwGRQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKHVi-000000055su-0P8D; Thu, 20 Jun 2024 13:07:30 +0000 Received: from szxga04-in.huawei.com ([45.249.212.190]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKHVW-000000055mY-0716 for linux-arm-kernel@lists.infradead.org; Thu, 20 Jun 2024 13:07:20 +0000 Received: from mail.maildlp.com (unknown [172.19.88.214]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4W4gfP4bL6z1ytV1; Thu, 20 Jun 2024 21:03:41 +0800 (CST) Received: from kwepemm600007.china.huawei.com (unknown [7.193.23.208]) by mail.maildlp.com (Postfix) with ESMTPS id 264821A016C; Thu, 20 Jun 2024 21:07:15 +0800 (CST) Received: from DESKTOP-6NKE0BC.china.huawei.com (10.174.185.210) by kwepemm600007.china.huawei.com (7.193.23.208) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.39; Thu, 20 Jun 2024 21:07:13 +0800 From: Kunkun Jiang To: Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , Randy Dunlap , Eric Auger CC: , , , Kunkun Jiang , Subject: [PATCH 3/3] KVM: arm64: vgic-its: Clear ite when discard frees an ite Date: Thu, 20 Jun 2024 21:06:50 +0800 Message-ID: <20240620130650.1279-4-jiangkunkun@huawei.com> X-Mailer: git-send-email 2.26.2.windows.1 In-Reply-To: <20240620130650.1279-1-jiangkunkun@huawei.com> References: <20240620130650.1279-1-jiangkunkun@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.174.185.210] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemm600007.china.huawei.com (7.193.23.208) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240620_060718_260545_A7E4634A X-CRM114-Status: GOOD ( 10.54 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org When discard frees an ite, we do not invalidate the corresponding ite. In the scenario of continuous save and restore, there may be a situation where an ite is not saved but is restored. This is unreasonable and may cause restore to fail. This patch clears the corresponding ite when discard frees a ite. Link: https://lore.kernel.org/kvmarm/8f9d74fc-f9d9-43ac-a387-91ff804cfaf1@redhat.com/ Signed-off-by: Kunkun Jiang --- arch/arm64/kvm/vgic/vgic-its.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 8e11859ff803..a10516ff760a 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -782,6 +782,10 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its, ite = find_ite(its, device_id, event_id); if (ite && its_is_collection_mapped(ite->collection)) { + struct its_device *device = find_its_device(its, device_id); + int ite_esz = vgic_its_get_abi(its)->ite_esz; + gpa_t gpa = device->itt_addr + ite->event_id * ite_esz; + u64 val = 0; /* * Though the spec talks about removing the pending state, we * don't bother here since we clear the ITTE anyway and the @@ -790,6 +794,9 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its, vgic_its_invalidate_cache(its); its_free_ite(kvm, ite); + + BUG_ON(ite_esz > sizeof(val)); + vgic_write_guest_lock(kvm, gpa, &val, ite_esz); return 0; }