From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EC85C2D0E4 for ; Sun, 15 Nov 2020 17:04:09 +0000 (UTC) Received: from mm01.cs.columbia.edu (mm01.cs.columbia.edu [128.59.11.253]) by mail.kernel.org (Postfix) with ESMTP id 983562244C for ; Sun, 15 Nov 2020 17:04:08 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="tWwIjkCo" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 983562244C Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvmarm-bounces@lists.cs.columbia.edu Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 106864BEEF; Sun, 15 Nov 2020 12:04:08 -0500 (EST) X-Virus-Scanned: at lists.cs.columbia.edu Authentication-Results: mm01.cs.columbia.edu (amavisd-new); dkim=softfail (fail, message has been altered) header.i=@kernel.org Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3unvc8e8-VuA; Sun, 15 Nov 2020 12:04:06 -0500 (EST) Received: from mm01.cs.columbia.edu (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id DC7F94BED3; Sun, 15 Nov 2020 12:04:06 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 79BAC4BEC5 for ; Sun, 15 Nov 2020 12:04:05 -0500 (EST) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3yEZMQcJTGZx for ; Sun, 15 Nov 2020 12:04:04 -0500 (EST) Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id 9064F4BE9E for ; Sun, 15 Nov 2020 12:04:04 -0500 (EST) Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3A7F2223FB; Sun, 15 Nov 2020 17:04:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1605459843; bh=47Yg3gRFv07hkRm946gKdQt9gA1sJtG0nNWa6xf0C/4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=tWwIjkCozPQsYmXmcuNE1AUahp+dOfl95+iNZIM/P4bLp6VYNMnrBqlIjVkkNBWwo 9rH+4FQExc4s+GkE5zlJMIUKciQYYg3xxPlWXX34AKG9HdThv7oI6qL6LAFza+Uy85 k//45RpJvVLbH9IPaJYsbqpAEUXv+o0cLsa68o4M= Received: from disco-boy.misterjones.org ([51.254.78.96] helo=www.loen.fr) by disco-boy.misterjones.org with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1keLRZ-00AoQd-Ho; Sun, 15 Nov 2020 17:04:01 +0000 MIME-Version: 1.0 Date: Sun, 15 Nov 2020 17:04:01 +0000 From: Marc Zyngier To: Zenghui Yu Subject: Re: [PATCH 1/2] KVM: arm64: vgic: Forbid invalid userspace Redistributor accesses In-Reply-To: <20201113142801.1659-2-yuzenghui@huawei.com> References: <20201113142801.1659-1-yuzenghui@huawei.com> <20201113142801.1659-2-yuzenghui@huawei.com> User-Agent: Roundcube Webmail/1.4.9 Message-ID: <724c43702b52aac0d3c9beb9604d1bfb@kernel.org> X-Sender: maz@kernel.org X-SA-Exim-Connect-IP: 51.254.78.96 X-SA-Exim-Rcpt-To: yuzenghui@huawei.com, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, eric.auger@redhat.com, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, wanghaibin.wang@huawei.com, zhukeqian1@huawei.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu X-BeenThere: kvmarm@lists.cs.columbia.edu X-Mailman-Version: 2.1.14 Precedence: list List-Id: Where KVM/ARM decisions are made List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu Hi Zenghui, On 2020-11-13 14:28, Zenghui Yu wrote: > It's expected that users will access registers in the redistributor > *if* > the RD has been initialized properly. Unfortunately userspace can be > bogus > enough to access registers before setting the RD base address, and KVM > implicitly allows it (we handle the access anyway, regardless of > whether > the base address is set). > > Bad thing happens when we're handling the user read of GICR_TYPER. We > end > up with an oops when deferencing the unset rdreg... > > gpa_t last_rdist_typer = rdreg->base + GICR_TYPER + > (rdreg->free_index - 1) * KVM_VGIC_V3_REDIST_SIZE; > > Fix this issue by informing userspace what had gone wrong (-ENXIO). I'm worried about the "implicit" aspect of the access that this patch now forbids. The problem is that the existing documentation doesn't cover this case, and -ENXIO's "Getting or setting this register is not yet supported" is way too vague. There is a precedent with the ITS, but that's undocumented as well. Also, how about v2? If that's the wasy we are going to fix this, we also nned to beef up the documentation. Of course, the other horrible way to address the issue is to return a value that doesn't have the Last bit set, since we can't synthetise it. It doesn't change the userspace API, and I can even find some (admittedly twisted) logic to it (since there is no base address, there is no last RD...). Thoughts? M. -- Jazz is not dead. It just smells funny... _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1F1DC2D0E4 for ; Sun, 15 Nov 2020 17:05:00 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 7C224223FB for ; Sun, 15 Nov 2020 17:05:00 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="B0MZqtBm"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="tWwIjkCo" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7C224223FB Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Type: Content-Transfer-Encoding:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Message-ID:References:In-Reply-To:Subject:To:From: Date:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=R5LC5g8ViSjaRF6waKFC/JUpal6YVZs+W82oirTVhkM=; b=B0MZqtBmLOuv6Dm+po2CqFjNe Z1ouZmgUI4p7g5nqArxwpHhuDOdnubVYYQ7IyVZmEedlH4p4h7ba0yOVBBdMI33Cdx6mD1Obiy5AQ OS9boHkZf2HyLuKT7/pNmij/jmbuduC944gQ3YujieVQRPI1O+si0uD7gQt65eNwCa5hk7YTJAtxL R0Pm5SCMY9cY2XUMDU9ncFm9J2cnNFu5O7AAlWlG6FUamntbg+C1juwO3odCv4zFayYvyDPNRCRgy O6UVZw1ivrEJf29rKw9nFxJlGjso+Ih3xJ7gyU4Qxd1d8vzSjhIK9vLS2dQSJAjgiJqSh5NZaBP20 PdQowr+FQ==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1keLRg-0006Dd-Ou; Sun, 15 Nov 2020 17:04:08 +0000 Received: from mail.kernel.org ([198.145.29.99]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1keLRd-0006DI-Cl for linux-arm-kernel@lists.infradead.org; Sun, 15 Nov 2020 17:04:06 +0000 Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3A7F2223FB; Sun, 15 Nov 2020 17:04:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1605459843; bh=47Yg3gRFv07hkRm946gKdQt9gA1sJtG0nNWa6xf0C/4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=tWwIjkCozPQsYmXmcuNE1AUahp+dOfl95+iNZIM/P4bLp6VYNMnrBqlIjVkkNBWwo 9rH+4FQExc4s+GkE5zlJMIUKciQYYg3xxPlWXX34AKG9HdThv7oI6qL6LAFza+Uy85 k//45RpJvVLbH9IPaJYsbqpAEUXv+o0cLsa68o4M= Received: from disco-boy.misterjones.org ([51.254.78.96] helo=www.loen.fr) by disco-boy.misterjones.org with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1keLRZ-00AoQd-Ho; Sun, 15 Nov 2020 17:04:01 +0000 MIME-Version: 1.0 Date: Sun, 15 Nov 2020 17:04:01 +0000 From: Marc Zyngier To: Zenghui Yu Subject: Re: [PATCH 1/2] KVM: arm64: vgic: Forbid invalid userspace Redistributor accesses In-Reply-To: <20201113142801.1659-2-yuzenghui@huawei.com> References: <20201113142801.1659-1-yuzenghui@huawei.com> <20201113142801.1659-2-yuzenghui@huawei.com> User-Agent: Roundcube Webmail/1.4.9 Message-ID: <724c43702b52aac0d3c9beb9604d1bfb@kernel.org> X-Sender: maz@kernel.org X-SA-Exim-Connect-IP: 51.254.78.96 X-SA-Exim-Rcpt-To: yuzenghui@huawei.com, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, eric.auger@redhat.com, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, wanghaibin.wang@huawei.com, zhukeqian1@huawei.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201115_120405_613276_EC34CC3B X-CRM114-Status: GOOD ( 17.50 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: suzuki.poulose@arm.com, linux-kernel@vger.kernel.org, eric.auger@redhat.com, james.morse@arm.com, linux-arm-kernel@lists.infradead.org, wanghaibin.wang@huawei.com, Keqian Zhu , kvmarm@lists.cs.columbia.edu, julien.thierry.kdev@gmail.com Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Zenghui, On 2020-11-13 14:28, Zenghui Yu wrote: > It's expected that users will access registers in the redistributor > *if* > the RD has been initialized properly. Unfortunately userspace can be > bogus > enough to access registers before setting the RD base address, and KVM > implicitly allows it (we handle the access anyway, regardless of > whether > the base address is set). > > Bad thing happens when we're handling the user read of GICR_TYPER. We > end > up with an oops when deferencing the unset rdreg... > > gpa_t last_rdist_typer = rdreg->base + GICR_TYPER + > (rdreg->free_index - 1) * KVM_VGIC_V3_REDIST_SIZE; > > Fix this issue by informing userspace what had gone wrong (-ENXIO). I'm worried about the "implicit" aspect of the access that this patch now forbids. The problem is that the existing documentation doesn't cover this case, and -ENXIO's "Getting or setting this register is not yet supported" is way too vague. There is a precedent with the ITS, but that's undocumented as well. Also, how about v2? If that's the wasy we are going to fix this, we also nned to beef up the documentation. Of course, the other horrible way to address the issue is to return a value that doesn't have the Last bit set, since we can't synthetise it. It doesn't change the userspace API, and I can even find some (admittedly twisted) logic to it (since there is no base address, there is no last RD...). Thoughts? M. -- Jazz is not dead. It just smells funny... _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B91BBC61DD8 for ; Sun, 15 Nov 2020 17:04:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 81D72223FB for ; Sun, 15 Nov 2020 17:04:25 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="tWwIjkCo" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727201AbgKOREE (ORCPT ); Sun, 15 Nov 2020 12:04:04 -0500 Received: from mail.kernel.org ([198.145.29.99]:57224 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726998AbgKORED (ORCPT ); Sun, 15 Nov 2020 12:04:03 -0500 Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3A7F2223FB; Sun, 15 Nov 2020 17:04:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1605459843; bh=47Yg3gRFv07hkRm946gKdQt9gA1sJtG0nNWa6xf0C/4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=tWwIjkCozPQsYmXmcuNE1AUahp+dOfl95+iNZIM/P4bLp6VYNMnrBqlIjVkkNBWwo 9rH+4FQExc4s+GkE5zlJMIUKciQYYg3xxPlWXX34AKG9HdThv7oI6qL6LAFza+Uy85 k//45RpJvVLbH9IPaJYsbqpAEUXv+o0cLsa68o4M= Received: from disco-boy.misterjones.org ([51.254.78.96] helo=www.loen.fr) by disco-boy.misterjones.org with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1keLRZ-00AoQd-Ho; Sun, 15 Nov 2020 17:04:01 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Sun, 15 Nov 2020 17:04:01 +0000 From: Marc Zyngier To: Zenghui Yu Cc: kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, eric.auger@redhat.com, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, wanghaibin.wang@huawei.com, Keqian Zhu Subject: Re: [PATCH 1/2] KVM: arm64: vgic: Forbid invalid userspace Redistributor accesses In-Reply-To: <20201113142801.1659-2-yuzenghui@huawei.com> References: <20201113142801.1659-1-yuzenghui@huawei.com> <20201113142801.1659-2-yuzenghui@huawei.com> User-Agent: Roundcube Webmail/1.4.9 Message-ID: <724c43702b52aac0d3c9beb9604d1bfb@kernel.org> X-Sender: maz@kernel.org X-SA-Exim-Connect-IP: 51.254.78.96 X-SA-Exim-Rcpt-To: yuzenghui@huawei.com, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, eric.auger@redhat.com, james.morse@arm.com, julien.thierry.kdev@gmail.com, suzuki.poulose@arm.com, wanghaibin.wang@huawei.com, zhukeqian1@huawei.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Zenghui, On 2020-11-13 14:28, Zenghui Yu wrote: > It's expected that users will access registers in the redistributor > *if* > the RD has been initialized properly. Unfortunately userspace can be > bogus > enough to access registers before setting the RD base address, and KVM > implicitly allows it (we handle the access anyway, regardless of > whether > the base address is set). > > Bad thing happens when we're handling the user read of GICR_TYPER. We > end > up with an oops when deferencing the unset rdreg... > > gpa_t last_rdist_typer = rdreg->base + GICR_TYPER + > (rdreg->free_index - 1) * KVM_VGIC_V3_REDIST_SIZE; > > Fix this issue by informing userspace what had gone wrong (-ENXIO). I'm worried about the "implicit" aspect of the access that this patch now forbids. The problem is that the existing documentation doesn't cover this case, and -ENXIO's "Getting or setting this register is not yet supported" is way too vague. There is a precedent with the ITS, but that's undocumented as well. Also, how about v2? If that's the wasy we are going to fix this, we also nned to beef up the documentation. Of course, the other horrible way to address the issue is to return a value that doesn't have the Last bit set, since we can't synthetise it. It doesn't change the userspace API, and I can even find some (admittedly twisted) logic to it (since there is no base address, there is no last RD...). Thoughts? M. -- Jazz is not dead. It just smells funny...