From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A0A98C77B75 for ; Mon, 22 May 2023 10:49:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Subject:Cc:To:From:Message-ID:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=bqF54UzYmR1v/CdAtAh4su+BhUm46OxP452cxCfOEPk=; b=Ta9dPaGtzpR73W o+sFKkz8HMAkJRCz/wpHGBOshDk0iYTh+QfStxi3C3lBEPc97lI++15HqMjjOjksDZ3b/HbxcYRyj ftGRnsccSJA1mKFmpqWrnEUuZJdINv/+JiCU3CUIgNQE/0SX8hTG/VjotgIH464z5VY4ls4YMyuoT sSjG/RgsJLvsMPHTmvCiGbfRNeT0Bd70+Vhms/4QtcuG1tHmInkk/IJY0auMADBCBEDsT5BoHTccw wNbxTjywFuiRSqGHkRazqCBzVO/Cdax26K5ZR+TOmgwo8FpiARbn1hUTdgx5zCoax8I8Tz9NK02oz ZD4twOQHT1e27b/CKMqQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1q135s-0066cL-18; Mon, 22 May 2023 10:48:48 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1q135o-0066YQ-2u for linux-arm-kernel@lists.infradead.org; Mon, 22 May 2023 10:48:46 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 14C0361123; Mon, 22 May 2023 10:48:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68996C433EF; Mon, 22 May 2023 10:48:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684752521; bh=A1L3YalSebFB+1IUyh1HO6NRZbTrCyfLglCVg0HfHD4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=FpBcqAt+tA3YxpY8BJAyJwBq0YcIRqWtWkpbsS8wce+q26GJYqg9X9wrpkOiM4q5w ZHF3hg4p4FWKIHxCs+DISKN3gNUZR1R4ifGSD6EHie6dyKSxSB/GE25WFdrkGYbPdO iCL1izYOoVIbf/UDcrwbj8HHhElDptnb5cXw8xkzgTf00S//GO7ByCFw+sY/gq1Ez3 eh6nakGOgA88uOhy2r8fb8TEIHX9eXJN0n2y0hnQ1vZhoViXxO81y39jKhaKnAv45G joiTQhobYcrJQUiUitqGlbMMc4c3WfAORCkv4ct4BZBZcE+AdAYE/aubfRx4bMMZqx ls2nKm7dnr9Vg== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1q135j-00H12R-2S; Mon, 22 May 2023 11:48:39 +0100 Date: Mon, 22 May 2023 11:48:38 +0100 Message-ID: <86a5xwljzt.wl-maz@kernel.org> From: Marc Zyngier To: Fuad Tabba Cc: kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, james.morse@arm.com, catalin.marinas@arm.com, alexandru.elisei@arm.com, oliver.upton@linux.dev, suzuki.poulose@arm.com, yuzenghui@huawei.com, will@kernel.org, reijiw@google.com, ricarkol@google.com, dmatlack@google.com, qperret@google.com, bgardon@google.com, gshan@redhat.com, peterx@redhat.com, seanjc@google.com Subject: Re: [PATCH] KVM: arm64: Reload PTE after invoking walker callback on preorder traversal In-Reply-To: <20230522103258.402272-1-tabba@google.com> References: <20230522103258.402272-1-tabba@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/28.2 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: tabba@google.com, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, james.morse@arm.com, catalin.marinas@arm.com, alexandru.elisei@arm.com, oliver.upton@linux.dev, suzuki.poulose@arm.com, yuzenghui@huawei.com, will@kernel.org, reijiw@google.com, ricarkol@google.com, dmatlack@google.com, qperret@google.com, bgardon@google.com, gshan@redhat.com, peterx@redhat.com, seanjc@google.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230522_034845_046269_B5EAD3BB X-CRM114-Status: GOOD ( 31.69 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Fuad, On Mon, 22 May 2023 11:32:58 +0100, Fuad Tabba wrote: > > The preorder callback on the kvm_pgtable_stage2_map() path can replace > a table with a block, then recursively free the detached table. The > higher-level walking logic stashes the old page table entry and > then walks the freed table, invoking the leaf callback and > potentially freeing pgtable pages prematurely. > > In normal operation, the call to tear down the detached stage-2 > is indirected and uses an RCU callback to trigger the freeing. > RCU is not available to pKVM, which is where this bug is > triggered. > > Change the behavior of the walker to reload the page table entry > after invoking the walker callback on preorder traversal, as it > does for leaf entries. Thanks for the fix and the detailed explanation. A couple of nits, none of which deserve a respin on their own (I can fix up things when applying the patch). > > Tested on Pixel 6. > > Fixes: 5c359cca1faf ("KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make") > Spurious empty line. In general, please keep the trailers grouped together, as it otherwise tends to confuse git-interpret-trailers. > Suggested-by: Oliver Upton > Signed-off-by: Fuad Tabba > > --- > > Based on: f1fcbaa18b28 (6.4-rc2) > > The bug can be triggered by applying Will's FFA series [1] to > android mainline [2] and booting a Pixel 6 in protected mode > (pKVM). > > [1] 20230419122051.1341-1-will@kernel.org > [2] https://android.googlesource.com/kernel/common/+/refs/tags/android-mainline-6.3 > --- > arch/arm64/include/asm/kvm_pgtable.h | 6 +++--- > arch/arm64/kvm/hyp/pgtable.c | 14 +++++++++++++- > 2 files changed, 16 insertions(+), 4 deletions(-) > > diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h > index 4cd6762bda80..3664f1d85ce6 100644 > --- a/arch/arm64/include/asm/kvm_pgtable.h > +++ b/arch/arm64/include/asm/kvm_pgtable.h > @@ -631,9 +631,9 @@ int kvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size); > * > * The walker will walk the page-table entries corresponding to the input > * address range specified, visiting entries according to the walker flags. > - * Invalid entries are treated as leaf entries. Leaf entries are reloaded > - * after invoking the walker callback, allowing the walker to descend into > - * a newly installed table. > + * Invalid entries are treated as leaf entries. The visited page table entry is > + * reloaded after invoking the walker callback, allowing the walker to descend > + * into a newly installed table. > * > * Returning a negative error code from the walker callback function will > * terminate the walk immediately with the same error code. > diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c > index 3d61bd3e591d..120c49d52ca0 100644 > --- a/arch/arm64/kvm/hyp/pgtable.c > +++ b/arch/arm64/kvm/hyp/pgtable.c > @@ -207,14 +207,26 @@ static inline int __kvm_pgtable_visit(struct kvm_pgtable_walk_data *data, > .flags = flags, > }; > int ret = 0; > + bool reload = false; > kvm_pteref_t childp; > bool table = kvm_pte_table(ctx.old, level); > > - if (table && (ctx.flags & KVM_PGTABLE_WALK_TABLE_PRE)) > + if (table && (ctx.flags & KVM_PGTABLE_WALK_TABLE_PRE)) { > ret = kvm_pgtable_visitor_cb(data, &ctx, KVM_PGTABLE_WALK_TABLE_PRE); > + reload = true; > + } > > if (!table && (ctx.flags & KVM_PGTABLE_WALK_LEAF)) { > ret = kvm_pgtable_visitor_cb(data, &ctx, KVM_PGTABLE_WALK_LEAF); > + reload = true; > + } >From these two clauses, it is clear that reload is always the value of (ctx.flags & KVM_PGTABLE_WALK_LEAF). That'd simplify the patch a bit. > + > + /* > + * Reload the page table after invoking the walker callback for leaf > + * entries or after pre-order traversal, to allow the walker to descend > + * into a newly installed or replaced table. > + */ > + if (reload) { > ctx.old = READ_ONCE(*ptep); > table = kvm_pte_table(ctx.old, level); > } > Thanks, M. -- Without deviation from the norm, progress is not possible. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel