Message ID | 20240726235234.228822-34-seanjc@google.com |
---|---|
State | New |
Headers | show
Return-Path: <kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org> X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=Sa+DBff3; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20230601 header.b=ViVkUxx3; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4WW4fp0RSDz1yY9 for <incoming@patchwork.ozlabs.org>; Sat, 27 Jul 2024 10:06:42 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Reply-To:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID :References:Mime-Version:In-Reply-To:Date:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=2jtDQImwvlF+dTu/7duuerX54RQs6JocdEV+48D1hDo=; b=Sa+DBff3lN75kF hH1CYYBeXR49SSjNNL/CeZJzE7Dty9oCeNmRLGcbp0vX2UqCZ6ZC9o5tZuth1lYN85fkYui/fj6QU yo7BIBl2ENITsPJCpilL/bv9GjLNyxASNRpD5iMAyF0b2us8IIDvcLLRP3bvvS+GXYNtcZSZAZqso XRHJS2ZnsyMnOG48tEy3n/bK1YAdrpd7M7jS+4hyUzBXeB2bzzPwWsPopyPIk3RF0yeePXPRxDpNd p12GDTmx4RGzmQ8dZ9bBoWu3LBhSZyw+djF9vxfJKdX0gvuoPcl5cooz1/iGLu4+9Vpzn2J5ozevw zLzeLam0wAEPiU1ecufw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sXUxM-00000005XHq-3BqD; Sat, 27 Jul 2024 00:06:40 +0000 Received: from mail-yw1-f201.google.com ([209.85.128.201]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sXUku-00000005Q2j-0d87 for kvm-riscv@lists.infradead.org; Fri, 26 Jul 2024 23:53:50 +0000 Received: by mail-yw1-f201.google.com with SMTP id 00721157ae682-66b8faa2a4aso7057717b3.0 for <kvm-riscv@lists.infradead.org>; Fri, 26 Jul 2024 16:53:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1722038026; x=1722642826; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=TLCx2qDCvkD9gyhhD5S2JLlOeuoeLAn7xH7FruJz3kQ=; b=ViVkUxx3zfWX1yD6qzk5hPWzIEjkXj8anpcFGSg2HFKjPFXWLz28h5jJT+y9/W+XSq Mj1mgTdh1bOa8RPk001AHy0jep4nsL6sCKis+wtlc+BI5youohH3VEMS4UMccor+0bIO RxdaAMHAoD0lwMuhL9cKJuzj+CCtXFjttHgqCHqVQ63RE4jX3Y17mhEQX5ldahrN/Wf0 W1F/xI/h2fR1P9Wa3MFNhJXK7qOK0hAjG89lVyjqf9SBoBy8TaHB8EuBUmL0vVZde6qu B4y1UG7EsYwM2labztv9XN+dXN5giJ9SyLySkrXHmTn4YBxkHms7mvskXKVIEsjXTlmC zzew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722038026; x=1722642826; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=TLCx2qDCvkD9gyhhD5S2JLlOeuoeLAn7xH7FruJz3kQ=; b=NRyJqbBZp0kp2RNiHHMGs6Ao6O61TiMGbvkWapbs4Xd6ARR7EMIabmWuqZHeV//851 CxfFdvmQK3waohylyEEgM5HR/ZOfjb/AHzU1Lr7BVGsUBp5s0Osxa0QEq8wuinbKbvXS kOwcHypEfkV/QRDhdmIpTFQ0YpblX3zcRE9YMnCiQ71B4dB0VEejbWlrxZbkLhYO7S6n BrQAjeU1MWJ8WxfIOjkIK1xOIQNRFMXsTiimFDXGRuO9sb9g8c9i1/yzgj4feEWmTl1e gqqK5cd34/Rifx2P7r4ohRw18bIEK4nT5LkrIdHanB+oB0keSHbS3jpLddNNyqJ0Fxcp LJqw== X-Forwarded-Encrypted: i=1; AJvYcCXIbtY0XpWTmtbMLtyCwSlBHm1tsyaiAYgW3tkTyLhnWsr2m8ExjGJuH+fLPxaz9pdP7zTULCrMt6K6z90Nw3nbWBptC8IczoOB5VrCCg== X-Gm-Message-State: AOJu0YzaYuNNsaFhPDcIoKtbo26p1mxhPNjBlj/75JwwNSIzhG28S8CZ lGOZxXgrOdZiQfdHSM2jGkag6IpecIG6gWg+QQ2gVgzvpcqmpCfSV6iorHdH097U/8J/Re2Z9// H3Q== X-Google-Smtp-Source: AGHT+IFuGqnDYAUSJ5FmVd85CGAsbS7YYsLTPQN/3Ul7QhkRMd8+dVyQHeeD8wiMpZyrbrthnX4Q+b9wtNM= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6902:1005:b0:e0b:f93:fe8c with SMTP id 3f1490d57ef6-e0b5427fa67mr79832276.0.1722038025699; Fri, 26 Jul 2024 16:53:45 -0700 (PDT) Date: Fri, 26 Jul 2024 16:51:42 -0700 In-Reply-To: <20240726235234.228822-1-seanjc@google.com> Mime-Version: 1.0 References: <20240726235234.228822-1-seanjc@google.com> X-Mailer: git-send-email 2.46.0.rc1.232.g9752f9e123-goog Message-ID: <20240726235234.228822-34-seanjc@google.com> Subject: [PATCH v12 33/84] KVM: Disallow direct access (w/o mmu_notifier) to unpinned pfn by default From: Sean Christopherson <seanjc@google.com> To: Paolo Bonzini <pbonzini@redhat.com>, Marc Zyngier <maz@kernel.org>, Oliver Upton <oliver.upton@linux.dev>, Tianrui Zhao <zhaotianrui@loongson.cn>, Bibo Mao <maobibo@loongson.cn>, Huacai Chen <chenhuacai@kernel.org>, Michael Ellerman <mpe@ellerman.id.au>, Anup Patel <anup@brainfault.org>, Paul Walmsley <paul.walmsley@sifive.com>, Palmer Dabbelt <palmer@dabbelt.com>, Albert Ou <aou@eecs.berkeley.edu>, Christian Borntraeger <borntraeger@linux.ibm.com>, Janosch Frank <frankja@linux.ibm.com>, Claudio Imbrenda <imbrenda@linux.ibm.com>, Sean Christopherson <seanjc@google.com> Cc: kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, loongarch@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, David Matlack <dmatlack@google.com>, David Stevens <stevensd@chromium.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240726_165348_276688_F6463301 X-CRM114-Status: GOOD ( 15.67 ) X-Spam-Score: -9.5 (---------) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Add an off-by-default module param to control whether or not KVM is allowed to map memory that isn't pinned, i.e. that KVM can't guarantee won't be freed while it is mapped into KVM and/or the guest. [...] Content analysis details: (-9.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [209.85.128.201 listed in list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM welcome-list 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.128.201 listed in wl.mailspike.net] -0.0 DKIMWL_WL_MED DKIMwl.org - Medium trust sender X-BeenThere: kvm-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: <kvm-riscv.lists.infradead.org> List-Unsubscribe: <http://lists.infradead.org/mailman/options/kvm-riscv>, <mailto:kvm-riscv-request@lists.infradead.org?subject=unsubscribe> List-Archive: <http://lists.infradead.org/pipermail/kvm-riscv/> List-Post: <mailto:kvm-riscv@lists.infradead.org> List-Help: <mailto:kvm-riscv-request@lists.infradead.org?subject=help> List-Subscribe: <http://lists.infradead.org/mailman/listinfo/kvm-riscv>, <mailto:kvm-riscv-request@lists.infradead.org?subject=subscribe> Reply-To: Sean Christopherson <seanjc@google.com> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kvm-riscv" <kvm-riscv-bounces@lists.infradead.org> Errors-To: kvm-riscv-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org |
Series |
KVM: Stop grabbing references to PFNMAP'd pages
|
expand
|
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index a28479629488..0b3c0bddaa07 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -94,6 +94,13 @@ unsigned int halt_poll_ns_shrink = 2; module_param(halt_poll_ns_shrink, uint, 0644); EXPORT_SYMBOL_GPL(halt_poll_ns_shrink); +/* + * Allow direct access (from KVM or the CPU) without MMU notifier protection + * to unpinned pages. + */ +static bool allow_unsafe_mappings; +module_param(allow_unsafe_mappings, bool, 0444); + /* * Ordering of locks: * @@ -2821,6 +2828,9 @@ static kvm_pfn_t kvm_resolve_pfn(struct kvm_follow_pfn *kfp, struct page *page, * reference to such pages would cause KVM to prematurely free a page * it doesn't own (KVM gets and puts the one and only reference). * Don't allow those pages until the FIXME is resolved. + * + * Don't grab a reference for pins, callers that pin pages are required + * to check refcounted_page, i.e. must not blindly release the pfn. */ if (pte) { pfn = pte_pfn(*pte); @@ -2942,6 +2952,14 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma, bool write_fault = kfp->flags & FOLL_WRITE; int r; + /* + * Remapped memory cannot be pinned in any meaningful sense. Bail if + * the caller wants to pin the page, i.e. access the page outside of + * MMU notifier protection, and unsafe umappings are disallowed. + */ + if (kfp->pin && !allow_unsafe_mappings) + return -EINVAL; + r = follow_pte(vma, kfp->hva, &ptep, &ptl); if (r) { /*
Add an off-by-default module param to control whether or not KVM is allowed to map memory that isn't pinned, i.e. that KVM can't guarantee won't be freed while it is mapped into KVM and/or the guest. Don't remove the functionality entirely, as there are use cases where mapping unpinned memory is safe (as defined by the platform owner), e.g. when memory is hidden from the kernel and managed by userspace, in which case userspace is already fully trusted to not muck with guest memory mappings. But for more typical setups, mapping unpinned memory is wildly unsafe, and unnecessary. The APIs are used exclusively by x86's nested virtualization support, and there is no known (or sane) use case for mapping PFN-mapped memory a KVM guest _and_ letting the guest use it for virtualization structures. Signed-off-by: Sean Christopherson <seanjc@google.com> --- virt/kvm/kvm_main.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)