From: Kunkun Jiang jiangkunkun@huawei.com

commit e9649129d33dca561305fc590a7c4ba8c3e5675a upstream.

vgic_its_save_device_tables will traverse its->device_list to save DTE for each device. vgic_its_restore_device_tables will traverse each entry of device table and check if it is valid. Restore if valid.

But when MAPD unmaps a device, it does not invalidate the corresponding DTE. In the scenario of continuous saves and restores, there may be a situation where a device's DTE is not saved but is restored. This is unreasonable and may cause restore to fail. This patch clears the corresponding DTE when MAPD unmaps a device.

Cc: stable@vger.kernel.org Fixes: 57a9a117154c ("KVM: arm64: vgic-its: Device table save/restore") Co-developed-by: Shusen Li lishusen2@huawei.com Signed-off-by: Shusen Li lishusen2@huawei.com Signed-off-by: Kunkun Jiang jiangkunkun@huawei.com [Jing: Update with entry write helper] Signed-off-by: Jing Zhang jingzhangos@google.com Link: https://lore.kernel.org/r/20241107214137.428439-5-jingzhangos@google.com Signed-off-by: Oliver Upton oliver.upton@linux.dev --- arch/arm64/kvm/vgic/vgic-its.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index bff7c49dfda5..e1b2bbfe1fef 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -1182,9 +1182,11 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its, bool valid = its_cmd_get_validbit(its_cmd); u8 num_eventid_bits = its_cmd_get_size(its_cmd); gpa_t itt_addr = its_cmd_get_ittaddr(its_cmd); + int dte_esz = vgic_its_get_abi(its)->dte_esz; struct its_device *device; + gpa_t gpa;

- if (!vgic_its_check_id(its, its->baser_device_table, device_id, NULL)) + if (!vgic_its_check_id(its, its->baser_device_table, device_id, &gpa)) return E_ITS_MAPD_DEVICE_OOR;

if (valid && num_eventid_bits > VITS_TYPER_IDBITS) @@ -1205,7 +1207,7 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its, * is an error, so we are done in any case. */ if (!valid) - return 0; + return vgic_its_write_entry_lock(its, gpa, 0, dte_esz);

device = vgic_its_alloc_device(its, device_id, itt_addr, num_eventid_bits);

From: Kunkun Jiang jiangkunkun@huawei.com

commit 7602ffd1d5e8927fadd5187cb4aed2fdc9c47143 upstream.

When DISCARD frees an ITE, it does not invalidate the corresponding ITE. In the scenario of continuous saves and restores, there may be a situation where an ITE is not saved but is restored. This is unreasonable and may cause restore to fail. This patch clears the corresponding ITE when DISCARD frees an ITE.

Cc: stable@vger.kernel.org Fixes: eff484e0298d ("KVM: arm64: vgic-its: ITT save and restore") Signed-off-by: Kunkun Jiang jiangkunkun@huawei.com [Jing: Update with entry write helper] Signed-off-by: Jing Zhang jingzhangos@google.com Link: https://lore.kernel.org/r/20241107214137.428439-6-jingzhangos@google.com Signed-off-by: Oliver Upton oliver.upton@linux.dev --- arch/arm64/kvm/vgic/vgic-its.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index e1b2bbfe1fef..4890131c87ef 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -855,6 +855,9 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its,

ite = find_ite(its, device_id, event_id); if (ite && its_is_collection_mapped(ite->collection)) { + struct its_device *device = find_its_device(its, device_id); + int ite_esz = vgic_its_get_abi(its)->ite_esz; + gpa_t gpa = device->itt_addr + ite->event_id * ite_esz; /* * Though the spec talks about removing the pending state, we * don't bother here since we clear the ITTE anyway and the @@ -863,7 +866,8 @@ static int vgic_its_cmd_handle_discard(struct kvm *kvm, struct vgic_its *its, vgic_its_invalidate_cache(kvm);

its_free_ite(kvm, ite); - return 0; + + return vgic_its_write_entry_lock(its, gpa, 0, ite_esz); }

return E_ITS_DISCARD_UNMAPPED_INTERRUPT;

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022

Status in newer kernel trees: 6.12.y | Not found 6.11.y | Not found 6.6.y | Not found 6.1.y | Not found 5.15.y | Not found

Note: The patch differs from the upstream commit: --- 1: 7fe28d7e68f92 ! 1: e7bc6980df78e KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* @@ Metadata ## Commit message ## KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*

+ commit 7fe28d7e68f92cc3d0668b8f2fbdf5c303ac3022 upstream. + In all the vgic_its_save_*() functinos, they do not check whether the data length is 8 bytes before calling vgic_write_guest_lock. This patch adds the check. To prevent the kernel from being blown up @@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_ite(struct vgic_its *it ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) | ite->collection->collection_id; val = cpu_to_le64(val); -- return vgic_write_guest_lock(kvm, gpa, &val, ite_esz); +- return kvm_write_guest_lock(kvm, gpa, &val, ite_esz); + + return vgic_its_write_entry_lock(its, gpa, val, ite_esz); } @@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_dte(struct vgic_its *it (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) | (dev->num_eventid_bits - 1)); val = cpu_to_le64(val); -- return vgic_write_guest_lock(kvm, ptr, &val, dte_esz); +- return kvm_write_guest_lock(kvm, ptr, &val, dte_esz); + + return vgic_its_write_entry_lock(its, ptr, val, dte_esz); } @@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_cte(struct vgic_its *it ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) | collection->collection_id); val = cpu_to_le64(val); -- return vgic_write_guest_lock(its->dev->kvm, gpa, &val, esz); +- return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz); + + return vgic_its_write_entry_lock(its, gpa, val, esz); }

- /* + static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) @@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) u64 val; int ret; @@ arch/arm64/kvm/vgic/vgic-its.c: static int vgic_its_save_collection_table(struct */ - val = 0; - BUG_ON(cte_esz > sizeof(val)); -- ret = vgic_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); +- ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz); - return ret; + return vgic_its_write_entry_lock(its, gpa, 0, cte_esz); }

- /* + /**

## arch/arm64/kvm/vgic/vgic.h ## -@@ arch/arm64/kvm/vgic/vgic.h: static inline int vgic_write_guest_lock(struct kvm *kvm, gpa_t gpa, - return ret; +@@ + #define __KVM_ARM_VGIC_NEW_H__ + + #include <linux/irqchip/arm-gic-common.h> ++#include <asm/kvm_mmu.h> + + #define PRODUCT_ID_KVM 0x4b /* ASCII code K */ + #define IMPLEMENTER_ARM 0x43b +@@ arch/arm64/kvm/vgic/vgic.h: static inline bool vgic_irq_is_multi_sgi(struct vgic_irq *irq) + return vgic_irq_get_lr_count(irq) > 1; }

+static inline int vgic_its_read_entry_lock(struct vgic_its *its, gpa_t eaddr, @@ arch/arm64/kvm/vgic/vgic.h: static inline int vgic_write_guest_lock(struct kvm * + if (KVM_BUG_ON(esize != sizeof(eval), kvm)) + return -EINVAL; + -+ return vgic_write_guest_lock(kvm, eaddr, &eval, esize); ++ return kvm_write_guest_lock(kvm, eaddr, &eval, esize); +} + /* ---

Results of testing on various branches:

| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.15.y | Success | Success |