On 26/03/2021 18:56, Catalin Marinas wrote:
Hi Steven,
On Fri, Mar 12, 2021 at 03:18:57PM +0000, Steven Price wrote:
A KVM guest could store tags in a page even if the VMM hasn't mapped
the page with PROT_MTE. So when restoring pages from swap we will
need to check to see if there are any saved tags even if !pte_tagged().
However don't check pages which are !pte_valid_user() as these will
not have been swapped out.
Signed-off-by: Steven Price <steven.price@xxxxxxx>
---
arch/arm64/include/asm/pgtable.h | 2 +-
arch/arm64/kernel/mte.c | 16 ++++++++++++----
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index e17b96d0e4b5..84166625c989 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -312,7 +312,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
__sync_icache_dcache(pte);
if (system_supports_mte() &&
- pte_present(pte) && pte_tagged(pte) && !pte_special(pte))
+ pte_present(pte) && pte_valid_user(pte) && !pte_special(pte))
mte_sync_tags(ptep, pte);
With the EPAN patches queued in for-next/epan, pte_valid_user()
disappeared as its semantics weren't very clear.
Thanks for pointing that out.
So this relies on the set_pte_at() being done on the VMM address space.
I wonder, if the VMM did an mprotect(PROT_NONE), can the VM still access
it via stage 2? If yes, the pte_valid_user() test wouldn't work. We need
something like pte_present() && addr <= user_addr_max().
AFAIUI the stage 2 matches the VMM's address space (for the subset that
has memslots). So mprotect(PROT_NONE) would cause the stage 2 mapping to
be invalidated and a subsequent fault would exit to the VMM to sort out.
This sort of thing is done for the lazy migration use case (i.e. pages
are fetched as the VM tries to access them).
BTW, ignoring virtualisation, can we ever bring a page in from swap on a
PROT_NONE mapping (say fault-around)? It's not too bad if we keep the
metadata around for when the pte becomes accessible but I suspect we
remove it if the page is removed from swap.
There are two stages of bringing data from swap. First is populating the
swap cache by doing the physical read from swap. The second is actually
restoring the page table entries.
Clearly the first part can happen even with PROT_NONE (the simple case
is there's another mapping which is !PROT_NONE).
For the second I'm a little hazy on exactly what happens when you do a
'swapoff' - that may cause a page to be re-inserted into a page table
without a fault. If you follow the chain down from try_to_unuse() you
end up at a call to set_pte_at(). So we need set_pte_at() to handle a
PROT_NONE mapping. So I guess the test we really want here is just
(pte_val() & PTE_USER).
Steve
_______________________________________________
kvmarm mailing list
kvmarm@xxxxxxxxxxxxxxxxxxxxx
https://lists.cs.columbia.edu/mailman/listinfo/kvmarm
