Description of the Reproducer scenario as asked in the thread [1].
Tried to create the reproducer scenario with vfio-pci driver using
nvidia GPU in PT mode, As because vfio-pci driver now supports
vma faulting (/vfio_pci_mmap_fault) so could create a crude reproducer
situation with that.
To create the repro - I did an ugly hack into arm64/kvm/mmu.c.
The hack is to make sure that stage2 mapping are not created
at the time of vm_init by unsetting VM_PFNMAP flag. This `unsetting` flag
needed because vfio-pci's mmap func(/vfio_pci_mmap) by-default
sets the VM_PFNMAP flag for the MMIO region but I want
the remap_pfn_range() func to set the _PFNMAP flag via vfio's fault
handler func vfio_pci_mmap_fault().
So with above, when guest access the MMIO region, this will
trigger the mmio fault path at arm64-kvm hypervisor layer like below:
user_mem_abort() {->...
--> Check the VM_PFNMAP flag, since not set so marks force_pte=false
....
__gfn_to_pfn_memslot()-->
...
handle_mm_fault()-->
do_fault()-->
vfio_pci_mmio_fault()-->
remap_pfn_range()--> Now will set the VM_PFNMAP flag.
}
Since the force_pte flag is set to false so will lead to THP oops.
By setting the force_pte=true will avoid the THP Oops which was
mentioned in the [2] and patch proposition [1/1] fixes that.
hackish change to reproduce scenario:
--->
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index d4cd25334610..b0a999aa6a95 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1318,6 +1318,12 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
vm_start = max(hva, vma->vm_start);
vm_end = min(reg_end, vma->vm_end);
+ /* Hack to make sure stage2 mapping not present, thus trigger
+ * user_mem_abort for stage2 mapping
+ */
+ if (vma->vm_flags & VM_PFNMAP) {
+ vma->vm_flags = vma->vm_flags & (~VM_PFNMAP);
+ }
if (vma->vm_flags & VM_PFNMAP) {
gpa_t gpa = mem->guest_phys_addr +
(vm_start - mem->userspace_addr);
Thanks.
Santosh
[1] https://lkml.org/lkml/2020/10/23/310
[2] https://lkml.org/lkml/2020/10/21/460
Santosh Shukla (1):
KVM: arm64: Correctly handle the mmio faulting
arch/arm64/kvm/mmu.c | 1 +
1 file changed, 1 insertion(+)
--
2.7.4
