linux-kernel - Re: [PATCH] RISC-V: KVM: Using user-mode pte within kvm_riscv_gstage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <DBX0JNR61UNM.Z42YERAKRFR8@ventanamicro.com>
Date: Fri, 08 Aug 2025 13:35:11 +0200
From: Radim Krčmář <rkrcmar@...tanamicro.com>
To: <fangyu.yu@...ux.alibaba.com>, <anup@...infault.org>,
 <atish.patra@...ux.dev>, <paul.walmsley@...ive.com>, <palmer@...belt.com>,
 <aou@...s.berkeley.edu>, <alex@...ti.fr>
Cc: <guoren@...ux.alibaba.com>, <kvm@...r.kernel.org>,
 <kvm-riscv@...ts.infradead.org>, <linux-riscv@...ts.infradead.org>,
 <linux-kernel@...r.kernel.org>, "linux-riscv"
 <linux-riscv-bounces@...ts.infradead.org>
Subject: Re: [PATCH] RISC-V: KVM: Using user-mode pte within
 kvm_riscv_gstage_ioremap

2025-08-07T15:07:29+08:00, <fangyu.yu@...ux.alibaba.com>:
> From: Fangyu Yu <fangyu.yu@...ux.alibaba.com>
>
> Currently we use kvm_riscv_gstage_ioremap to map IMSIC gpa to the spa of
                                                                    ^^^
                                                                    hpa?

> guest interrupt file within IMSIC.
>
> The PAGE_KERNEL_IO property does not include user mode settings, so when
> accessing the IMSIC address in the virtual machine,  a  guest page fault
> will occur, this is not expected.

PAGE_KERNEL_IO also set the reserved G bit, so you're fixing two issues
with a single change. :)

> According to the RISC-V Privileged Architecture Spec, for G-stage address
> translation, all memory accesses are considered to be user-level accesses
> as though executed in Umode.

What implementation are you using?  I would have assume that the
original code was tested on QEMU, so we might have a bug there.

> Signed-off-by: Fangyu Yu <fangyu.yu@...ux.alibaba.com>
> ---
> diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
> @@ -359,8 +360,11 @@ int kvm_riscv_gstage_ioremap(struct kvm *kvm, gpa_t gpa,
>  	end = (gpa + size + PAGE_SIZE - 1) & PAGE_MASK;
>  	pfn = __phys_to_pfn(hpa);
>  
> +	prot = pgprot_noncached(PAGE_WRITE);
> +
>  	for (addr = gpa; addr < end; addr += PAGE_SIZE) {
> -		pte = pfn_pte(pfn, PAGE_KERNEL_IO);
> +		pte = pfn_pte(pfn, prot);
> +		pte = pte_mkdirty(pte);

Is it necessary to dirty the pte?

It was dirtied before, so it definitely doesn't hurt,

Reviewed-by: Radim Krčmář <rkrcmar@...tanamicro.com>

Thanks.