This ensures that KVM or VFIO correctly see a writable PTE when they request one. Otherwise, a guest write to an unpopulated PTE from a mapping backed by a DRM GEM BO triggers a VM exit with EFAULT.
The code actually is simpler, because the same logic already applied to the hugepage mapping case using vmf_insert_pfn_pmd(). Reported-by: Sergio Lopez <[email protected]> Link: https://lore.kernel.org/kvm/[email protected]/ Tested-by: Sergio Lopez <[email protected]> Reviewed-by: Boris Brezillon <[email protected]> Fixes: 28e3918179aa ("drm/gem-shmem: Track folio accessed/dirty status in mmap") Cc: [email protected] Signed-off-by: Paolo Bonzini <[email protected]> --- drivers/gpu/drm/drm_gem_shmem_helper.c | 38 ++++++++++++++------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index c989459eb215..c81be3e97317 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -589,11 +589,25 @@ static void drm_gem_shmem_record_mkwrite(struct vm_fault *vmf) folio_mark_dirty(page_folio(shmem->pages[page_offset])); } +/* + * Because the vm_ops have a .pfn_mkwrite() callback, vma_set_page_prot() + * has cleared the write bit from vma->vm_page_prot. vmf_insert_pfn() + * would install a read-only entry even for a write fault, relying on a + * second fault to reach .pfn_mkwrite() and upgrade it, but that second + * fault never happens for fixup_user_fault() callers that directly + * walk the page tables with follow_pfnmap_start(). To ensure that + * they don't see the read-only entry, pass FAULT_FLAG_WRITE info down + * to install a writable entry right away. Because .pfn_mkwrite() is + * not invoked, record the write afterwards. + */ static vm_fault_t try_insert_pfn(struct vm_fault *vmf, unsigned int order, unsigned long pfn) { + bool write = vmf->flags & FAULT_FLAG_WRITE; + vm_fault_t ret = VM_FAULT_FALLBACK; + if (!order) { - return vmf_insert_pfn(vmf->vma, vmf->address, pfn); + ret = vmf_insert_pfn_mkwrite(vmf->vma, vmf->address, pfn, write); #ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP } else if (order == PMD_ORDER) { unsigned long paddr = pfn << PAGE_SHIFT; @@ -601,27 +615,15 @@ static vm_fault_t try_insert_pfn(struct vm_fault *vmf, unsigned int order, if (aligned && folio_test_pmd_mappable(page_folio(pfn_to_page(pfn)))) { - vm_fault_t ret; - pfn &= PMD_MASK >> PAGE_SHIFT; - - /* Unlike PTEs which are automatically upgraded to - * writeable entries, the PMD upgrades go through - * .huge_fault(). Make sure we pass the "write" info - * along in that case. - * This also means we have to record the write fault - * here, instead of in .pfn_mkwrite(). - */ - ret = vmf_insert_pfn_pmd(vmf, pfn, - vmf->flags & FAULT_FLAG_WRITE); - if (ret == VM_FAULT_NOPAGE && (vmf->flags & FAULT_FLAG_WRITE)) - drm_gem_shmem_record_mkwrite(vmf); - - return ret; + ret = vmf_insert_pfn_pmd(vmf, pfn, write); } #endif } - return VM_FAULT_FALLBACK; + + if (ret == VM_FAULT_NOPAGE && write) + drm_gem_shmem_record_mkwrite(vmf); + return ret; } static vm_fault_t drm_gem_shmem_any_fault(struct vm_fault *vmf, unsigned int order) -- 2.55.0
