Virtualization - May 2020 - [PATCH v2 resubmit] virtio-balloon: Disable free page reporting if page poison reporting is not enabled

From: Alexander Duyck <alexander.h.duyck at linux.intel.com>

We should disable free page reporting if page poisoning is enabled but we
cannot report it via the balloon interface. This way we can avoid the
possibility of corrupting guest memory. Normally the page poisoning feature
should always be present when free page reporting is enabled on the
hypervisor, however this allows us to correctly handle a case of the
virtio-balloon device being possibly misconfigured.

Fixes: 5d757c8d518d ("virtio-balloon: add support for providing free page
reports to host")
Acked-by: David Hildenbrand <david at redhat.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck at linux.intel.com>
---

Changes since v1:
Originally this patch also modified free page hinting, that has been removed.
Updated patch title and description.
Added a comment explaining reasoning for disabling free page reporting.

Resbumitting v2 w/ Ack from David Hildebrand.

 drivers/virtio/virtio_balloon.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 51086a5afdd4..1f157d2f4952 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -1107,11 +1107,18 @@ static int virtballoon_restore(struct virtio_device
*vdev)
 
 static int virtballoon_validate(struct virtio_device *vdev)
 {
-	/* Tell the host whether we care about poisoned pages. */
+	/*
+	 * Inform the hypervisor that our pages are poisoned or
+	 * initialized. If we cannot do that then we should disable
+	 * page reporting as it could potentially change the contents
+	 * of our free pages.
+	 */
 	if (!want_init_on_free() &&
 	    (IS_ENABLED(CONFIG_PAGE_POISONING_NO_SANITY) ||
 	     !page_poisoning_enabled()))
 		__virtio_clear_bit(vdev, VIRTIO_BALLOON_F_PAGE_POISON);
+	else if (!virtio_has_feature(vdev, VIRTIO_BALLOON_F_PAGE_POISON))
+		__virtio_clear_bit(vdev, VIRTIO_BALLOON_F_REPORTING);
 
 	__virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
 	return 0;

Just following up. It has been a week since I submitted this. I was
hoping we could get it in for 5.7 since this affects free page
reporting which will be introduced with that kernel release.

Thanks.

- Alex

On Fri, May 8, 2020 at 10:40 AM Alexander Duyck
<alexander.duyck at gmail.com> wrote:
>
> From: Alexander Duyck <alexander.h.duyck at linux.intel.com>
>
> We should disable free page reporting if page poisoning is enabled but we
> cannot report it via the balloon interface. This way we can avoid the
> possibility of corrupting guest memory. Normally the page poisoning feature
> should always be present when free page reporting is enabled on the
> hypervisor, however this allows us to correctly handle a case of the
> virtio-balloon device being possibly misconfigured.
>
> Fixes: 5d757c8d518d ("virtio-balloon: add support for providing free
page reports to host")
> Acked-by: David Hildenbrand <david at redhat.com>
> Signed-off-by: Alexander Duyck <alexander.h.duyck at linux.intel.com>
> ---
>
> Changes since v1:
> Originally this patch also modified free page hinting, that has been
removed.
> Updated patch title and description.
> Added a comment explaining reasoning for disabling free page reporting.
>
> Resbumitting v2 w/ Ack from David Hildebrand.
>
>  drivers/virtio/virtio_balloon.c |    9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/virtio/virtio_balloon.c
b/drivers/virtio/virtio_balloon.c
> index 51086a5afdd4..1f157d2f4952 100644
> --- a/drivers/virtio/virtio_balloon.c
> +++ b/drivers/virtio/virtio_balloon.c
> @@ -1107,11 +1107,18 @@ static int virtballoon_restore(struct virtio_device
*vdev)
>
>  static int virtballoon_validate(struct virtio_device *vdev)
>  {
> -       /* Tell the host whether we care about poisoned pages. */
> +       /*
> +        * Inform the hypervisor that our pages are poisoned or
> +        * initialized. If we cannot do that then we should disable
> +        * page reporting as it could potentially change the contents
> +        * of our free pages.
> +        */
>         if (!want_init_on_free() &&
>             (IS_ENABLED(CONFIG_PAGE_POISONING_NO_SANITY) ||
>              !page_poisoning_enabled()))
>                 __virtio_clear_bit(vdev, VIRTIO_BALLOON_F_PAGE_POISON);
> +       else if (!virtio_has_feature(vdev, VIRTIO_BALLOON_F_PAGE_POISON))
> +               __virtio_clear_bit(vdev, VIRTIO_BALLOON_F_REPORTING);
>
>         __virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
>         return 0;
>

Do I need to resubmit this patch? It has been over two weeks now since
it was originally submitted, and a week and a half since I last sent
out an email following up. I'm just wondering if there is some list I
missed as I am assuming the maintainers and lists I contacted here are
correct? It looks like we are at RC7 now so I am worried this won't
make it in before LInus releases 5.7.

Thanks.

- Alex

On Fri, May 15, 2020 at 10:02 AM Alexander Duyck
<alexander.duyck at gmail.com> wrote:
>
> Just following up. It has been a week since I submitted this. I was
> hoping we could get it in for 5.7 since this affects free page
> reporting which will be introduced with that kernel release.
>
> Thanks.
>
> - Alex
>
> On Fri, May 8, 2020 at 10:40 AM Alexander Duyck
> <alexander.duyck at gmail.com> wrote:
> >
> > From: Alexander Duyck <alexander.h.duyck at linux.intel.com>
> >
> > We should disable free page reporting if page poisoning is enabled but
we
> > cannot report it via the balloon interface. This way we can avoid the
> > possibility of corrupting guest memory. Normally the page poisoning
feature
> > should always be present when free page reporting is enabled on the
> > hypervisor, however this allows us to correctly handle a case of the
> > virtio-balloon device being possibly misconfigured.
> >
> > Fixes: 5d757c8d518d ("virtio-balloon: add support for providing
free page reports to host")
> > Acked-by: David Hildenbrand <david at redhat.com>
> > Signed-off-by: Alexander Duyck <alexander.h.duyck at
linux.intel.com>
> > ---
> >
> > Changes since v1:
> > Originally this patch also modified free page hinting, that has been
removed.
> > Updated patch title and description.
> > Added a comment explaining reasoning for disabling free page
reporting.
> >
> > Resbumitting v2 w/ Ack from David Hildebrand.
> >
> >  drivers/virtio/virtio_balloon.c |    9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/virtio/virtio_balloon.c
b/drivers/virtio/virtio_balloon.c
> > index 51086a5afdd4..1f157d2f4952 100644
> > --- a/drivers/virtio/virtio_balloon.c
> > +++ b/drivers/virtio/virtio_balloon.c
> > @@ -1107,11 +1107,18 @@ static int virtballoon_restore(struct
virtio_device *vdev)
> >
> >  static int virtballoon_validate(struct virtio_device *vdev)
> >  {
> > -       /* Tell the host whether we care about poisoned pages. */
> > +       /*
> > +        * Inform the hypervisor that our pages are poisoned or
> > +        * initialized. If we cannot do that then we should disable
> > +        * page reporting as it could potentially change the contents
> > +        * of our free pages.
> > +        */
> >         if (!want_init_on_free() &&
> >             (IS_ENABLED(CONFIG_PAGE_POISONING_NO_SANITY) ||
> >              !page_poisoning_enabled()))
> >                 __virtio_clear_bit(vdev,
VIRTIO_BALLOON_F_PAGE_POISON);
> > +       else if (!virtio_has_feature(vdev,
VIRTIO_BALLOON_F_PAGE_POISON))
> > +               __virtio_clear_bit(vdev, VIRTIO_BALLOON_F_REPORTING);
> >
> >         __virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
> >         return 0;
> >