Patch "arm/arm64: KVM: Enforce unconditional flush to PoC when mapping to stage-2" has been added to the 4.10-stable tree

This is a note to let you know that I've just added the patch titled

arm/arm64: KVM: Enforce unconditional flush to PoC when mapping to stage-2

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
arm-arm64-kvm-enforce-unconditional-flush-to-poc-when-mapping-to-stage-2.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Marc Zyngier <[email protected]>
Date: Wed, 25 Jan 2017 12:29:59 +0000
Subject: arm/arm64: KVM: Enforce unconditional flush to PoC when mapping to stage-2

From: Marc Zyngier <[email protected]>

commit 8f36ebaf21fdae99c091c67e8b6fab33969f2667 upstream.

When we fault in a page, we flush it to the PoC (Point of Coherency) if the faulting vcpu has its own caches off, so that it can observe the page we just brought it.

But if the vcpu has its caches on, we skip that step. Bad things happen when *another* vcpu tries to access that page with its own caches disabled. At that point, there is no garantee that the data has made it to the PoC, and we access stale data.

The obvious fix is to always flush to PoC when a page is faulted in, no matter what the state of the vcpu is.

---
 arch/arm/include/asm/kvm_mmu.h   |    9 +--------
 arch/arm64/include/asm/kvm_mmu.h |    3 +--
 2 files changed, 2 insertions(+), 10 deletions(-)

@@ -150,18 +150,12 @@ static inline void __coherent_cache_gues
 	 * and iterate over the range.
 	 */
 
-	bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached;
-
 	VM_BUG_ON(size & ~PAGE_MASK);
 
-	if (!need_flush && !icache_is_pipt())
-		goto vipt_cache;
-
 	while (size) {
 		void *va = kmap_atomic_pfn(pfn);
 
-		if (need_flush)
-			kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+		kvm_flush_dcache_to_poc(va, PAGE_SIZE);
 
 		if (icache_is_pipt())
 			__cpuc_coherent_user_range((unsigned long)va,

@@ -173,7 +167,6 @@ static inline void __coherent_cache_gues
 		kunmap_atomic(va);
 	}
 
-vipt_cache:
 	if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) {
 		/* any kind of VIPT cache */
 		__flush_icache_all();

@@ -241,8 +241,7 @@ static inline void __coherent_cache_gues
 {
 	void *va = page_address(pfn_to_page(pfn));
 
-	if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
-		kvm_flush_dcache_to_poc(va, size);
+	kvm_flush_dcache_to_poc(va, size);
 
 	if (!icache_is_aliasing()) {		/* PIPT */
 		flush_icache_range((unsigned long)va,

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/arm-arm64-kvm-enforce-unconditional-flush-to-poc-when-mapping-to-stage-2.patch queue-4.10/kvm-arm-arm64-vgic-stop-injecting-the-msi-occurrence-twice.patch