[PATCH v2 0/2] KVM: x86/mmu: Fill memory_fault for unresolvable guest page faults

[mike.malyshev@gmail.com]

From: Mikhail Malyshev <mike.malyshev@gmail.com>

When KVM cannot resolve a guest page fault, kvm_handle_error_pfn() returns
a bare -EFAULT.  KVM_CAP_MEMORY_FAULT_INFO documents the opposite: that
KVM_RUN fills kvm_run.memory_fault "if KVM cannot resolve a guest page
fault VM-Exit, e.g. if there is a valid memslot but no backing VMA for the
corresponding host virtual address".

The gap has a practical cost.  On a host that assigns an Intel integrated
GPU (Raptor Lake-P) to a guest via vfio-pci, the guest's display driver
clears PCI_COMMAND.MEM on one vCPU while another vCPU is mid-MMIO to BAR0
of the same device.  vfio-pci zaps the BAR's mmap, so the second vCPU's
fault finds a valid memslot whose VM_PFNMAP fault handler declines to
install a PTE, and KVM_RUN fails with -EFAULT and nothing else.  The VMM
has nothing to act on and kills the VM, even though the guest did nothing
architecturally invalid and the condition clears as soon as the driver
re-enables memory decoding.  This reproduces on demand and has been
observed in the field on production edge hardware.

Patch 1 is Anish Moorthy's 2024 patch [1], code unchanged, with the
changelog rewritten around that user.  Patch 2 converts the remaining
WARN_ON_ONCE()-protected -EFAULTs in x86's fault path to KVM_BUG_ON() +
-EIO, so that an -EFAULT out of the fault path consistently means "guest
access KVM could not resolve" rather than "KVM is broken".

Changes since v1
================

v1 [2] took a different approach: it mapped KVM_PFN_ERR_PFNMAP to MMIO
semantics inside KVM.  Sean objected that giving PFNMAP memory emulated
MMIO semantics changed long-standing ABI inconsistently, and outlined this
approach instead [3][4], including the shape of both patches.  v2
implements that outline:

  - report the fault via KVM_EXIT_MEMORY_FAULT rather than inventing MMIO
    semantics for PFNMAP memory;
  - take Anish's patch rather than writing an equivalent one, crediting
    both authors;
  - add the KVM_BUG_ON() + -EIO conversions as a separate patch;
  - x86 only, and based on kvm-x86/next rather than linus/master.

The userspace half
==================

This series reports the fault; it deliberately does not define what an
access to a BAR with memory decoding disabled returns.  That policy belongs
in userspace, and QEMU does not implement it yet: QEMU routes
KVM_EXIT_MEMORY_FAULT into its guest_memfd conversion path, which rejects
a vfio BAR -- a ram_device region with no guest_memfd -- and stops the VM
with an internal error.  Unmodified QEMU therefore still loses the VM
exactly as it does today on a bare -EFAULT; only the reported error
changes.  A QEMU series emulating Unsupported Request semantics for this
case -- reads return all ones, writes are dropped, as the hardware does --
will follow and will link back here.

So this series does not regress today's userspace, but neither does it
fix anything for it: it is the enabling half, not a standalone crash fix.
That is also why patch 1 carries a Fixes: tag but is not tagged for
stable: a backport would not help any userspace that exists today.

Testing
=======

arch/x86/kvm/ builds clean with no new warnings for x86_64 and for i386
allmodconfig, the latter covering the 32-bit-only hunk in patch 2.
checkpatch.pl --strict reports 0 errors, 0 warnings, 0 checks on both
patches and on this cover letter.  End-to-end testing against the
reproducer requires the QEMU counterpart and will be reported with that
series.

Link: https://lore.kernel.org/all/20240809205158.1340255-1-amoorthy@google.com/ [1]
Link: https://lore.kernel.org/all/20260621133708.3454718-1-mike.malyshev@gmail.com/ [2]
Link: https://lore.kernel.org/all/ajnEAkFGyJWmomhq@google.com/ [3]
Link: https://lore.kernel.org/all/aj1Vc13mqb-fXiow@google.com/ [4]

Anish Moorthy (1):
  KVM: x86/mmu: Report a memory fault exit when the fault handler
    EFAULTs

Mikhail Malyshev (1):
  KVM: x86/mmu: Convert can't-happen fault path EFAULTs to KVM_BUG_ON()
    + -EIO

 arch/x86/kvm/mmu/mmu.c         | 13 +++++++------
 arch/x86/kvm/mmu/paging_tmpl.h |  4 ++--
 2 files changed, 9 insertions(+), 8 deletions(-)


base-commit: 70c944caf570fda2d79baa71435589a8db39f048
-- 
2.43.0