KVM: x86/mmu: emulate (not -EFAULT) guest access to a disabled passthrough BAR

A passed-through PCI device's BAR is mapped into the guest via a VM_IO/
VM_PFNMAP VMA whose fault handler (e.g. vfio_pci_mmap_fault) declines to
install a PTE while the device's memory space is disabled, such as right
after the guest clears PCI_COMMAND.MEM. If another vCPU accesses that BAR
during the window, the gup in the page-fault path fails with an error pfn
even though the memslot is still valid, and KVM_RUN returns -EFAULT to
userspace, crashing the VM. A guest can trigger this at will, so it is a
guest-triggerable host-side VM kill.

On real hardware an access to a BAR with memory decoding disabled completes
as an Unsupported Request (reads return all-ones, writes are dropped). KVM
can present the same behaviour by treating the access as MMIO and emulating
it, which is exactly what the noslot path already does.

Distinguish the VM_IO/VM_PFNMAP fault-handler failure from other error pfns
with a new KVM_PFN_ERR_PFNMAP value (in-range, so existing error-pfn range
checks are unaffected) and route it to kvm_handle_noslot_fault() in the x86
TDP fault path. Genuine, non-pfnmap faults (e.g. a vanished anonymous
backing) still take the fatal -EFAULT path, so real errors are not masked.
The MMIO mapping self-heals when the device memory is re-enabled and the
memslot is updated, bumping the MMIO generation.

Fixes: abafbc5 ("vfio-pci: Invalidate mmaps and block MMIO access on disabled memory")
Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>

Author: rucoder

arch/x86/kvm/mmu/mmu.c

@@ -4521,8 +4521,22 @@ static int kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault,
 	if (ret != RET_PF_CONTINUE)
 		return ret;
 
-	if (unlikely(is_error_pfn(fault->pfn)))
+	if (unlikely(is_error_pfn(fault->pfn))) {
+		/*
+		 * A passed-through PCI BAR is backed by a VM_IO/VM_PFNMAP
+		 * mapping whose fault handler refuses to install a PTE while the
+		 * device's memory space is disabled (e.g. the guest cleared
+		 * PCI_COMMAND.MEM). The gup then fails even though the memslot
+		 * is still valid. Treat such an access as MMIO and emulate it
+		 * (the guest observes Unsupported Request semantics, matching
+		 * real hardware) instead of killing the VM with -EFAULT. Other,
+		 * non-pfnmap errors still take the fatal path.
+		 */
+		if (fault->pfn == KVM_PFN_ERR_PFNMAP)
+			return kvm_handle_noslot_fault(vcpu, fault, access);
+
 		return kvm_handle_error_pfn(vcpu, fault);
+	}
 
 	if (WARN_ON_ONCE(!fault->slot || is_noslot_pfn(fault->pfn)))
 		return kvm_handle_noslot_fault(vcpu, fault, access);

include/linux/kvm_host.h

@@ -97,6 +97,13 @@
 #define KVM_PFN_ERR_HWPOISON	(KVM_PFN_ERR_MASK + 1)
 #define KVM_PFN_ERR_RO_FAULT	(KVM_PFN_ERR_MASK + 2)
 #define KVM_PFN_ERR_SIGPENDING	(KVM_PFN_ERR_MASK + 3)
+/*
+ * Faulting in a VM_IO/VM_PFNMAP mapping failed because its fault handler
+ * declined to install a PTE, e.g. a passed-through PCI BAR whose device memory
+ * is currently disabled (guest cleared PCI_COMMAND.MEM). The memslot is valid;
+ * the access should be treated as MMIO rather than a fatal -EFAULT.
+ */
+#define KVM_PFN_ERR_PFNMAP	(KVM_PFN_ERR_MASK + 4)
 
 /*
  * error pfns indicate that the gfn is in slot but faild to

virt/kvm/kvm_main.c

@@ -2991,7 +2991,13 @@ kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool interruptible,
 		if (r == -EAGAIN)
 			goto retry;
 		if (r < 0)
-			pfn = KVM_PFN_ERR_FAULT;
+			/*
+			 * The mapping's fault handler declined to install a PTE
+			 * (e.g. a passed-through PCI BAR with device memory
+			 * disabled). Flag it distinctly so the fault handler can
+			 * treat the access as MMIO instead of a fatal -EFAULT.
+			 */
+			pfn = KVM_PFN_ERR_PFNMAP;
 	} else {
 		if (async && vma_is_valid(vma, write_fault))
 			*async = true;