[PATCH] KVM: riscv: Set Accessed bit in dirty-log write fault fast path

[PATCH] KVM: riscv: Set Accessed bit in dirty-log write fault fast path

[SeungJu Cheon]

kvm_riscv_mmu_dirty_log_write_fault_fast() considers a leaf with W
and D set already handled, even if aging has cleared its A bit.
On hardware that faults when A is clear, the fast path returns
true without setting A and skips the slow path that would set it.
The guest retries the same store, but A is still clear, so it
faults again. This repeats indefinitely, preventing the guest
from making progress.

Host reclaim or page_idle can trigger this while dirty logging is
enabled, potentially hanging vCPUs during live migration.

Require _PAGE_ACCESSED in addition to W and D before treating the
fault as handled, and set A along with W and D. The existing
cmpxchg loop retries if aging changes the PTE before the update.

Fixes: 7705be59eb2d ("KVM: riscv: Fast-path dirty logging write faults")
Cc: stable@vger.kernel.org # 7.2+
Signed-off-by: SeungJu Cheon <suunj1331@gmail.com>
---
Testing:

On a HiFive Premier P550 (EIC7700X, which traps on clear A/D bits),
run:

dirty_log_perf_test -v 3 -b 256M -i 3

While the test runs, repeatedly mark all system RAM idle through
/sys/kernel/mm/page_idle/bitmap.

Before the fix, the test did not complete its first iteration in
over 11 minutes, with lock_stat showing about 16k read-side
mmu_lock acquisitions per second from the fast path.

After the fix, all three iterations complete, each taking about
29 seconds under the same aging workload.

 arch/riscv/kvm/mmu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
index 78a1826c466d..042d1e3b3547 100644
--- a/arch/riscv/kvm/mmu.c
+++ b/arch/riscv/kvm/mmu.c
@@ -591,14 +591,15 @@ static bool kvm_riscv_mmu_dirty_log_write_fault_fast(struct kvm *kvm,
 			dirty_marked = true;
 		}
 
-		if ((pte_val(old_pte) & (_PAGE_WRITE | _PAGE_DIRTY)) ==
-		    (_PAGE_WRITE | _PAGE_DIRTY)) {
+		if ((pte_val(old_pte) &
+		     (_PAGE_WRITE | _PAGE_DIRTY | _PAGE_ACCESSED)) ==
+		    (_PAGE_WRITE | _PAGE_DIRTY | _PAGE_ACCESSED)) {
 			new_pte = old_pte;
 			ret = true;
 			break;
 		}
 
-		new_pte = pte_mkdirty(pte_mkwrite_novma(old_pte));
+		new_pte = pte_mkyoung(pte_mkdirty(pte_mkwrite_novma(old_pte)));
 
 		if (kvm_riscv_gstage_try_update_pte(&gstage, ptep_level, gpa,
 						    ptep, old_pte, new_pte)) {
-- 
2.52.0

Re: [PATCH] KVM: riscv: Set Accessed bit in dirty-log write fault fast path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: riscv: host memory corruption via dirty logging fast path
--

commit b1648eda48b2a005ceca6ca39f80fd20aed60966
Author: SeungJu Cheon <suunj1331@gmail.com>
KVM: riscv: Set Accessed bit in dirty-log write fault fast path

This patch fixes an issue where the fast path for dirty logging write
faults loops indefinitely on hardware that faults when the Accessed bit
is clear. It ensures the accessed bit is set alongside write and dirty
bits.

Cc: stable@vger.kernel.org # 7.2+

> diff --git a/arch/riscv/kvm/mmu.c b/arch/riscv/kvm/mmu.c
> index 371fccaf9df08..21637b7959730 100644
> --- a/arch/riscv/kvm/mmu.c
> +++ b/arch/riscv/kvm/mmu.c
[ ... ]
> @@ -591,14 +591,15 @@ static bool kvm_riscv_mmu_dirty_log_write_fault_fast(struct kvm *kvm,
[ ... ]
> -		new_pte = pte_mkdirty(pte_mkwrite_novma(old_pte));
> +		new_pte = pte_mkyoung(pte_mkdirty(pte_mkwrite_novma(old_pte)));

[Severity: Critical]
Does this unconditionally set the _PAGE_WRITE bit on the stage-2 PTE
without verifying if the original mapping was host-writable?

When dirty logging is enabled, a guest write to a previously read-only
mapped page can trigger kvm_riscv_mmu_map() with logging enabled:

kvm_riscv_mmu_map()
    if (is_write && logging &&
        kvm_riscv_mmu_dirty_log_write_fault_fast(kvm, memslot, gpa, out_map))
        return 0;

If we unconditionally add _PAGE_WRITE here via pte_mkwrite_novma(),
could an unprivileged guest bypass host write-protection by reading an
unallocated page (like the shared zero page) and then writing to it
during live migration?

This appears to bypass the host writability checks in the slow path's
__kvm_faultin_pfn(), which might allow a guest to write directly into
host read-only pages, such as CoW mappings or the shared zero page.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016101458.221648-1-suunj1331@gmail.com?part=1