Re: [PATCH v1 2/2] KVM: s390: pv: fix race when making a page secure

David Hildenbrand
2025-02-13T20:16:10Z

On 13.02.25 21:07, Claudio Imbrenda wrote:
> Holding the pte lock for the page that is being converted to secure is
> needed to avoid races. A previous commit removed the locking, which
> caused issues. Fix by locking the pte again.
>
> Fixes: 5cbe24350b7d ("KVM: s390: move pv gmap functions into kvm")

If you found this because of my report about the changed locking,
consider adding a Suggested-by / Reported-y.

> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> ---
> arch/s390/include/asm/uv.h | 2 +-
> arch/s390/kernel/uv.c | 19 +++++++++++++++++--
> arch/s390/kvm/gmap.c | 12 ++++++++----
> 3 files changed, 26 insertions(+), 7 deletions(-)
>
> diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h
> index b11f5b6d0bd1..46fb0ef6f984 100644
> --- a/arch/s390/include/asm/uv.h
> +++ b/arch/s390/include/asm/uv.h
> @@ -631,7 +631,7 @@ int uv_pin_shared(unsigned long paddr);
> int uv_destroy_folio(struct folio *folio);
> int uv_destroy_pte(pte_t pte);
> int uv_convert_from_secure_pte(pte_t pte);
> -int make_folio_secure(struct folio *folio, struct uv_cb_header *uvcb);
> +int make_hva_secure(struct mm_struct *mm, unsigned long hva, struct uv_cb_header *uvcb);
> int uv_convert_from_secure(unsigned long paddr);
> int uv_convert_from_secure_folio(struct folio *folio);
>
> diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
> index 9f05df2da2f7..de3c092da7b9 100644
> --- a/arch/s390/kernel/uv.c
> +++ b/arch/s390/kernel/uv.c
> @@ -245,7 +245,7 @@ static int expected_folio_refs(struct folio *folio)
> * Context: The caller must hold exactly one extra reference on the folio
> * (it's the same logic as split_folio())
> */
> -int make_folio_secure(struct folio *folio, struct uv_cb_header *uvcb)
> +static int __make_folio_secure(struct folio *folio, unsigned long hva, struct uv_cb_header *uvcb)
> {
> int expected, cc = 0;
>
> @@ -277,7 +277,22 @@ int make_folio_secure(struct folio *folio, struct uv_cb_header *uvcb)
> return -EAGAIN;
> return uvcb->rc == 0x10a ? -ENXIO : -EINVAL;
> }
> -EXPORT_SYMBOL_GPL(make_folio_secure);
> +
> +int make_hva_secure(struct mm_struct *mm, unsigned long hva, struct uv_cb_header *uvcb)
> +{
> + spinlock_t *ptelock;
> + pte_t *ptep;
> + int rc;
> +
> + ptep = get_locked_pte(mm, hva, &ptelock);
> + if (!ptep)
> + return -ENXIO;
> + rc = __make_folio_secure(page_folio(pte_page(*ptep)), hva, uvcb);
> + pte_unmap_unlock(ptep, ptelock);
> +
> + return rc;
> +}
> +EXPORT_SYMBOL_GPL(make_hva_secure);
>
> /*
> * To be called with the folio locked or with an extra reference! This will
> diff --git a/arch/s390/kvm/gmap.c b/arch/s390/kvm/gmap.c
> index fc4d490d25a2..e56c0ab5fec7 100644
> --- a/arch/s390/kvm/gmap.c
> +++ b/arch/s390/kvm/gmap.c
> @@ -55,7 +55,7 @@ static bool should_export_before_import(struct uv_cb_header *uvcb, struct mm_str
> return atomic_read(&mm->context.protected_count) > 1;
> }
>
> -static int __gmap_make_secure(struct gmap *gmap, struct page *page, void *uvcb)
> +static int __gmap_make_secure(struct gmap *gmap, struct page *page, unsigned long hva, void *uvcb)
> {
> struct folio *folio = page_folio(page);
> int rc;
> @@ -83,7 +83,7 @@ static int __gmap_make_secure(struct gmap *gmap, struct page *page, void *uvcb)
> return -EAGAIN;
> if (should_export_before_import(uvcb, gmap->mm))
> uv_convert_from_secure(folio_to_phys(folio));
> - rc = make_folio_secure(folio, uvcb);
> + rc = make_hva_secure(gmap->mm, hva, uvcb);
> folio_unlock(folio);
>
> /*
> @@ -120,6 +120,7 @@ static int __gmap_make_secure(struct gmap *gmap, struct page *page, void *uvcb)
> int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)
> {
> struct kvm *kvm = gmap->private;
> + unsigned long vmaddr;
> struct page *page;
> int rc = 0;
>
> @@ -127,8 +128,11 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)
>
> page = gfn_to_page(kvm, gpa_to_gfn(gaddr));
> mmap_read_lock(gmap->mm);
> - if (page)
> - rc = __gmap_make_secure(gmap, page, uvcb);
> + vmaddr = gfn_to_hva(gmap->private, gpa_to_gfn(gaddr));
> + if (kvm_is_error_hva(vmaddr))
> + rc = -ENXIO;
> + if (!rc && page)
> + rc = __gmap_make_secure(gmap, page, vmaddr, uvcb);
> kvm_release_page_clean(page);
> mmap_read_unlock(gmap->mm);
>

You effectively make the code more complicated and inefficient than
before. Now you effectively walk the page table twice in the common
small-folio case ...

Can we just go back to the old handling that we had before here?

--
Cheers,

David / dhildenb