From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A43437EFE3 for ; Mon, 24 Aug 2026 17:49:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.200 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787593781; cv=none; b=WQvm9tOkQAkp4bE76YoNkPAdpotH/yJ5SLYMF0YWCCIzFkDcYxz98HnmZfNEtBgsAqHcHZt0tbsJ+OMU9GXWajXfP8Wni1W0qzE34YNx1pDhxk/639FX7tiu0Sbk8kTYjW/W6LUkNHXM+AkSLfZ3E6wLFzGNEM+KWE1l1GRkR74= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787593781; c=relaxed/simple; bh=PPDJlqSUvHay03xyBP07YiG5iuuiA6STLjyjRlcztdc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=CCQMuXOhR4xKaCCu7uhZ7OZ3hQF51PkeY53eM1pep3pKHl270bbQiUpGaXw9OOIc1t/1NyUtHnGb9pHrHiXCQ/l+uARET7BdDkhJzK4binVs5oDyDplj3o7dIbn9gvvoOnZ1zD2i5stxK6Xn1l6JIx6vQLzS+/UXql+0K5Cmd7c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ouJioJJG; arc=none smtp.client-ip=209.85.214.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ouJioJJG" Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2d55d8cd938so70138475ad.1 for ; Mon, 24 Aug 2026 10:49:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787593778; x=1788198578; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=/Z/z5YUBWrEARW+uT0SGoD2jo4BnRQlBc+8qnsY9bew=; b=ouJioJJGE+dbzq5MtpkOCN6ycveqW9/ropQpCz4Zi3IlFR5aHpvSoHMocOqs8w2+g0 cPH1gX5/zqBBBjBzhj5RID/mk1Qtpo9Jt0eEEYJKksgUrttrEr/04fay2Zo2FD/6RScG IWgTiOcEANzztypKp1ivH4T7rNX0SYilohno9FJdWRJPoNMdtxJxLZ4jydLJwdKcFVe+ 1+VSW6U3WWrW6a9S6YguRQYOJcXzAQojjzavRqhLX6mBNh1WmQdox1DxUTWdruykoRKT YF3Azpe7Cd9NqqM3VfTou6moDVtgdErIAKII8wl61JF/bNO7kE29DuyulCCvf6tVQj35 rorw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787593778; x=1788198578; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/Z/z5YUBWrEARW+uT0SGoD2jo4BnRQlBc+8qnsY9bew=; b=FgF+mENhNbIc4KHg/kPPWdAL97xAYWfKtjHWyX2+9rSVlAr4GpxI/Fe6WeeY3twQEl XU6K2Jws+5lpO/lCJmA+frSZvwnbVvFgNHSjAnqAltmhKDyFaWspaIkNw7qpLWzS5aOT /p4cF83ZcU/4A8HFtSup9ynXBFBp8XBz3Nrr021VJoKVp4jBjhGAGVkSKnM2nomfFzxJ gQBzCSXPQSApPbhfxqZqHr+etAtVP3bFpq0EK4BOaJYvmmJpP5Ho/mdgkTGfEK/AhPT2 yVVl5QxQJ418Yr/cz2SSvq3PA8cx96NQ0gqpv0kRi4fSJq1nmVZg2Pj1WKYls1ufXbtK /hlQ== X-Forwarded-Encrypted: i=1; AHgh+Rouio7kmfU0pBdjusAU8ftJR/tvZbePU4xS3ZPRuf8CXJB1FXQjdhIyywynJnxgoVnKLmtwd2g1VP4UH+0=@vger.kernel.org X-Gm-Message-State: AFuF++kJfj0e83GulzqfvBRJ+XVDUNZysw7oq/PJeNwvjmEnioMPOBmA pSS7vwiF4LJ2uk5LXjZpaBt9btpKltnNkDynTcN+16EZdHNHbOBuZIa17AZxqL4o2IgTr2SKCbo V66LMuw== X-Received: from plbjf12.prod.google.com ([2002:a17:903:268c:b0:2ce:9b92:ec60]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:3888:b0:2d0:cc92:f7c2 with SMTP id d9443c01a7336-2d670b4cdc9mr375142645ad.1.1787593777427; Mon, 24 Aug 2026 10:49:37 -0700 (PDT) Date: Mon, 24 Aug 2026 10:49:36 -0700 In-Reply-To: <20260822190224.3788887-1-nicoyip.dev@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260822190224.3788887-1-nicoyip.dev@gmail.com> Message-ID: Subject: Re: [PATCH] KVM: x86/mmu: Protect noncoherent DMA zaps with SRCU From: Sean Christopherson To: Chengfeng Ye Cc: Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Yan Zhao , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Type: text/plain; charset="us-ascii" On Sun, Aug 23, 2026, Chengfeng Ye wrote: > Fixes: 362ff6dca541 ("KVM: x86/mmu: Zap KVM TDP when noncoherent DMA assignment starts/stops") > Cc: stable@vger.kernel.org > Signed-off-by: Chengfeng Ye > --- > arch/x86/kvm/x86.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > index 69469bbdc84a..2114553f3159 100644 > --- a/arch/x86/kvm/x86.c > +++ b/arch/x86/kvm/x86.c > @@ -14092,8 +14092,12 @@ static void kvm_noncoherent_dma_assignment_start_or_stop(struct kvm *kvm) > * > * If KVM always honors guest PAT, however, there is nothing to do. > */ > - if (kvm_check_has_quirk(kvm, KVM_X86_QUIRK_IGNORE_GUEST_PAT)) > + if (kvm_check_has_quirk(kvm, KVM_X86_QUIRK_IGNORE_GUEST_PAT)) { > + int idx = srcu_read_lock(&kvm->srcu); Please do: guard(srcu)(&kvm->srcu); even though this is tagged for stable. Alternatively, what if we have kvm_zap_gfn_range() acquire SRCU? Nesting "locks" is a-ok, and two of the three users of kvm_zap_gfn_range() have had this bug (see commit 074c00800719 ("KVM: x86: Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()"). diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 6c13da942bfc..34e9eebb38af 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -7072,6 +7072,8 @@ void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end) if (WARN_ON_ONCE(gfn_end <= gfn_start)) return; + guard(srcu)(&kvm->srcu); + write_lock(&kvm->mmu_lock); kvm_mmu_invalidate_start(kvm); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 0626e835e9eb..9ecbaea69677 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7875,10 +7875,8 @@ void __kvm_set_or_clear_apicv_inhibit(struct kvm *kvm, kvm->arch.apicv_inhibit_reasons = new; if (new) { unsigned long gfn = gpa_to_gfn(APIC_DEFAULT_PHYS_BASE); - int idx = srcu_read_lock(&kvm->srcu); kvm_zap_gfn_range(kvm, gfn, gfn+1); - srcu_read_unlock(&kvm->srcu, idx); } } else { kvm->arch.apicv_inhibit_reasons = new; > + > kvm_zap_gfn_range(kvm, gpa_to_gfn(0), gpa_to_gfn(~0ULL)); > + srcu_read_unlock(&kvm->srcu, idx); > + } > } > > void kvm_arch_register_noncoherent_dma(struct kvm *kvm) > -- > 2.43.0