* [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory slot [not found] <20230714033247.3791879-1-tien.sung.ang@intel.com> @ 2023-07-14 3:32 ` tien.sung.ang 2023-07-14 5:41 ` Ang, Tien Sung 0 siblings, 1 reply; 4+ messages in thread From: tien.sung.ang @ 2023-07-14 3:32 UTC (permalink / raw) To: tien.sung.ang Cc: Gavin Shan, stable, Shuai Hu, Zhenyu Zhang, David Hildenbrand, Oliver Upton, Peter Xu, Sean Christopherson, Shaoqin Huang, Paolo Bonzini From: Gavin Shan <gshan@redhat.com> We run into guest hang in edk2 firmware when KSM is kept as running on the host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device (TYPE_PFLASH_CFI01) during the operation of sector erasing or buffered write. The status is returned by reading the memory region of the pflash device and the read request should have been forwarded to QEMU and emulated by it. Unfortunately, the read request is covered by an illegal stage2 mapping when the guest hang issue occurs. The read request is completed with QEMU bypassed and wrong status is fetched. The edk2 firmware runs into an infinite loop with the wrong status. The illegal stage2 mapping is populated due to same page sharing by KSM at (C) even the associated memory slot has been marked as invalid at (B) when the memory slot is requested to be deleted. It's notable that the active and inactive memory slots can't be swapped when we're in the middle of kvm_mmu_notifier_change_pte() because kvm->mn_active_invalidate_count is elevated, and kvm_swap_active_memslots() will busy loop until it reaches to zero again. Besides, the swapping from the active to the inactive memory slots is also avoided by holding &kvm->srcu in __kvm_handle_hva_range(), corresponding to synchronize_srcu_expedited() in kvm_swap_active_memslots(). CPU-A CPU-B ----- ----- ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) kvm_vm_ioctl_set_memory_region kvm_set_memory_region __kvm_set_memory_region kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE) kvm_invalidate_memslot kvm_copy_memslot kvm_replace_memslot kvm_swap_active_memslots (A) kvm_arch_flush_shadow_memslot (B) same page sharing by KSM kvm_mmu_notifier_invalidate_range_start : kvm_mmu_notifier_change_pte kvm_handle_hva_range __kvm_handle_hva_range kvm_set_spte_gfn (C) : kvm_mmu_notifier_invalidate_range_end Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal stage2 mapping so that the read request for the pflash's status is forwarded to QEMU and emulated by it. In this way, the correct pflash's status can be returned from QEMU to break the infinite loop in the edk2 firmware. We tried a git-bisect and the first problematic commit is cd4c71835228 (" KVM: arm64: Convert to the gfn-based MMU notifier callbacks"). With this, clean_dcache_guest_page() is called after the memory slots are iterated in kvm_mmu_notifier_change_pte(). clean_dcache_guest_page() is called before the iteration on the memory slots before this commit. This change literally enlarges the racy window between kvm_mmu_notifier_change_pte() and memory slot removal so that we're able to reproduce the issue in a practical test case. However, the issue exists since commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup"). Cc: stable@vger.kernel.org # v3.9+ Fixes: d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") Reported-by: Shuai Hu <hshuai@redhat.com> Reported-by: Zhenyu Zhang <zhenyzha@redhat.com> Signed-off-by: Gavin Shan <gshan@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Oliver Upton <oliver.upton@linux.dev> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Shaoqin Huang <shahuang@redhat.com> Message-Id: <20230615054259.14911-1-gshan@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> --- virt/kvm/kvm_main.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 479802a892d4..65f94f592ff8 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -686,6 +686,24 @@ static __always_inline int kvm_handle_hva_range_no_flush(struct mmu_notifier *mn return __kvm_handle_hva_range(kvm, &range); } + +static bool kvm_change_spte_gfn(struct kvm *kvm, struct kvm_gfn_range *range) +{ + /* + * Skipping invalid memslots is correct if and only change_pte() is + * surrounded by invalidate_range_{start,end}(), which is currently + * guaranteed by the primary MMU. If that ever changes, KVM needs to + * unmap the memslot instead of skipping the memslot to ensure that KVM + * doesn't hold references to the old PFN. + */ + WARN_ON_ONCE(!READ_ONCE(kvm->mn_active_invalidate_count)); + + if (range->slot->flags & KVM_MEMSLOT_INVALID) + return false; + + return kvm_set_spte_gfn(kvm, range); +} + static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, struct mm_struct *mm, unsigned long address, @@ -707,7 +725,7 @@ static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, if (!READ_ONCE(kvm->mmu_invalidate_in_progress)) return; - kvm_handle_hva_range(mn, address, address + 1, pte, kvm_set_spte_gfn); + kvm_handle_hva_range(mn, address, address + 1, pte, kvm_change_spte_gfn); } void kvm_mmu_invalidate_begin(struct kvm *kvm, unsigned long start, -- 2.25.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory slot 2023-07-14 3:32 ` [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory slot tien.sung.ang @ 2023-07-14 5:41 ` Ang, Tien Sung 0 siblings, 0 replies; 4+ messages in thread From: Ang, Tien Sung @ 2023-07-14 5:41 UTC (permalink / raw) Cc: Gavin Shan, stable@vger.kernel.org, Shuai Hu, Zhenyu Zhang, David Hildenbrand, Oliver Upton, Peter Xu, Christopherson,, Sean, Shaoqin Huang, Paolo Bonzini Please ignore this email. It was sent as a mistake. > -----Original Message----- > From: Ang, Tien Sung <tien.sung.ang@intel.com> > Sent: Friday, 14 July, 2023 11:33 AM > To: Ang, Tien Sung <tien.sung.ang@intel.com> > Cc: Gavin Shan <gshan@redhat.com>; stable@vger.kernel.org; Shuai Hu > <hshuai@redhat.com>; Zhenyu Zhang <zhenyzha@redhat.com>; David > Hildenbrand <david@redhat.com>; Oliver Upton <oliver.upton@linux.dev>; > Peter Xu <peterx@redhat.com>; Christopherson,, Sean > <seanjc@google.com>; Shaoqin Huang <shahuang@redhat.com>; Paolo > Bonzini <pbonzini@redhat.com> > Subject: [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory > slot > > From: Gavin Shan <gshan@redhat.com> > > We run into guest hang in edk2 firmware when KSM is kept as running on the > host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device > (TYPE_PFLASH_CFI01) during the operation of sector erasing or buffered > write. The status is returned by reading the memory region of the pflash > device and the read request should have been forwarded to QEMU and > emulated by it. Unfortunately, the read request is covered by an illegal > stage2 mapping when the guest hang issue occurs. The read request is > completed with QEMU bypassed and wrong status is fetched. The edk2 > firmware runs into an infinite loop with the wrong status. > > The illegal stage2 mapping is populated due to same page sharing by KSM at > (C) even the associated memory slot has been marked as invalid at (B) when > the memory slot is requested to be deleted. It's notable that the active and > inactive memory slots can't be swapped when we're in the middle of > kvm_mmu_notifier_change_pte() because kvm- > >mn_active_invalidate_count is elevated, and > kvm_swap_active_memslots() will busy loop until it reaches to zero again. > Besides, the swapping from the active to the inactive memory slots is also > avoided by holding &kvm->srcu in __kvm_handle_hva_range(), > corresponding to synchronize_srcu_expedited() in > kvm_swap_active_memslots(). > > CPU-A CPU-B > ----- ----- > ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) > kvm_vm_ioctl_set_memory_region > kvm_set_memory_region > __kvm_set_memory_region > kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE) > kvm_invalidate_memslot > kvm_copy_memslot > kvm_replace_memslot > kvm_swap_active_memslots (A) > kvm_arch_flush_shadow_memslot (B) > same page sharing by KSM > kvm_mmu_notifier_invalidate_range_start > : > kvm_mmu_notifier_change_pte > kvm_handle_hva_range > __kvm_handle_hva_range > kvm_set_spte_gfn (C) > : > kvm_mmu_notifier_invalidate_range_end > > Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal > stage2 mapping so that the read request for the pflash's status is forwarded > to QEMU and emulated by it. In this way, the correct pflash's status can be > returned from QEMU to break the infinite loop in the edk2 firmware. > > We tried a git-bisect and the first problematic commit is cd4c71835228 (" > KVM: arm64: Convert to the gfn-based MMU notifier callbacks"). With this, > clean_dcache_guest_page() is called after the memory slots are iterated in > kvm_mmu_notifier_change_pte(). clean_dcache_guest_page() is called > before the iteration on the memory slots before this commit. This change > literally enlarges the racy window between > kvm_mmu_notifier_change_pte() and memory slot removal so that we're > able to reproduce the issue in a practical test case. However, the issue exists > since commit d5d8184d35c9 > ("KVM: ARM: Memory virtualization setup"). > > Cc: stable@vger.kernel.org # v3.9+ > Fixes: d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") > Reported-by: Shuai Hu <hshuai@redhat.com> > Reported-by: Zhenyu Zhang <zhenyzha@redhat.com> > Signed-off-by: Gavin Shan <gshan@redhat.com> > Reviewed-by: David Hildenbrand <david@redhat.com> > Reviewed-by: Oliver Upton <oliver.upton@linux.dev> > Reviewed-by: Peter Xu <peterx@redhat.com> > Reviewed-by: Sean Christopherson <seanjc@google.com> > Reviewed-by: Shaoqin Huang <shahuang@redhat.com> > Message-Id: <20230615054259.14911-1-gshan@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > virt/kvm/kvm_main.c | 20 +++++++++++++++++++- > 1 file changed, 19 insertions(+), 1 deletion(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index > 479802a892d4..65f94f592ff8 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -686,6 +686,24 @@ static __always_inline int > kvm_handle_hva_range_no_flush(struct mmu_notifier *mn > > return __kvm_handle_hva_range(kvm, &range); } > + > +static bool kvm_change_spte_gfn(struct kvm *kvm, struct kvm_gfn_range > +*range) { > + /* > + * Skipping invalid memslots is correct if and only change_pte() is > + * surrounded by invalidate_range_{start,end}(), which is currently > + * guaranteed by the primary MMU. If that ever changes, KVM > needs to > + * unmap the memslot instead of skipping the memslot to ensure > that KVM > + * doesn't hold references to the old PFN. > + */ > + WARN_ON_ONCE(!READ_ONCE(kvm- > >mn_active_invalidate_count)); > + > + if (range->slot->flags & KVM_MEMSLOT_INVALID) > + return false; > + > + return kvm_set_spte_gfn(kvm, range); > +} > + > static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, > struct mm_struct *mm, > unsigned long address, > @@ -707,7 +725,7 @@ static void kvm_mmu_notifier_change_pte(struct > mmu_notifier *mn, > if (!READ_ONCE(kvm->mmu_invalidate_in_progress)) > return; > > - kvm_handle_hva_range(mn, address, address + 1, pte, > kvm_set_spte_gfn); > + kvm_handle_hva_range(mn, address, address + 1, pte, > +kvm_change_spte_gfn); > } > > void kvm_mmu_invalidate_begin(struct kvm *kvm, unsigned long start, > -- > 2.25.1 ^ permalink raw reply [flat|nested] 4+ messages in thread
[parent not found: <cover.1689305655.git.tien.sung.ang@intel.com>]
* [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory slot [not found] <cover.1689305655.git.tien.sung.ang@intel.com> @ 2023-07-14 3:34 ` tien.sung.ang 2023-07-14 5:40 ` Ang, Tien Sung 0 siblings, 1 reply; 4+ messages in thread From: tien.sung.ang @ 2023-07-14 3:34 UTC (permalink / raw) To: tien.sung.ang Cc: Gavin Shan, stable, Shuai Hu, Zhenyu Zhang, David Hildenbrand, Oliver Upton, Peter Xu, Sean Christopherson, Shaoqin Huang, Paolo Bonzini From: Gavin Shan <gshan@redhat.com> We run into guest hang in edk2 firmware when KSM is kept as running on the host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device (TYPE_PFLASH_CFI01) during the operation of sector erasing or buffered write. The status is returned by reading the memory region of the pflash device and the read request should have been forwarded to QEMU and emulated by it. Unfortunately, the read request is covered by an illegal stage2 mapping when the guest hang issue occurs. The read request is completed with QEMU bypassed and wrong status is fetched. The edk2 firmware runs into an infinite loop with the wrong status. The illegal stage2 mapping is populated due to same page sharing by KSM at (C) even the associated memory slot has been marked as invalid at (B) when the memory slot is requested to be deleted. It's notable that the active and inactive memory slots can't be swapped when we're in the middle of kvm_mmu_notifier_change_pte() because kvm->mn_active_invalidate_count is elevated, and kvm_swap_active_memslots() will busy loop until it reaches to zero again. Besides, the swapping from the active to the inactive memory slots is also avoided by holding &kvm->srcu in __kvm_handle_hva_range(), corresponding to synchronize_srcu_expedited() in kvm_swap_active_memslots(). CPU-A CPU-B ----- ----- ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) kvm_vm_ioctl_set_memory_region kvm_set_memory_region __kvm_set_memory_region kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE) kvm_invalidate_memslot kvm_copy_memslot kvm_replace_memslot kvm_swap_active_memslots (A) kvm_arch_flush_shadow_memslot (B) same page sharing by KSM kvm_mmu_notifier_invalidate_range_start : kvm_mmu_notifier_change_pte kvm_handle_hva_range __kvm_handle_hva_range kvm_set_spte_gfn (C) : kvm_mmu_notifier_invalidate_range_end Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal stage2 mapping so that the read request for the pflash's status is forwarded to QEMU and emulated by it. In this way, the correct pflash's status can be returned from QEMU to break the infinite loop in the edk2 firmware. We tried a git-bisect and the first problematic commit is cd4c71835228 (" KVM: arm64: Convert to the gfn-based MMU notifier callbacks"). With this, clean_dcache_guest_page() is called after the memory slots are iterated in kvm_mmu_notifier_change_pte(). clean_dcache_guest_page() is called before the iteration on the memory slots before this commit. This change literally enlarges the racy window between kvm_mmu_notifier_change_pte() and memory slot removal so that we're able to reproduce the issue in a practical test case. However, the issue exists since commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup"). Cc: stable@vger.kernel.org # v3.9+ Fixes: d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") Reported-by: Shuai Hu <hshuai@redhat.com> Reported-by: Zhenyu Zhang <zhenyzha@redhat.com> Signed-off-by: Gavin Shan <gshan@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Oliver Upton <oliver.upton@linux.dev> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Shaoqin Huang <shahuang@redhat.com> Message-Id: <20230615054259.14911-1-gshan@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> --- virt/kvm/kvm_main.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 479802a892d4..65f94f592ff8 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -686,6 +686,24 @@ static __always_inline int kvm_handle_hva_range_no_flush(struct mmu_notifier *mn return __kvm_handle_hva_range(kvm, &range); } + +static bool kvm_change_spte_gfn(struct kvm *kvm, struct kvm_gfn_range *range) +{ + /* + * Skipping invalid memslots is correct if and only change_pte() is + * surrounded by invalidate_range_{start,end}(), which is currently + * guaranteed by the primary MMU. If that ever changes, KVM needs to + * unmap the memslot instead of skipping the memslot to ensure that KVM + * doesn't hold references to the old PFN. + */ + WARN_ON_ONCE(!READ_ONCE(kvm->mn_active_invalidate_count)); + + if (range->slot->flags & KVM_MEMSLOT_INVALID) + return false; + + return kvm_set_spte_gfn(kvm, range); +} + static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, struct mm_struct *mm, unsigned long address, @@ -707,7 +725,7 @@ static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, if (!READ_ONCE(kvm->mmu_invalidate_in_progress)) return; - kvm_handle_hva_range(mn, address, address + 1, pte, kvm_set_spte_gfn); + kvm_handle_hva_range(mn, address, address + 1, pte, kvm_change_spte_gfn); } void kvm_mmu_invalidate_begin(struct kvm *kvm, unsigned long start, -- 2.25.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory slot 2023-07-14 3:34 ` tien.sung.ang @ 2023-07-14 5:40 ` Ang, Tien Sung 0 siblings, 0 replies; 4+ messages in thread From: Ang, Tien Sung @ 2023-07-14 5:40 UTC (permalink / raw) Cc: Gavin Shan, stable@vger.kernel.org, Shuai Hu, Zhenyu Zhang, David Hildenbrand, Oliver Upton, Peter Xu, Christopherson,, Sean, Shaoqin Huang, Paolo Bonzini Please ignore this email. It was sent as a mistake. > -----Original Message----- > From: Ang, Tien Sung <tien.sung.ang@intel.com> > Sent: Friday, 14 July, 2023 11:35 AM > To: Ang, Tien Sung <tien.sung.ang@intel.com> > Cc: Gavin Shan <gshan@redhat.com>; stable@vger.kernel.org; Shuai Hu > <hshuai@redhat.com>; Zhenyu Zhang <zhenyzha@redhat.com>; David > Hildenbrand <david@redhat.com>; Oliver Upton <oliver.upton@linux.dev>; > Peter Xu <peterx@redhat.com>; Christopherson,, Sean > <seanjc@google.com>; Shaoqin Huang <shahuang@redhat.com>; Paolo > Bonzini <pbonzini@redhat.com> > Subject: [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory > slot > > From: Gavin Shan <gshan@redhat.com> > > We run into guest hang in edk2 firmware when KSM is kept as running on the > host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device > (TYPE_PFLASH_CFI01) during the operation of sector erasing or buffered > write. The status is returned by reading the memory region of the pflash > device and the read request should have been forwarded to QEMU and > emulated by it. Unfortunately, the read request is covered by an illegal > stage2 mapping when the guest hang issue occurs. The read request is > completed with QEMU bypassed and wrong status is fetched. The edk2 > firmware runs into an infinite loop with the wrong status. > > The illegal stage2 mapping is populated due to same page sharing by KSM at > (C) even the associated memory slot has been marked as invalid at (B) when > the memory slot is requested to be deleted. It's notable that the active and > inactive memory slots can't be swapped when we're in the middle of > kvm_mmu_notifier_change_pte() because kvm- > >mn_active_invalidate_count is elevated, and > kvm_swap_active_memslots() will busy loop until it reaches to zero again. > Besides, the swapping from the active to the inactive memory slots is also > avoided by holding &kvm->srcu in __kvm_handle_hva_range(), > corresponding to synchronize_srcu_expedited() in > kvm_swap_active_memslots(). > > CPU-A CPU-B > ----- ----- > ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) > kvm_vm_ioctl_set_memory_region > kvm_set_memory_region > __kvm_set_memory_region > kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE) > kvm_invalidate_memslot > kvm_copy_memslot > kvm_replace_memslot > kvm_swap_active_memslots (A) > kvm_arch_flush_shadow_memslot (B) > same page sharing by KSM > kvm_mmu_notifier_invalidate_range_start > : > kvm_mmu_notifier_change_pte > kvm_handle_hva_range > __kvm_handle_hva_range > kvm_set_spte_gfn (C) > : > kvm_mmu_notifier_invalidate_range_end > > Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal > stage2 mapping so that the read request for the pflash's status is forwarded > to QEMU and emulated by it. In this way, the correct pflash's status can be > returned from QEMU to break the infinite loop in the edk2 firmware. > > We tried a git-bisect and the first problematic commit is cd4c71835228 (" > KVM: arm64: Convert to the gfn-based MMU notifier callbacks"). With this, > clean_dcache_guest_page() is called after the memory slots are iterated in > kvm_mmu_notifier_change_pte(). clean_dcache_guest_page() is called > before the iteration on the memory slots before this commit. This change > literally enlarges the racy window between > kvm_mmu_notifier_change_pte() and memory slot removal so that we're > able to reproduce the issue in a practical test case. However, the issue exists > since commit d5d8184d35c9 > ("KVM: ARM: Memory virtualization setup"). > > Cc: stable@vger.kernel.org # v3.9+ > Fixes: d5d8184d35c9 ("KVM: ARM: Memory virtualization setup") > Reported-by: Shuai Hu <hshuai@redhat.com> > Reported-by: Zhenyu Zhang <zhenyzha@redhat.com> > Signed-off-by: Gavin Shan <gshan@redhat.com> > Reviewed-by: David Hildenbrand <david@redhat.com> > Reviewed-by: Oliver Upton <oliver.upton@linux.dev> > Reviewed-by: Peter Xu <peterx@redhat.com> > Reviewed-by: Sean Christopherson <seanjc@google.com> > Reviewed-by: Shaoqin Huang <shahuang@redhat.com> > Message-Id: <20230615054259.14911-1-gshan@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > virt/kvm/kvm_main.c | 20 +++++++++++++++++++- > 1 file changed, 19 insertions(+), 1 deletion(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index > 479802a892d4..65f94f592ff8 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -686,6 +686,24 @@ static __always_inline int > kvm_handle_hva_range_no_flush(struct mmu_notifier *mn > > return __kvm_handle_hva_range(kvm, &range); } > + > +static bool kvm_change_spte_gfn(struct kvm *kvm, struct kvm_gfn_range > +*range) { > + /* > + * Skipping invalid memslots is correct if and only change_pte() is > + * surrounded by invalidate_range_{start,end}(), which is currently > + * guaranteed by the primary MMU. If that ever changes, KVM > needs to > + * unmap the memslot instead of skipping the memslot to ensure > that KVM > + * doesn't hold references to the old PFN. > + */ > + WARN_ON_ONCE(!READ_ONCE(kvm- > >mn_active_invalidate_count)); > + > + if (range->slot->flags & KVM_MEMSLOT_INVALID) > + return false; > + > + return kvm_set_spte_gfn(kvm, range); > +} > + > static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, > struct mm_struct *mm, > unsigned long address, > @@ -707,7 +725,7 @@ static void kvm_mmu_notifier_change_pte(struct > mmu_notifier *mn, > if (!READ_ONCE(kvm->mmu_invalidate_in_progress)) > return; > > - kvm_handle_hva_range(mn, address, address + 1, pte, > kvm_set_spte_gfn); > + kvm_handle_hva_range(mn, address, address + 1, pte, > +kvm_change_spte_gfn); > } > > void kvm_mmu_invalidate_begin(struct kvm *kvm, unsigned long start, > -- > 2.25.1 ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-07-14 5:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20230714033247.3791879-1-tien.sung.ang@intel.com>
2023-07-14 3:32 ` [PATCH 1/2] KVM: Avoid illegal stage2 mapping on invalid memory slot tien.sung.ang
2023-07-14 5:41 ` Ang, Tien Sung
[not found] <cover.1689305655.git.tien.sung.ang@intel.com>
2023-07-14 3:34 ` tien.sung.ang
2023-07-14 5:40 ` Ang, Tien Sung
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox