Commit f8160295 authored by Lai Jiangshan's avatar Lai Jiangshan Committed by Paolo Bonzini
Browse files

KVM: X86: Fix missed remote tlb flush in rmap_write_protect() 



When kvm->tlbs_dirty > 0, some rmaps might have been deleted
without flushing tlb remotely after kvm_sync_page().  If @gfn
was writable before and it's rmaps was deleted in kvm_sync_page(),
and if the tlb entry is still in a remote running VCPU,  the @gfn
is not safely protected.

To fix the problem, kvm_sync_page() does the remote flush when
needed to avoid the problem.

Fixes: a4ee1ca4 ("KVM: MMU: delay flush all tlbs on sync_page path")
Signed-off-by: default avatarLai Jiangshan <laijs@linux.alibaba.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Message-Id: <20210918005636.3675-2-jiangshanlai@gmail.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent faf6b755

arch/x86/kvm/mmu/paging_tmpl.h

+2 −21
Original line number Diff line number Diff line
@@ -1047,14 +1047,6 @@ static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gpa_t vaddr, 
 * Using the cached information from sp->gfns is safe because:

 * - The spte has a reference to the struct page, so the pfn for a given gfn

 *   can't change unless all sptes pointing to it are nuked first.

 *

 * Note:

 *   We should flush all tlbs if spte is dropped even though guest is

 *   responsible for it. Since if we don't, kvm_mmu_notifier_invalidate_page

 *   and kvm_mmu_notifier_invalidate_range_start detect the mapping page isn't

 *   used by guest then tlbs are not flushed, so guest is allowed to access the

 *   freed pages.

 *   And we increase kvm->tlbs_dirty to delay tlbs flush in this case.

 */

static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)

{
@@ -1107,13 +1099,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp) 
			return 0;



		if (FNAME(prefetch_invalid_gpte)(vcpu, sp, &sp->spt[i], gpte)) {

			/*

			 * Update spte before increasing tlbs_dirty to make

			 * sure no tlb flush is lost after spte is zapped; see

			 * the comments in kvm_flush_remote_tlbs().

			 */

			smp_wmb();

			vcpu->kvm->tlbs_dirty++;

			set_spte_ret |= SET_SPTE_NEED_REMOTE_TLB_FLUSH;

			continue;

		}
@@ -1128,12 +1114,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp) 


		if (gfn != sp->gfns[i]) {

			drop_spte(vcpu->kvm, &sp->spt[i]);

			/*

			 * The same as above where we are doing

			 * prefetch_invalid_gpte().

			 */

			smp_wmb();

			vcpu->kvm->tlbs_dirty++;

			set_spte_ret |= SET_SPTE_NEED_REMOTE_TLB_FLUSH;

			continue;

		}