From nobody Mon Sep 29 21:15:49 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22A65C00140 for ; Mon, 15 Aug 2022 21:52:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350322AbiHOVwr (ORCPT ); Mon, 15 Aug 2022 17:52:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350293AbiHOVrh (ORCPT ); Mon, 15 Aug 2022 17:47:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1405D2A275; Mon, 15 Aug 2022 12:31:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CCD18B8107A; Mon, 15 Aug 2022 19:31:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F14DC433D6; Mon, 15 Aug 2022 19:31:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660591907; bh=qQyraYE4LbhTbwMvV6lt7Z7x61Pv/yXQ96/5OMaQNNo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gbkfqy/bMsIX4FgTrjGVaFn6CWbpG9FX9Be9JNNmXw64sd+oFvV2xBukx8qy31krY o0ZL4zXmkdtgz34LUO8zWKXBL0aMKqm1p7d/omn74g77o6ggURbA8mobPo0pRA8x6Q t9L7X70ZSqP6v2670wfhQtSKX0kTBNxZ4ozXewTk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lai Jiangshan , Sean Christopherson , Paolo Bonzini Subject: [PATCH 5.19 0029/1157] KVM: Fully serialize gfn=>pfn cache refresh via mutex Date: Mon, 15 Aug 2022 19:49:45 +0200 Message-Id: <20220815180440.596564836@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180439.416659447@linuxfoundation.org> References: <20220815180439.416659447@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit 93984f19e7bce4c18084a6ef3dacafb155b806ed upstream. Protect gfn=3D>pfn cache refresh with a mutex to fully serialize refreshes. The refresh logic doesn't protect against - concurrent unmaps, or refreshes with different GPAs (which may or may not happen in practice, for example if a cache is only used under vcpu->mutex; but it's allowed in the code) - a false negative on the memslot generation. If the first refresh sees a stale memslot generation, it will refresh the hva and generation before moving on to the hva=3D>pfn translation. If it then drops gpc->lock, a different user of the cache can come along, acquire gpc->lock, see that the memslot generation is fresh, and skip the hva=3D>pfn update due to the userspace address also matching (because it too was updated). The refresh path can already sleep during hva=3D>pfn resolution, so wrap the refresh with a mutex to ensure that any given refresh runs to completion before other callers can start their refresh. Cc: stable@vger.kernel.org Cc: Lai Jiangshan Signed-off-by: Sean Christopherson Message-Id: <20220429210025.3293691-7-seanjc@google.com> Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- include/linux/kvm_types.h | 2 ++ virt/kvm/pfncache.c | 12 ++++++++++++ 2 files changed, 14 insertions(+) --- a/include/linux/kvm_types.h +++ b/include/linux/kvm_types.h @@ -19,6 +19,7 @@ struct kvm_memslots; enum kvm_mr_change; =20 #include +#include #include #include =20 @@ -69,6 +70,7 @@ struct gfn_to_pfn_cache { struct kvm_vcpu *vcpu; struct list_head list; rwlock_t lock; + struct mutex refresh_lock; void *khva; kvm_pfn_t pfn; enum pfn_cache_usage usage; --- a/virt/kvm/pfncache.c +++ b/virt/kvm/pfncache.c @@ -157,6 +157,13 @@ int kvm_gfn_to_pfn_cache_refresh(struct if (page_offset + len > PAGE_SIZE) return -EINVAL; =20 + /* + * If another task is refreshing the cache, wait for it to complete. + * There is no guarantee that concurrent refreshes will see the same + * gpa, memslots generation, etc..., so they must be fully serialized. + */ + mutex_lock(&gpc->refresh_lock); + write_lock_irq(&gpc->lock); =20 old_pfn =3D gpc->pfn; @@ -250,6 +257,8 @@ int kvm_gfn_to_pfn_cache_refresh(struct out: write_unlock_irq(&gpc->lock); =20 + mutex_unlock(&gpc->refresh_lock); + gpc_release_pfn_and_khva(kvm, old_pfn, old_khva); =20 return ret; @@ -261,6 +270,7 @@ void kvm_gfn_to_pfn_cache_unmap(struct k void *old_khva; kvm_pfn_t old_pfn; =20 + mutex_lock(&gpc->refresh_lock); write_lock_irq(&gpc->lock); =20 gpc->valid =3D false; @@ -276,6 +286,7 @@ void kvm_gfn_to_pfn_cache_unmap(struct k gpc->pfn =3D KVM_PFN_ERR_FAULT; =20 write_unlock_irq(&gpc->lock); + mutex_unlock(&gpc->refresh_lock); =20 gpc_release_pfn_and_khva(kvm, old_pfn, old_khva); } @@ -290,6 +301,7 @@ int kvm_gfn_to_pfn_cache_init(struct kvm =20 if (!gpc->active) { rwlock_init(&gpc->lock); + mutex_init(&gpc->refresh_lock); =20 gpc->khva =3D NULL; gpc->pfn =3D KVM_PFN_ERR_FAULT;