From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D64B73F65F9 for ; Fri, 26 Jun 2026 11:27:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782473225; cv=none; b=YIgaWgdvpngIpBv2e2iT7/JKl9SOOphQcB6hIZw6798YQls+VC75T6VAmS9MbmfkOulIfmx8ZMbFdhq5tILkxnsNWApi9w9dtLsQSOugyhXD/MDPY/k5mfZfleD2jBPstNMAa5WYVh+pEF2ggHoSLM80XJe+4DkqLjobh4yB2R0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782473225; c=relaxed/simple; bh=WXl9yLoUo76hOiTJglihhCL7gCr4ibYOhM31n/ceHRU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RkOhSnLDilkQbE/7qLN3IMe/Qi9Tm+UAlQFYM7W8FvcGOtK8fo9/5egUhcXP3QvzD9a32rMcwxtLZ6MaYVO39B818sDeuY9ZKSiLwkpeMdtpeNqVvJz62rogoCAJqZfq15YCMyTMdtfaLaDy/THe3Gk2OtcHpIFJTKLZCyGw5Og= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=G4KwDw84; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=ABwRMjnO; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="G4KwDw84"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="ABwRMjnO" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782473219; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wNsphw/JwWnRotYMp01A5Ccsyrc1xSlMCc+z3bGtV58=; b=G4KwDw84hCB0+3FEGWKK6MtdH9t1qfyPObQLkkwELVrbMJJltfRF33cD1E+gHKfTJa42eB 4U/wHrvnaldRX58Y+zmiJwK6ObT3dph5LBAYQy6zl2EXi2pXJZN1vBf4iXnwpiURlWM4vX 3COn5lpF7VsyhX7+JpHsUuUAVugJuDA= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-492-G_X-pVquNJOBI83v1il5jQ-1; Fri, 26 Jun 2026 07:26:58 -0400 X-MC-Unique: G_X-pVquNJOBI83v1il5jQ-1 X-Mimecast-MFC-AGG-ID: G_X-pVquNJOBI83v1il5jQ_1782473217 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-490b4d3d3e6so6439425e9.0 for ; Fri, 26 Jun 2026 04:26:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1782473217; x=1783078017; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=wNsphw/JwWnRotYMp01A5Ccsyrc1xSlMCc+z3bGtV58=; b=ABwRMjnONJ9O6ESb8b+BYczP0lpaLN1pdVfqJBxitDqlNlw5XCbatLcvbo9yQs83vo nWojnx635WNy8n01q77/BzHSEqZShh3FbGrdJhFOjxEOGnA+A9gw/45scI+sK4ytrIyz jPtE6/hLmw4FFi1SrX/TTRMmu8rjiBWvGXiuk44ERlxOekiiRBSOYpfxpomY76i0xWrZ wKJgJYLN+SdKpbr5pyfyL2auy1CHZyCb8q4sJRk1MD4ah1j6A4SnBDpoJufkWpctUUIH btZq/zVDV6hwfRrGPU/JOHfXXrNrSxdruOqML8oYtlCI/eqBGJYDv2iWJ1QnuVfcKRoQ ZYZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782473217; x=1783078017; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=wNsphw/JwWnRotYMp01A5Ccsyrc1xSlMCc+z3bGtV58=; b=XVgtwvM0PUbH6tDBtAQxjQq/JFu1c1aV2HGbY6/D96IPXuNF+vjCAYgUSw82TdqbIJ HPcxkJKhLX1FptCO8V15UgBVcM5rmJjqQ55ZO9pI/iW2iUFsNK3HnqLzKFViBRG3XV2c nHim/3AJl49SIOLODrHQNn1Jse8JQU7Bd55FAbrbMV+rp6bjKh5tD4U7yQZhdtIrab2D KmmIaD+LuP2NvW7MxlfPh0KWSArlmOebs9PhqYLtUQWAYZLPa476Mh/jf17ZCsPAtchM WSUvfoQ/gkigUimQ0haOjK4uNN9PZ/PS2X+I5R2PZrEuWKnVz3HW9PWzhiJbTPFtd2j/ TzBg== X-Gm-Message-State: AOJu0Yz4GhSymdhHS0mzgyWUFHH05Ne8L/7jSPCxniuz1gOVpBYK+ABI 5p+cCSonVV+OCQA8+go9HTd+EyI0czpTTxUFSXzIYoJS6lORPyQf63/ImLiYEnTAK1YNGBe5Nyt 8p9RpMgenLhiQBrvfVTW9G2Qj6GJMEDKUqW+q+zX/5U3h+jsJGv9/9C+8TWAIHB8QgiRhl669lD LtVCsVVzC9iSoM/x8ZuKvrOIHhihaipNx8SgQ7Ivopvt8d5GW7xA== X-Gm-Gg: AfdE7ckkoO5WgTQ5CJiAnUefegPcfvI2EN4OfTki15iN1Bvs0lv26l0VfSo70jFSLhO h9dc94TJJIbn9XU7ptAQ7zT4pi/nTgf61I3lgpls0+CaN96lf3pV8aMHC+cpYQLGlF9eb5RWJR1 2OaOQMUVuzZ17dgLn8z9kf/7bvHsmG8gtlWeE4IqZ6xEWkKyOdxtsw+WJViUuNRf/YFghLf9llK TEuYONatEOyR6AXVrcozKurLd/MRKdf7wKMdQujAqq6Qw+XAuG5TvIqrfOkgMf1FugRCXQUZ+uZ Ck0RifZwo0aQJJasGU4GnTZVOthR+KUboRfkfCfPzLbtyBkOZn/i73OT7Rr2dRqzXwjbLXQDMpv Rfox1wKs0OrrtHRKhzM0+cy+O/cYMewyfv6zX3EDaNEisrW0cfuR/JSeEGbf635LgPnWKLxAfFU XWMUULo7uFVi30XbZr X-Received: by 2002:a05:600c:c4a3:b0:490:d354:bd00 with SMTP id 5b1f17b1804b1-4926fc8822cmr5708435e9.25.1782473217087; Fri, 26 Jun 2026 04:26:57 -0700 (PDT) X-Received: by 2002:a05:600c:c4a3:b0:490:d354:bd00 with SMTP id 5b1f17b1804b1-4926fc8822cmr5707695e9.25.1782473216411; Fri, 26 Jun 2026 04:26:56 -0700 (PDT) Received: from [192.168.10.48] ([151.95.124.208]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-492692d5149sm72533015e9.9.2026.06.26.04.26.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 04:26:55 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, stable@vger.kernel.org Cc: Lai Jiangshan Subject: [PATCH 5.10.y 08/17] KVM: X86: Fix missed remote tlb flush in rmap_write_protect() Date: Fri, 26 Jun 2026 13:26:25 +0200 Message-ID: <20260626112634.1778506-9-pbonzini@redhat.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260626112634.1778506-1-pbonzini@redhat.com> References: <20260626112634.1778506-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Lai Jiangshan commit f81602958c115fc7c87b985f71574042a20ff858 upstream. When kvm->tlbs_dirty > 0, some rmaps might have been deleted without flushing tlb remotely after kvm_sync_page(). If @gfn was writable before and it's rmaps was deleted in kvm_sync_page(), and if the tlb entry is still in a remote running VCPU, the @gfn is not safely protected. To fix the problem, kvm_sync_page() does the remote flush when needed to avoid the problem. Fixes: a4ee1ca4a36e ("KVM: MMU: delay flush all tlbs on sync_page path") Signed-off-by: Lai Jiangshan Signed-off-by: Paolo Bonzini Message-Id: <20210918005636.3675-2-jiangshanlai@gmail.com> Signed-off-by: Paolo Bonzini --- arch/x86/kvm/mmu/paging_tmpl.h | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h index c6daeeff1d9c..1500fc877aec 100644 --- a/arch/x86/kvm/mmu/paging_tmpl.h +++ b/arch/x86/kvm/mmu/paging_tmpl.h @@ -1007,14 +1007,6 @@ static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gpa_t vaddr, * Using the cached information from sp->gfns is safe because: * - The spte has a reference to the struct page, so the pfn for a given gfn * can't change unless all sptes pointing to it are nuked first. - * - * Note: - * We should flush all tlbs if spte is dropped even though guest is - * responsible for it. Since if we don't, kvm_mmu_notifier_invalidate_page - * and kvm_mmu_notifier_invalidate_range_start detect the mapping page isn't - * used by guest then tlbs are not flushed, so guest is allowed to access the - * freed pages. - * And we increase kvm->tlbs_dirty to delay tlbs flush in this case. */ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp) { @@ -1044,13 +1036,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp) return 0; if (FNAME(prefetch_invalid_gpte)(vcpu, sp, &sp->spt[i], gpte)) { - /* - * Update spte before increasing tlbs_dirty to make - * sure no tlb flush is lost after spte is zapped; see - * the comments in kvm_flush_remote_tlbs(). - */ - smp_wmb(); - vcpu->kvm->tlbs_dirty++; + set_spte_ret |= SET_SPTE_NEED_REMOTE_TLB_FLUSH; continue; } @@ -1065,12 +1051,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp) if (gfn != sp->gfns[i]) { drop_spte(vcpu->kvm, &sp->spt[i]); - /* - * The same as above where we are doing - * prefetch_invalid_gpte(). - */ - smp_wmb(); - vcpu->kvm->tlbs_dirty++; + set_spte_ret |= SET_SPTE_NEED_REMOTE_TLB_FLUSH; continue; } -- 2.54.0