[Question] mshv: unpopulated parts of a movable region after removal

[Yuho Choi <oss.patchbox@gmail.com>]

Hi,

I have a question about how a movable memory region is unmapped when it
is removed (mainline 067c5c24cef2), and would appreciate your view.

When a movable region is created, mshv_map_user_memory() maps its whole
GPA range with HV_MAP_GPA_NO_ACCESS. mshv_region_range_fault() later
fills in the page array and remaps the faulted pages with access, and
mshv_region_interval_invalidate() remaps invalidated pages with no
access again and clears their entries in the page array.

When the region is destroyed, mshv_region_destroy() calls
mshv_region_unmap(), which goes through mshv_region_process_range().
That walk skips the entries that have no page, so only the parts that
currently have pages are unmapped. The parts that were never faulted in,
or were invalidated, are not unmapped. Before commit abceb4297bf8
("mshv: Fix huge page handling in memory region traversal"), the whole
GPA range was unmapped with one hv_call_unmap_gpa_pages() call.

If I read this correctly, the hypervisor keeps those GPAs mapped with no
access after the region is removed. A guest access to them would then
come back as HVMSG_GPA_INTERCEPT rather than HVMSG_UNMAPPED_GPA, and the
mappings would stay until the GPAs are mapped again or the partition is
destroyed.

Is this intended, for example because the hypervisor treats a no-access
mapping like an unmapped GPA? Or should mshv_region_destroy() unmap
these parts as well? If so, does the unmap need to follow how they were
mapped: 4K pages when the region is created, and large pages when an
invalidated range covered a huge page?

I found this during in-house security research and have not reproduced it.

Thanks,
Yuho