From: Vitaly Kuznetsov <vkuznets@redhat.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Cc: Dave Young <ruyang@redhat.com>, Xiaoying Yan <yiyan@redhat.com>,
"Dr . David Alan Gilbert" <dgilbert@redhat.com>,
David Woodhouse <dwmw@amazon.co.uk>,
stable@vger.kernel.org
Subject: Re: [PATCH] KVM: x86: revalidate steal time cache if MSR value changes
Date: Thu, 04 Aug 2022 15:56:59 +0200 [thread overview]
Message-ID: <87v8r8yuvo.fsf@redhat.com> (raw)
In-Reply-To: <20220804132832.420648-1-pbonzini@redhat.com>
Paolo Bonzini <pbonzini@redhat.com> writes:
> Commit 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time
> / preempted status", 2021-11-11) open coded the previous call to
> kvm_map_gfn, but in doing so it dropped the comparison between the cached
> guest physical address and the one in the MSR. This cause an incorrect
> cache hit if the guest modifies the steal time address while the memslots
> remain the same. This can happen with kexec, in which case the steal
> time data is written at the address used by the old kernel instead of
> the old one.
>
> While at it, rename the variable from gfn to gpa since it is a plain
> physical address and not a right-shifted one.
>
> Reported-by: Dave Young <ruyang@redhat.com>
> Reported-by: Xiaoying Yan <yiyan@redhat.com>
> Analyzed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> Cc: David Woodhouse <dwmw@amazon.co.uk>
> Cc: stable@vger.kernel.org
> Fixes: 7e2175ebd695 ("KVM: x86: Fix recording of guest steal time / preempted status")
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
> arch/x86/kvm/x86.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index e5fa335a4ea7..36dcf18b04bf 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -3380,6 +3380,7 @@ static void record_steal_time(struct kvm_vcpu *vcpu)
> struct gfn_to_hva_cache *ghc = &vcpu->arch.st.cache;
> struct kvm_steal_time __user *st;
> struct kvm_memslots *slots;
> + gpa_t gpa = vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS;
> u64 steal;
> u32 version;
>
> @@ -3397,13 +3398,12 @@ static void record_steal_time(struct kvm_vcpu *vcpu)
> slots = kvm_memslots(vcpu->kvm);
>
> if (unlikely(slots->generation != ghc->generation ||
> + gpa != ghc->gpa ||
> kvm_is_error_hva(ghc->hva) || !ghc->memslot)) {
> - gfn_t gfn = vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS;
> -
> /* We rely on the fact that it fits in a single page. */
> BUILD_BUG_ON((sizeof(*st) - 1) & KVM_STEAL_VALID_BITS);
>
> - if (kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, gfn, sizeof(*st)) ||
> + if (kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, gpa, sizeof(*st)) ||
(It would be nice to somehow get at least a warning when 'gfn_t' is used
instead of 'gpa_t' and vice versa)
> kvm_is_error_hva(ghc->hva) || !ghc->memslot)
> return;
> }
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
--
Vitaly
next prev parent reply other threads:[~2022-08-04 13:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-04 13:28 [PATCH] KVM: x86: revalidate steal time cache if MSR value changes Paolo Bonzini
2022-08-04 13:56 ` Vitaly Kuznetsov [this message]
2022-08-04 17:08 ` Dr. David Alan Gilbert
2022-08-04 17:42 ` Sean Christopherson
2022-08-04 15:54 ` Dr. David Alan Gilbert
2022-08-08 12:42 ` [EXTERNAL] " David Woodhouse
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87v8r8yuvo.fsf@redhat.com \
--to=vkuznets@redhat.com \
--cc=dgilbert@redhat.com \
--cc=dwmw@amazon.co.uk \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=ruyang@redhat.com \
--cc=stable@vger.kernel.org \
--cc=yiyan@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).