From c22aa7536838a18902bfe800ddf5f7e9c5190416 Mon Sep 17 00:00:00 2001 From: Thomas Lamprecht Date: Sat, 15 Jul 2023 18:41:30 +0200 Subject: [PATCH] fix #4833: backport fix for recovering potential NX huge pages Signed-off-by: Thomas Lamprecht --- ...-memslot-for-correct-address-space-i.patch | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 patches/kernel/0009-KVM-x86-mmu-Grab-memslot-for-correct-address-space-i.patch diff --git a/patches/kernel/0009-KVM-x86-mmu-Grab-memslot-for-correct-address-space-i.patch b/patches/kernel/0009-KVM-x86-mmu-Grab-memslot-for-correct-address-space-i.patch new file mode 100644 index 0000000..078891d --- /dev/null +++ b/patches/kernel/0009-KVM-x86-mmu-Grab-memslot-for-correct-address-space-i.patch @@ -0,0 +1,82 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Thu, 1 Jun 2023 18:01:37 -0700 +Subject: [PATCH] KVM: x86/mmu: Grab memslot for correct address space in NX + recovery worker + +commit 817fa998362d6ea9fabd5e97af8e9e2eb5f0e6f2 upstream. + +Factor in the address space (non-SMM vs. SMM) of the target shadow page +when recovering potential NX huge pages, otherwise KVM will retrieve the +wrong memslot when zapping shadow pages that were created for SMM. The +bug most visibly manifests as a WARN on the memslot being non-NULL, but +the worst case scenario is that KVM could unaccount the shadow page +without ensuring KVM won't install a huge page, i.e. if the non-SMM slot +is being dirty logged, but the SMM slot is not. + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 3911 at arch/x86/kvm/mmu/mmu.c:7015 + kvm_nx_huge_page_recovery_worker+0x38c/0x3d0 [kvm] + CPU: 1 PID: 3911 Comm: kvm-nx-lpage-re + RIP: 0010:kvm_nx_huge_page_recovery_worker+0x38c/0x3d0 [kvm] + RSP: 0018:ffff99b284f0be68 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: ffff99b284edd000 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffff9271397024e0 R08: 0000000000000000 R09: ffff927139702450 + R10: 0000000000000000 R11: 0000000000000001 R12: ffff99b284f0be98 + R13: 0000000000000000 R14: ffff9270991fcd80 R15: 0000000000000003 + FS: 0000000000000000(0000) GS:ffff927f9f640000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f0aacad3ae0 CR3: 000000088fc2c005 CR4: 00000000003726e0 + Call Trace: + +__pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [kvm] + kvm_vm_worker_thread+0x106/0x1c0 [kvm] + kthread+0xd9/0x100 + ret_from_fork+0x2c/0x50 + + ---[ end trace 0000000000000000 ]--- + +This bug was exposed by commit edbdb43fc96b ("KVM: x86: Preserve TDP MMU +roots until they are explicitly invalidated"), which allowed KVM to retain +SMM TDP MMU roots effectively indefinitely. Before commit edbdb43fc96b, +KVM would zap all SMM TDP MMU roots and thus all SMM TDP MMU shadow pages +once all vCPUs exited SMM, which made the window where this bug (recovering +an SMM NX huge page) could be encountered quite tiny. To hit the bug, the +NX recovery thread would have to run while at least one vCPU was in SMM. +Most VMs typically only use SMM during boot, and so the problematic shadow +pages were gone by the time the NX recovery thread ran. + +Now that KVM preserves TDP MMU roots until they are explicitly invalidated +(e.g. by a memslot deletion), the window to trigger the bug is effectively +never closed because most VMMs don't delete memslots after boot (except +for a handful of special scenarios). + +Fixes: eb298605705a ("KVM: x86/mmu: Do not recover dirty-tracked NX Huge Pages") +Reported-by: Fabio Coatti +Closes: https://lore.kernel.org/all/CADpTngX9LESCdHVu_2mQkNGena_Ng2CphWNwsRGSMxzDsTjU2A@mail.gmail.com +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230602010137.784664-1-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Thomas Lamprecht +--- + arch/x86/kvm/mmu/mmu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c +index dcca08a08bd0..3220c1285984 100644 +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -6945,7 +6945,10 @@ static void kvm_recover_nx_huge_pages(struct kvm *kvm) + */ + slot = NULL; + if (atomic_read(&kvm->nr_memslots_dirty_logging)) { +- slot = gfn_to_memslot(kvm, sp->gfn); ++ struct kvm_memslots *slots; ++ ++ slots = kvm_memslots_for_spte_role(kvm, sp->role); ++ slot = __gfn_to_memslot(slots, sp->gfn); + WARN_ON_ONCE(!slot); + } + -- 2.39.2