From patchwork Thu Jun 8 09:03:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gavin Shan X-Patchwork-Id: 104888 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp150086vqr; Thu, 8 Jun 2023 02:25:04 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ65jPsmPuE0yvSBlY1/E6dR5o211cGnBIstDypVGaUyVq/aObt22xrElOmGjn33Z40OOFGk X-Received: by 2002:a17:903:228c:b0:1b1:9968:53be with SMTP id b12-20020a170903228c00b001b1996853bemr5730640plh.64.1686216303680; Thu, 08 Jun 2023 02:25:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686216303; cv=none; d=google.com; s=arc-20160816; b=HYCLo07TOO1B/aJqsfPt3mCF2/l2hoyui6WFSqJsubU02dXzU4aKInfUQBgPeNSBuj PxwLFrMsseKs5v9oMQT6wQ6ZxHq7zw4iYO+TRMDXcssCsji5ooCj39n3BnfKwXyVwAK0 uoq+RxwaAXsEtQAs+l0aogJyMmVErYAxRxGFOI5pWi9e3HjSlZvPTG7TpTUoL5zC7vVe Gb6zMuMJfEHa4Vx+K10RPUtfl2GG1lLzNQ3kUKMxCFRlaF/qJjrAaMUVI6Hrb0gtyk+A 3JF4WrKBNib2tK5ckihTRKiOhUKVlUOT3oaoEOJJUfMsAp63wIg31nffhESuxXQf+cmc UA/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=dagrqDiq3A7dkc7gq9vL9zi12EhyXb6jT5d9cSUCfXk=; b=P6B55uiZsJBr+wl7TrCnInReqP3EeZ64bR4RC5Xk2KJeOBilMWpsDCoi8j+j4WsYR/ Fdjf3FaUfz0QEqKR0S1B1KBanOF3FTY5P7rp5q2LrSIK6LS9RqzzlPr7IsgTFEzYJA3k LFb/BGb3p/813C9v8qhgRsh3jfbMkPKdhdvWUXWVzTwDMpUNrY1unZ89TbJwjC3tFtW/ 8X2J649f6aGhgD3TbteviMAUQUNZuZ94CVKvNZLKZMTIWLTneZ2p+xEuJNvAtKABA43X usGSimLnUp3T/DsUWboD1GbeYDqKzlCtZm7S0qZKAxNuIbphXkTGol3Vm8wZ1ZGwHcCO VJhg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=NYCg1rzP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v2-20020a170903238200b001a97fd670e6si763442plh.208.2023.06.08.02.24.51; Thu, 08 Jun 2023 02:25:03 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=NYCg1rzP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234155AbjFHJFM (ORCPT + 99 others); Thu, 8 Jun 2023 05:05:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235776AbjFHJE5 (ORCPT ); Thu, 8 Jun 2023 05:04:57 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1F7BE50 for ; Thu, 8 Jun 2023 02:04:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1686215051; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dagrqDiq3A7dkc7gq9vL9zi12EhyXb6jT5d9cSUCfXk=; b=NYCg1rzPTwiS/aCavnUZtEl4gLkS9NLpi2ef/euDZukufEQRNAXTSVGX1uTiGIFamFE5RZ +AbArl62pOAyiIJwNVYlj22tr/zdiggbLoZ0J6QiP0R5LqHbo88YbzKUWqSR9obMif1b0M roBRhebpB2OCjc7gQBYu7GZy6h+x5A4= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-481-uYlwIiBtPiGpmZWNBjNLZA-1; Thu, 08 Jun 2023 05:04:06 -0400 X-MC-Unique: uYlwIiBtPiGpmZWNBjNLZA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 079FF185A78E; Thu, 8 Jun 2023 09:04:06 +0000 (UTC) Received: from gshan.redhat.com (vpn2-54-168.bne.redhat.com [10.64.54.168]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1C3DC40D1B66; Thu, 8 Jun 2023 09:04:02 +0000 (UTC) From: Gavin Shan To: kvmarm@lists.linux.dev Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, pbonzini@redhat.com, seanjc@google.com, oliver.upton@linux.dev, maz@kernel.org, hshuai@redhat.com, zhenyzha@redhat.com, shan.gavin@gmail.com Subject: [PATCH] KVM: Avoid illegal stage2 mapping on invalid memory slot Date: Thu, 8 Jun 2023 19:03:48 +1000 Message-Id: <20230608090348.414990-1-gshan@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768125947212874189?= X-GMAIL-MSGID: =?utf-8?q?1768125947212874189?= We run into guest hang in edk2 firmware when KSM is kept as running on the host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device (TYPE_PFLASH_CFI01) during the operation for sector erasing or buffered write. The status is returned by reading the memory region of the pflash device and the read request should have been forwarded to QEMU and emulated by it. Unfortunately, the read request is covered by an illegal stage2 mapping when the guest hang issue occurs. The read request is completed with QEMU bypassed and wrong status is fetched. The illegal stage2 mapping is populated due to same page mering by KSM at (C) even the associated memory slot has been marked as invalid at (B). CPU-A CPU-B ----- ----- ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) kvm_vm_ioctl_set_memory_region kvm_set_memory_region __kvm_set_memory_region kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE) kvm_invalidate_memslot kvm_copy_memslot kvm_replace_memslot kvm_swap_active_memslots (A) kvm_arch_flush_shadow_memslot (B) same page merging by KSM kvm_mmu_notifier_change_pte kvm_handle_hva_range __kvm_handle_hva_range (C) Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal stage2 mapping. Without the illegal stage2 mapping, the read request for the pflash's status is forwarded to QEMU and emulated by it. The correct pflash's status can be returned from QEMU to break the infinite wait in edk2 firmware. Cc: stable@vger.kernel.org # v5.13+ Fixes: 3039bcc74498 ("KVM: Move x86's MMU notifier memslot walkers to generic code") Reported-by: Shuai Hu Reported-by: Zhenyu Zhang Signed-off-by: Gavin Shan --- virt/kvm/kvm_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 479802a892d4..7f81a3a209b6 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -598,6 +598,9 @@ static __always_inline int __kvm_handle_hva_range(struct kvm *kvm, unsigned long hva_start, hva_end; slot = container_of(node, struct kvm_memory_slot, hva_node[slots->node_idx]); + if (slot->flags & KVM_MEMSLOT_INVALID) + continue; + hva_start = max(range->start, slot->userspace_addr); hva_end = min(range->end, slot->userspace_addr + (slot->npages << PAGE_SHIFT));