diff options
author | Oliver Upton <[email protected]> | 2023-06-27 23:54:05 +0000 |
---|---|---|
committer | Oliver Upton <[email protected]> | 2023-07-12 20:10:40 +0000 |
commit | df6556adf27b7372cfcd97e1c0afb0d516c8279f (patch) | |
tree | 8f0da1e0576081ebf5ebae2cab8a272892592bc0 /lib/memory-notifier-error-inject.c | |
parent | 970dee09b230895fe2230d2b32ad05a2826818c6 (diff) |
KVM: arm64: Correctly handle page aging notifiers for unaligned memslot
Userspace is allowed to select any PAGE_SIZE aligned hva to back guest
memory. This is even the case with hugepages, although it is a rather
suboptimal configuration as PTE level mappings are used at stage-2.
The arm64 page aging handlers have an assumption that the specified
range is exactly one page/block of memory, which in the aforementioned
case is not necessarily true. All together this leads to the WARN() in
kvm_age_gfn() firing.
However, the WARN is only part of the issue as the table walkers visit
at most a single leaf PTE. For hugepage-backed memory in a memslot that
isn't hugepage-aligned, page aging entirely misses accesses to the
hugepage beyond the first page in the memslot.
Add a new walker dedicated to handling page aging MMU notifiers capable
of walking a range of PTEs. Convert kvm(_test)_age_gfn() over to the new
walker and drop the WARN that caught the issue in the first place. The
implementation of this walker was inspired by the test_clear_young()
implementation by Yu Zhao [*], but repurposed to address a bug in the
existing aging implementation.
Cc: [email protected] # v5.15
Fixes: 056aad67f836 ("kvm: arm/arm64: Rework gpa callback handlers")
Link: https://lore.kernel.org/kvmarm/[email protected]/
Co-developed-by: Yu Zhao <[email protected]>
Signed-off-by: Yu Zhao <[email protected]>
Reported-by: Reiji Watanabe <[email protected]>
Reviewed-by: Marc Zyngier <[email protected]>
Reviewed-by: Shaoqin Huang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Oliver Upton <[email protected]>
Diffstat (limited to 'lib/memory-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions