diff mbox series

KVM: PPC: Book3S HV: Fix kvm_unmap_gfn_range_hv() for Hash MMU

Message ID 20210511105459.800788-1-mpe@ellerman.id.au
State New
Headers show
Series KVM: PPC: Book3S HV: Fix kvm_unmap_gfn_range_hv() for Hash MMU | expand

Commit Message

Michael Ellerman May 11, 2021, 10:54 a.m. UTC
Commit 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based
MMU notifier callbacks") fixed kvm_unmap_gfn_range_hv() by adding a for
loop over each gfn in the range.

But for the Hash MMU it repeatedly calls kvm_unmap_rmapp() with the
first gfn of the range, rather than iterating through the range.

This exhibits as strange guest behaviour, sometimes crashing in firmare,
or booting and then guest userspace crashing unexpectedly.

Fix it by passing the iterator, gfn, to kvm_unmap_rmapp().

Fixes: 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based MMU notifier callbacks")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
 arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

I plan to take this via the powerpc fixes branch.

Comments

Sean Christopherson May 11, 2021, 4:39 p.m. UTC | #1
On Tue, May 11, 2021, Michael Ellerman wrote:
> Commit 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based
> MMU notifier callbacks") fixed kvm_unmap_gfn_range_hv() by adding a for
> loop over each gfn in the range.
> 
> But for the Hash MMU it repeatedly calls kvm_unmap_rmapp() with the
> first gfn of the range, rather than iterating through the range.
> 
> This exhibits as strange guest behaviour, sometimes crashing in firmare,
> or booting and then guest userspace crashing unexpectedly.
> 
> Fix it by passing the iterator, gfn, to kvm_unmap_rmapp().
> 
> Fixes: 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based MMU notifier callbacks")
> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
> ---
>  arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> I plan to take this via the powerpc fixes branch.

FWIW,

Reviewed-by: Sean Christopherson <seanjc@google.com>

> 
> diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
> index 2d9193cd73be..c63e263312a4 100644
> --- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
> +++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
> @@ -840,7 +840,7 @@ bool kvm_unmap_gfn_range_hv(struct kvm *kvm, struct kvm_gfn_range *range)
>  			kvm_unmap_radix(kvm, range->slot, gfn);
>  	} else {
>  		for (gfn = range->start; gfn < range->end; gfn++)
> -			kvm_unmap_rmapp(kvm, range->slot, range->start);
> +			kvm_unmap_rmapp(kvm, range->slot, gfn);
>  	}
>  
>  	return false;
> -- 
> 2.25.1
>
Michael Ellerman May 12, 2021, 3:20 a.m. UTC | #2
Sean Christopherson <seanjc@google.com> writes:
> On Tue, May 11, 2021, Michael Ellerman wrote:
>> Commit 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based
>> MMU notifier callbacks") fixed kvm_unmap_gfn_range_hv() by adding a for
>> loop over each gfn in the range.
>> 
>> But for the Hash MMU it repeatedly calls kvm_unmap_rmapp() with the
>> first gfn of the range, rather than iterating through the range.
>> 
>> This exhibits as strange guest behaviour, sometimes crashing in firmare,
>> or booting and then guest userspace crashing unexpectedly.
>> 
>> Fix it by passing the iterator, gfn, to kvm_unmap_rmapp().
>> 
>> Fixes: 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based MMU notifier callbacks")
>> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
>> ---
>>  arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> I plan to take this via the powerpc fixes branch.
>
> FWIW,
>
> Reviewed-by: Sean Christopherson <seanjc@google.com>

Thanks.

cheers
Michael Ellerman May 15, 2021, 10:43 p.m. UTC | #3
On Tue, 11 May 2021 20:54:59 +1000, Michael Ellerman wrote:
> Commit 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based
> MMU notifier callbacks") fixed kvm_unmap_gfn_range_hv() by adding a for
> loop over each gfn in the range.
> 
> But for the Hash MMU it repeatedly calls kvm_unmap_rmapp() with the
> first gfn of the range, rather than iterating through the range.
> 
> [...]

Applied to powerpc/fixes.

[1/1] KVM: PPC: Book3S HV: Fix kvm_unmap_gfn_range_hv() for Hash MMU
      https://git.kernel.org/powerpc/c/da3bb206c9ceb0736d9e2897ea697acabad35833

cheers
diff mbox series

Patch

diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 2d9193cd73be..c63e263312a4 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -840,7 +840,7 @@  bool kvm_unmap_gfn_range_hv(struct kvm *kvm, struct kvm_gfn_range *range)
 			kvm_unmap_radix(kvm, range->slot, gfn);
 	} else {
 		for (gfn = range->start; gfn < range->end; gfn++)
-			kvm_unmap_rmapp(kvm, range->slot, range->start);
+			kvm_unmap_rmapp(kvm, range->slot, gfn);
 	}
 
 	return false;