Commit 11d45175 authored by Yan Zhao's avatar Yan Zhao Committed by Sean Christopherson
Browse files

KVM: x86/mmu: Warn if PFN changes on shadow-present SPTE in shadow MMU 



Warn if PFN changes on shadow-present SPTE in mmu_set_spte().

KVM should _never_ change the PFN of a shadow-present SPTE. In
mmu_set_spte(), there is a WARN_ON_ONCE() on pfn changes on shadow-present
SPTE in mmu_spte_update() to detect this condition. However, that
WARN_ON_ONCE() is not hittable since mmu_set_spte() invokes drop_spte()
earlier before mmu_spte_update(), which clears SPTE to a !shadow-present
state. So, before invoking drop_spte(), add a WARN_ON_ONCE() in
mmu_set_spte() to warn PFN change of a shadow-present SPTE.

For the spurious prefetch fault, only return RET_PF_SPURIOUS directly when
PFN is not changed. When PFN changes, fall through to follow the sequence
of drop_spte(), warn of PFN change, make_spte(), flush tlb, rmap_add().

Signed-off-by: default avatarYan Zhao <yan.y.zhao@intel.com>
Link: https://lore.kernel.org/r/20250318013310.5781-1-yan.y.zhao@intel.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent 988da782

arch/x86/kvm/mmu/mmu.c

+3 −2
Original line number Diff line number Diff line
@@ -3020,7 +3020,8 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, 
	}



	if (is_shadow_present_pte(*sptep)) {

		if (prefetch && is_last_spte(*sptep, level))

		if (prefetch && is_last_spte(*sptep, level) &&

		    pfn == spte_to_pfn(*sptep))

			return RET_PF_SPURIOUS;



		/*
@@ -3034,7 +3035,7 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, 
			child = spte_to_child_sp(pte);

			drop_parent_pte(vcpu->kvm, child, sptep);

			flush = true;

		} else if (pfn != spte_to_pfn(*sptep)) {

		} else if (WARN_ON_ONCE(pfn != spte_to_pfn(*sptep))) {

			drop_spte(vcpu->kvm, sptep);

			flush = true;

		} else