From e60b7f156d9de73e61c833457ee1748a39233aba Mon Sep 17 00:00:00 2001
From: Andrea Arcangeli <aarcange@redhat.com>
Date: Mon, 16 Mar 2009 14:46:37 +0000
Subject: [PATCH 2/2] KVM: Fix missing smp tlb flush in invlpg

When kvm emulates an invlpg instruction, it can drop a shadow pte, but
leaves the guest tlbs intact.  This can cause memory corruption when
swapping out.

Without this the other cpu can still write to a freed host physical page.
tlb smp flush must happen if rmap_remove is called always before mmu_lock
is released because the VM will take the mmu_lock before it can finally add
the page to the freelist after swapout. mmu notifier makes it safe to flush
the tlb after freeing the page (otherwise it would never be safe) so we can do
a single flush for multiple sptes invalidated.

[ehabkost: backported from upstream, using struct shadow_walker to store
           need_flush]

Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Bugzilla: 490469
RH-Upstream-status: applied(kvm/master)
Acked-by: Avi Kivity <avi@redhat.com>
Acked-by: Juan Quintela <quintela@redhat.com>
---
 arch/x86/kvm/paging_tmpl.h |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 1e2ada4..5140910 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -83,6 +83,7 @@ struct shadow_walker {
 	pfn_t pfn;
 	u64 *sptep;
 	gpa_t pte_gpa;
+	int need_flush;
 };
 
 static gfn_t gpte_to_gfn(pt_element_t gpte)
@@ -484,6 +485,7 @@ static int FNAME(shadow_invlpg_entry)(struct kvm_shadow_walk *_sw,
 			rmap_remove(vcpu->kvm, sptep);
 			if (is_large_pte(*sptep))
 				--vcpu->kvm->stat.lpages;
+			sw->need_flush = 1;
 		}
 		set_shadow_pte(sptep, shadow_trap_nonpresent_pte);
 		return 1;
@@ -499,10 +501,13 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
 	struct shadow_walker walker = {
 		.walker = { .entry = FNAME(shadow_invlpg_entry), },
 		.pte_gpa = -1,
+		.need_flush = 0,
 	};
 
 	spin_lock(&vcpu->kvm->mmu_lock);
 	walk_shadow(&walker.walker, vcpu, gva);
+	if (walker.need_flush)
+		kvm_flush_remote_tlbs(vcpu->kvm);
 	spin_unlock(&vcpu->kvm->mmu_lock);
 	if (walker.pte_gpa == -1)
 		return;
-- 
1.6.1