diff options
| author |   Claudio Imbrenda <imbrenda@linux.ibm.com> | 2022-06-28 15:56:02 +0200 |
|---|---|---|
| committer |   Janosch Frank <frankja@linux.ibm.com> | 2022-07-13 14:42:11 +0000 |
| commit | faa2f72cb3569256480c5540d242c84e99965160 (patch) | |
| tree | ce7db920cfb0d3d27409e94db2d9b8b9e9535f1d /arch/s390/include | |
| parent | KVM: s390: Add facility 197 to the allow list (diff) | |
| download | linux-dev-faa2f72cb3569256480c5540d242c84e99965160.tar.xz linux-dev-faa2f72cb3569256480c5540d242c84e99965160.zip | |
KVM: s390: pv: leak the topmost page table when destroy fails
Each secure guest must have a unique ASCE (address space control
element); we must avoid that new guests use the same page for their
ASCE, to avoid errors.
Since the ASCE mostly consists of the address of the topmost page table
(plus some flags), we must not return that memory to the pool unless
the ASCE is no longer in use.
Only a successful Destroy Secure Configuration UVC will make the ASCE
reusable again.
If the Destroy Configuration UVC fails, the ASCE cannot be reused for a
secure guest (either for the ASCE or for other memory areas). To avoid
a collision, it must not be used again. This is a permanent error and
the page becomes in practice unusable, so we set it aside and leak it.
On failure we already leak other memory that belongs to the ultravisor
(i.e. the variable and base storage for a guest) and not leaking the
topmost page table was an oversight.
This error (and thus the leakage) should not happen unless the hardware
is broken or KVM has some unknown serious bug.
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Fixes: 29b40f105ec8d55 ("KVM: s390: protvirt: Add initial vm and cpu lifecycle handling")
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/r/20220628135619.32410-2-imbrenda@linux.ibm.com
Message-Id: <20220628135619.32410-2-imbrenda@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Diffstat (limited to 'arch/s390/include')
| -rw-r--r-- | arch/s390/include/asm/gmap.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/arch/s390/include/asm/gmap.h b/arch/s390/include/asm/gmap.h index 40264f60b0da..f4073106e1f3 100644 --- a/arch/s390/include/asm/gmap.h +++ b/arch/s390/include/asm/gmap.h @@ -148,4 +148,6 @@ void gmap_sync_dirty_log_pmd(struct gmap *gmap, unsigned long dirty_bitmap[4], unsigned long gaddr, unsigned long vmaddr); int gmap_mark_unmergeable(void); void s390_reset_acc(struct mm_struct *mm); +void s390_unlist_old_asce(struct gmap *gmap); +int s390_replace_asce(struct gmap *gmap); #endif /* _ASM_S390_GMAP_H */ |