On 7/28/22 23:20, Sean Christopherson wrote:
Anyways, the bug we really care about is that by not precisely checking if a huge page is disallowed, KVM would refuse to create huge page after disabling dirty logging, which is a very noticeable performance issue for large VMs if a migration is canceled. That particular bug has since been unintentionally fixed in the TDP MMU by zapping the non-leaf SPTE, but there are other paths that could similarly be affected, e.g. I believe zapping leaf SPTEs in response to a host page migration (mmu_notifier invalidation) to create a huge page would yield a similar result; KVM would see the shadow-present non-leaf SPTE and assume a huge page is disallowed.
Ok, thanks. So this will be 5.21 material even during the -rc phase; I have posted a couple comments for patch 1 and 2.
One way to simplify the rmb/wmb logic could be to place the rmb/wmb respectively after loading iter.old_spte and in tdp_mmu_link_sp. If you like it, feel free to integrate it in v3.
Paolo
