> > > and the backing page is being reclaimed in L0? I saw > > nested_get_vmcs12_pages() will check vmcs12 and set the APIC access address > > in VMCS02, but not sure if this routine will be triggered by the mmu > > notifier... > > Pages from vmcs12 that are referenced by physical address in the VMCS are pinned > (where "pinned" means KVM holds a reference to the page) by kvm_vcpu_map(). I.e. > the page will not be migrated, and if userspace unmaps the page, userspace might > break its VM, but that's true for any guest memory that userspace unexpectedly > unmaps, and there won't be any no use-after-free issues. > Thanks, Sean. About the kvm_vcpu_map(), is it necessary for APIC access address? L0 only needs to get its pfn, and does not care about the hva or struct page. Could we just use gfn_to_pfn() to retrieve the pfn, and kvm_release_pfn_clean() to unpin it later? B.R. Yu
