On Tue, May 11, 2021, Michael Ellerman wrote:
> Commit 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based
> MMU notifier callbacks") fixed kvm_unmap_gfn_range_hv() by adding a for
> loop over each gfn in the range.
>
> But for the Hash MMU it repeatedly calls kvm_unmap_rmapp() with the
> first gfn of the range, rather than iterating through the range.
>
> This exhibits as strange guest behaviour, sometimes crashing in firmare,
> or booting and then guest userspace crashing unexpectedly.
>
> Fix it by passing the iterator, gfn, to kvm_unmap_rmapp().
>
> Fixes: 32b48bf8514c ("KVM: PPC: Book3S HV: Fix conversion to gfn-based MMU
> notifier callbacks")
> Signed-off-by: Michael Ellerman <m...@ellerman.id.au>
> ---
> arch/powerpc/kvm/book3s_64_mmu_hv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> I plan to take this via the powerpc fixes branch.
FWIW,
Reviewed-by: Sean Christopherson <sea...@google.com>
>
> diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c
> b/arch/powerpc/kvm/book3s_64_mmu_hv.c
> index 2d9193cd73be..c63e263312a4 100644
> --- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
> +++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
> @@ -840,7 +840,7 @@ bool kvm_unmap_gfn_range_hv(struct kvm *kvm, struct
> kvm_gfn_range *range)
> kvm_unmap_radix(kvm, range->slot, gfn);
> } else {
> for (gfn = range->start; gfn < range->end; gfn++)
> - kvm_unmap_rmapp(kvm, range->slot, range->start);
> + kvm_unmap_rmapp(kvm, range->slot, gfn);
> }
>
> return false;
> --
> 2.25.1
>
