[xen master] x86/pv: fix MMUEXT_FLUSH_CACHE to flush all pCPU caches

[patchbot@xxxxxxx]

commit bbaea9878bf6d11f6f336710148dbbd26e927cfd
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Wed Apr 30 11:36:09 2025 +0200
Commit:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
CommitDate: Tue May 13 19:43:48 2025 +0200

    x86/pv: fix MMUEXT_FLUSH_CACHE to flush all pCPU caches
    
    The implementation of MMUEXT_FLUSH_CACHE is bogus, as it doesn't account to
    flush the cache of any previous pCPU where the current vCPU might have run,
    and hence is likely to not work as expected.
    
    Fix this by resorting to use the same logic as MMUEXT_FLUSH_CACHE_GLOBAL,
    which will be correct in all cases.
    
    Adjust MMUEXT_FLUSH_CACHE_GLOBAL return code in case cache flush is not
    permitted for the domain to use -EACCES instead of -EINVAL, as that's more
    accurate and also matches the error code used by MMUEXT_FLUSH_CACHE.
    
    Fixes: 8e90e37e6db8 ("Fix WBINVD by adding a new hypercall.")
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/mm.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index 66c15a3c86..a1703db762 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3805,14 +3805,11 @@ long do_mmuext_op(
             break;
 
         case MMUEXT_FLUSH_CACHE:
-            if ( unlikely(currd != pg_owner) )
-                rc = -EPERM;
-            else if ( unlikely(!cache_flush_permitted(currd)) )
-                rc = -EACCES;
-            else
-                wbinvd();
-            break;
-
+            /*
+             * Dirty pCPU caches where the current vCPU has been scheduled are
+             * not tracked, and hence we need to resort to a global cache
+             * flush for correctness.
+             */
         case MMUEXT_FLUSH_CACHE_GLOBAL:
             if ( unlikely(currd != pg_owner) )
                 rc = -EPERM;
@@ -3829,7 +3826,7 @@ long do_mmuext_op(
                 flush_mask(mask, FLUSH_CACHE);
             }
             else
-                rc = -EINVAL;
+                rc = -EACCES;
             break;
 
         case MMUEXT_SET_LDT:
--
generated by git-patchbot for /home/xen/git/xen.git#master