• Sean Christopherson's avatar
    KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU · 654430ef
    Sean Christopherson authored
    Calculate and check the full mmu_role when initializing the MMU context
    for the nested MMU, where "full" means the bits and pieces of the role
    that aren't handled by kvm_calc_mmu_role_common().  While the nested MMU
    isn't used for shadow paging, things like the number of levels in the
    guest's page tables are surprisingly important when walking the guest
    page tables.  Failure to reinitialize the nested MMU context if L2's
    paging mode changes can result in unexpected and/or missed page faults,
    and likely other explosions.
    
    E.g. if an L1 vCPU is running both a 32-bit PAE L2 and a 64-bit L2, the
    "common" role calculation will yield the same role for both L2s.  If the
    64-bit L2 is run after the 32-bit PAE L2, L0 will fail to reinitialize
    the nested MMU context, ultimately resulting in a bad walk of L2's page
    tables as the MMU will still have a guest root_level of PT32E_ROOT_LEVEL.
    
      WARNING: CPU: 4 PID: 167334 at arch/x86/kvm/vmx/vmx.c:3075 ept_save_pdptrs+0x15/0xe0 [kvm_intel]
      Modules linked in: kvm_intel]
      CPU: 4 PID: 167334 Comm: CPU 3/KVM Not tainted 5.13.0-rc1-d849817d5673-reqs #185
      Hardware name: ASUS Q87M-E/Q87M-E, BIOS 1102 03/03/2014
      RIP: 0010:ept_save_pdptrs+0x15/0xe0 [kvm_intel]
      Code: <0f> 0b c3 f6 87 d8 02 00f
      RSP: 0018:ffffbba702dbba00 EFLAGS: 00010202
      RAX: 0000000000000011 RBX: 0000000000000002 RCX: ffffffff810a2c08
      RDX: ffff91d7bc30acc0 RSI: 0000000000000011 RDI: ffff91d7bc30a600
      RBP: ffff91d7bc30a600 R08: 0000000000000010 R09: 0000000000000007
      R10: 0000000000000000 R11: 0000000000000000 R12: ffff91d7bc30a600
      R13: ffff91d7bc30acc0 R14: ffff91d67c123460 R15: 0000000115d7e005
      FS:  00007fe8e9ffb700(0000) GS:ffff91d90fb00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000000 CR3: 000000029f15a001 CR4: 00000000001726e0
      Call Trace:
       kvm_pdptr_read+0x3a/0x40 [kvm]
       paging64_walk_addr_generic+0x327/0x6a0 [kvm]
       paging64_gva_to_gpa_nested+0x3f/0xb0 [kvm]
       kvm_fetch_guest_virt+0x4c/0xb0 [kvm]
       __do_insn_fetch_bytes+0x11a/0x1f0 [kvm]
       x86_decode_insn+0x787/0x1490 [kvm]
       x86_decode_emulated_instruction+0x58/0x1e0 [kvm]
       x86_emulate_instruction+0x122/0x4f0 [kvm]
       vmx_handle_exit+0x120/0x660 [kvm_intel]
       kvm_arch_vcpu_ioctl_run+0xe25/0x1cb0 [kvm]
       kvm_vcpu_ioctl+0x211/0x5a0 [kvm]
       __x64_sys_ioctl+0x83/0xb0
       do_syscall_64+0x40/0xb0
       entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
    Cc: stable@vger.kernel.org
    Fixes: bf627a92 ("x86/kvm/mmu: check if MMU reconfiguration is needed in init_kvm_nested_mmu()")
    Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
    Message-Id: <20210610220026.1364486-1-seanjc@google.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    654430ef
mmu.c 159 KB