Commit 2e53d63a authored by Marcelo Tosatti's avatar Marcelo Tosatti Committed by Avi Kivity

KVM: MMU: ignore zapped root pagetables

Mark zapped root pagetables as invalid and ignore such pages during lookup.

This is a problem with the cr3-target feature, where a zapped root table fools
the faulting code into creating a read-only mapping. The result is a lockup
if the instruction can't be emulated.
Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: default avatarAvi Kivity <avi@qumranet.com>
parent 847f0ad8
...@@ -667,7 +667,8 @@ static struct kvm_mmu_page *kvm_mmu_lookup_page(struct kvm *kvm, gfn_t gfn) ...@@ -667,7 +667,8 @@ static struct kvm_mmu_page *kvm_mmu_lookup_page(struct kvm *kvm, gfn_t gfn)
index = kvm_page_table_hashfn(gfn); index = kvm_page_table_hashfn(gfn);
bucket = &kvm->arch.mmu_page_hash[index]; bucket = &kvm->arch.mmu_page_hash[index];
hlist_for_each_entry(sp, node, bucket, hash_link) hlist_for_each_entry(sp, node, bucket, hash_link)
if (sp->gfn == gfn && !sp->role.metaphysical) { if (sp->gfn == gfn && !sp->role.metaphysical
&& !sp->role.invalid) {
pgprintk("%s: found role %x\n", pgprintk("%s: found role %x\n",
__FUNCTION__, sp->role.word); __FUNCTION__, sp->role.word);
return sp; return sp;
...@@ -792,8 +793,11 @@ static void kvm_mmu_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp) ...@@ -792,8 +793,11 @@ static void kvm_mmu_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp)
if (!sp->root_count) { if (!sp->root_count) {
hlist_del(&sp->hash_link); hlist_del(&sp->hash_link);
kvm_mmu_free_page(kvm, sp); kvm_mmu_free_page(kvm, sp);
} else } else {
list_move(&sp->link, &kvm->arch.active_mmu_pages); list_move(&sp->link, &kvm->arch.active_mmu_pages);
sp->role.invalid = 1;
kvm_reload_remote_mmus(kvm);
}
kvm_mmu_reset_last_pte_updated(kvm); kvm_mmu_reset_last_pte_updated(kvm);
} }
...@@ -1073,6 +1077,8 @@ static void mmu_free_roots(struct kvm_vcpu *vcpu) ...@@ -1073,6 +1077,8 @@ static void mmu_free_roots(struct kvm_vcpu *vcpu)
sp = page_header(root); sp = page_header(root);
--sp->root_count; --sp->root_count;
if (!sp->root_count && sp->role.invalid)
kvm_mmu_zap_page(vcpu->kvm, sp);
vcpu->arch.mmu.root_hpa = INVALID_PAGE; vcpu->arch.mmu.root_hpa = INVALID_PAGE;
spin_unlock(&vcpu->kvm->mmu_lock); spin_unlock(&vcpu->kvm->mmu_lock);
return; return;
...@@ -1085,6 +1091,8 @@ static void mmu_free_roots(struct kvm_vcpu *vcpu) ...@@ -1085,6 +1091,8 @@ static void mmu_free_roots(struct kvm_vcpu *vcpu)
root &= PT64_BASE_ADDR_MASK; root &= PT64_BASE_ADDR_MASK;
sp = page_header(root); sp = page_header(root);
--sp->root_count; --sp->root_count;
if (!sp->root_count && sp->role.invalid)
kvm_mmu_zap_page(vcpu->kvm, sp);
} }
vcpu->arch.mmu.pae_root[i] = INVALID_PAGE; vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
} }
......
...@@ -2658,6 +2658,10 @@ static int __vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) ...@@ -2658,6 +2658,10 @@ static int __vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
kvm_x86_ops->guest_debug_pre(vcpu); kvm_x86_ops->guest_debug_pre(vcpu);
again: again:
if (vcpu->requests)
if (test_and_clear_bit(KVM_REQ_MMU_RELOAD, &vcpu->requests))
kvm_mmu_unload(vcpu);
r = kvm_mmu_reload(vcpu); r = kvm_mmu_reload(vcpu);
if (unlikely(r)) if (unlikely(r))
goto out; goto out;
...@@ -2689,6 +2693,14 @@ static int __vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) ...@@ -2689,6 +2693,14 @@ static int __vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
goto out; goto out;
} }
if (vcpu->requests)
if (test_bit(KVM_REQ_MMU_RELOAD, &vcpu->requests)) {
local_irq_enable();
preempt_enable();
r = 1;
goto out;
}
if (signal_pending(current)) { if (signal_pending(current)) {
local_irq_enable(); local_irq_enable();
preempt_enable(); preempt_enable();
......
...@@ -141,6 +141,7 @@ union kvm_mmu_page_role { ...@@ -141,6 +141,7 @@ union kvm_mmu_page_role {
unsigned pad_for_nice_hex_output:6; unsigned pad_for_nice_hex_output:6;
unsigned metaphysical:1; unsigned metaphysical:1;
unsigned access:3; unsigned access:3;
unsigned invalid:1;
}; };
}; };
......
...@@ -37,6 +37,7 @@ ...@@ -37,6 +37,7 @@
#define KVM_REQ_TLB_FLUSH 0 #define KVM_REQ_TLB_FLUSH 0
#define KVM_REQ_MIGRATE_TIMER 1 #define KVM_REQ_MIGRATE_TIMER 1
#define KVM_REQ_REPORT_TPR_ACCESS 2 #define KVM_REQ_REPORT_TPR_ACCESS 2
#define KVM_REQ_MMU_RELOAD 3
struct kvm_vcpu; struct kvm_vcpu;
extern struct kmem_cache *kvm_vcpu_cache; extern struct kmem_cache *kvm_vcpu_cache;
...@@ -190,6 +191,7 @@ void kvm_resched(struct kvm_vcpu *vcpu); ...@@ -190,6 +191,7 @@ void kvm_resched(struct kvm_vcpu *vcpu);
void kvm_load_guest_fpu(struct kvm_vcpu *vcpu); void kvm_load_guest_fpu(struct kvm_vcpu *vcpu);
void kvm_put_guest_fpu(struct kvm_vcpu *vcpu); void kvm_put_guest_fpu(struct kvm_vcpu *vcpu);
void kvm_flush_remote_tlbs(struct kvm *kvm); void kvm_flush_remote_tlbs(struct kvm *kvm);
void kvm_reload_remote_mmus(struct kvm *kvm);
long kvm_arch_dev_ioctl(struct file *filp, long kvm_arch_dev_ioctl(struct file *filp,
unsigned int ioctl, unsigned long arg); unsigned int ioctl, unsigned long arg);
......
...@@ -119,6 +119,29 @@ void kvm_flush_remote_tlbs(struct kvm *kvm) ...@@ -119,6 +119,29 @@ void kvm_flush_remote_tlbs(struct kvm *kvm)
smp_call_function_mask(cpus, ack_flush, NULL, 1); smp_call_function_mask(cpus, ack_flush, NULL, 1);
} }
void kvm_reload_remote_mmus(struct kvm *kvm)
{
int i, cpu;
cpumask_t cpus;
struct kvm_vcpu *vcpu;
cpus_clear(cpus);
for (i = 0; i < KVM_MAX_VCPUS; ++i) {
vcpu = kvm->vcpus[i];
if (!vcpu)
continue;
if (test_and_set_bit(KVM_REQ_MMU_RELOAD, &vcpu->requests))
continue;
cpu = vcpu->cpu;
if (cpu != -1 && cpu != raw_smp_processor_id())
cpu_set(cpu, cpus);
}
if (cpus_empty(cpus))
return;
smp_call_function_mask(cpus, ack_flush, NULL, 1);
}
int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id) int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
{ {
struct page *page; struct page *page;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment