iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

KVM: MMU: load PDPTRs outside mmu_lock

Browse Source 
On SVM, reading PDPTRs might access guest memory, which might fault
and thus might sleep.  On the other hand, it is not possible to
release the lock after make_mmu_pages_available has been called.

Therefore, push the call to make_mmu_pages_available and the
mmu_lock critical section within mmu_alloc_direct_roots and
mmu_alloc_shadow_roots.

Reported-by: Wanpeng Li <wanpengli@tencent.com>
Co-developed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2021-04-08 08:10:25 -04:00
parent d9bd0082e2
commit 4a38162ee9
1 changed files with 37 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
arch/x86/kvm/mmu/mmu.c
View File

@ -3245,6 +3245,12 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
u8 shadow_root_level = mmu->shadow_root_level; u8 shadow_root_level = mmu->shadow_root_level;
hpa_t root; hpa_t root;
unsigned i; unsigned i;
int r;
write_lock(&vcpu->kvm->mmu_lock);
r = make_mmu_pages_available(vcpu);
if (r < 0)
goto out_unlock;
if (is_tdp_mmu_enabled(vcpu->kvm)) { if (is_tdp_mmu_enabled(vcpu->kvm)) {
root = kvm_tdp_mmu_get_vcpu_root_hpa(vcpu); root = kvm_tdp_mmu_get_vcpu_root_hpa(vcpu);
@ -3253,8 +3259,10 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
root = mmu_alloc_root(vcpu, 0, 0, shadow_root_level, true); root = mmu_alloc_root(vcpu, 0, 0, shadow_root_level, true);
mmu->root_hpa = root; mmu->root_hpa = root;
} else if (shadow_root_level == PT32E_ROOT_LEVEL) { } else if (shadow_root_level == PT32E_ROOT_LEVEL) {
if (WARN_ON_ONCE(!mmu->pae_root)) if (WARN_ON_ONCE(!mmu->pae_root)) {
return -EIO; r = -EIO;
goto out_unlock;
}
for (i = 0; i < 4; ++i) { for (i = 0; i < 4; ++i) {
WARN_ON_ONCE(IS_VALID_PAE_ROOT(mmu->pae_root[i])); WARN_ON_ONCE(IS_VALID_PAE_ROOT(mmu->pae_root[i]));
@ -3267,13 +3275,15 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
mmu->root_hpa = __pa(mmu->pae_root); mmu->root_hpa = __pa(mmu->pae_root);
} else { } else {
WARN_ONCE(1, "Bad TDP root level = %d\n", shadow_root_level); WARN_ONCE(1, "Bad TDP root level = %d\n", shadow_root_level);
return -EIO; r = -EIO;
goto out_unlock;
} }
/* root_pgd is ignored for direct MMUs. */ /* root_pgd is ignored for direct MMUs. */
mmu->root_pgd = 0; mmu->root_pgd = 0;
out_unlock:
return 0; write_unlock(&vcpu->kvm->mmu_lock);
return r;
} }
static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
@ -3282,7 +3292,8 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
u64 pdptrs[4], pm_mask; u64 pdptrs[4], pm_mask;
gfn_t root_gfn, root_pgd; gfn_t root_gfn, root_pgd;
hpa_t root; hpa_t root;
int i; unsigned i;
int r;
root_pgd = mmu->get_guest_pgd(vcpu); root_pgd = mmu->get_guest_pgd(vcpu);
root_gfn = root_pgd >> PAGE_SHIFT; root_gfn = root_pgd >> PAGE_SHIFT;
@ -3290,6 +3301,10 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
if (mmu_check_root(vcpu, root_gfn)) if (mmu_check_root(vcpu, root_gfn))
return 1; return 1;
/*
* On SVM, reading PDPTRs might access guest memory, which might fault
* and thus might sleep. Grab the PDPTRs before acquiring mmu_lock.
*/
if (mmu->root_level == PT32E_ROOT_LEVEL) { if (mmu->root_level == PT32E_ROOT_LEVEL) {
for (i = 0; i < 4; ++i) { for (i = 0; i < 4; ++i) {
pdptrs[i] = mmu->get_pdptr(vcpu, i); pdptrs[i] = mmu->get_pdptr(vcpu, i);
@ -3301,6 +3316,11 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
} }
} }
write_lock(&vcpu->kvm->mmu_lock);
r = make_mmu_pages_available(vcpu);
if (r < 0)
goto out_unlock;
/* /*
* Do we shadow a long mode page table? If so we need to * Do we shadow a long mode page table? If so we need to
* write-protect the guests page table root. * write-protect the guests page table root.
@ -3312,8 +3332,10 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
goto set_root_pgd; goto set_root_pgd;
} }
if (WARN_ON_ONCE(!mmu->pae_root)) if (WARN_ON_ONCE(!mmu->pae_root)) {
return -EIO; r = -EIO;
goto out_unlock;
}
/* /*
* We shadow a 32 bit page table. This may be a legacy 2-level * We shadow a 32 bit page table. This may be a legacy 2-level
@ -3324,8 +3346,10 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) { if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) {
pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK; pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK;
if (WARN_ON_ONCE(!mmu->lm_root)) if (WARN_ON_ONCE(!mmu->lm_root)) {
return -EIO; r = -EIO;
goto out_unlock;
}
mmu->lm_root[0] = __pa(mmu->pae_root) | pm_mask; mmu->lm_root[0] = __pa(mmu->pae_root) | pm_mask;
} }
@ -3353,6 +3377,8 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
set_root_pgd: set_root_pgd:
mmu->root_pgd = root_pgd; mmu->root_pgd = root_pgd;
out_unlock:
write_unlock(&vcpu->kvm->mmu_lock);
return 0; return 0;
} }
@ -4853,14 +4879,10 @@ int kvm_mmu_load(struct kvm_vcpu *vcpu)
r = mmu_alloc_special_roots(vcpu); r = mmu_alloc_special_roots(vcpu);
if (r) if (r)
goto out; goto out;
write_lock(&vcpu->kvm->mmu_lock); if (vcpu->arch.mmu->direct_map)
if (make_mmu_pages_available(vcpu))
r = -ENOSPC;
else if (vcpu->arch.mmu->direct_map)
r = mmu_alloc_direct_roots(vcpu); r = mmu_alloc_direct_roots(vcpu);
else else
r = mmu_alloc_shadow_roots(vcpu); r = mmu_alloc_shadow_roots(vcpu);
write_unlock(&vcpu->kvm->mmu_lock);
if (r) if (r)
goto out; goto out;