Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23ad135a authored Feb 05, 2019 by Sean Christopherson Committed by Greg Kroah-Hartman Mar 23, 2019

KVM: Call kvm_arch_memslots_updated() before updating memslots

commit 152482580a1b0accb60676063a1ac57b2d12daf6 upstream.

kvm_arch_memslots_updated() is at this point in time an x86-specific
hook for handling MMIO generation wraparound. x86 stashes 19 bits of
the memslots generation number in its MMIO sptes in order to avoid
full page fault walks for repeat faults on emulated MMIO addresses.
Because only 19 bits are used, wrapping the MMIO generation number is
possible, if unlikely. kvm_arch_memslots_updated() alerts x86 that
the generation has changed so that it can invalidate all MMIO sptes in
case the effective MMIO generation has wrapped so as to avoid using a
stale spte, e.g. a (very) old spte that was created with generation==0.

Given that the purpose of kvm_arch_memslots_updated() is to prevent
consuming stale entries, it needs to be called before the new generation
is propagated to memslots. Invalidating the MMIO sptes after updating
memslots means that there is a window where a vCPU could dereference
the new memslots generation, e.g. 0, and incorrectly reuse an old MMIO
spte that was created with (pre-wrap) generation==0.

Fixes: e59dbe09 ("KVM: Introduce kvm_arch_memslots_updated()")
Cc: <stable@vger.kernel.org>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 585715ef

arch/mips/include/asm/kvm_host.h

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1131,7 +1131,7 @@ static inline void kvm_arch_hardware_unsetup(void) {}
	static inline void kvm_arch_sync_events(struct kvm *kvm) {}		static inline void kvm_arch_sync_events(struct kvm *kvm) {}
	static inline void kvm_arch_free_memslot(struct kvm *kvm,		static inline void kvm_arch_free_memslot(struct kvm *kvm,
	struct kvm_memory_slot free, struct kvm_memory_slot dont) {}		struct kvm_memory_slot free, struct kvm_memory_slot dont) {}
	static inline void kvm_arch_memslots_updated(struct kvm kvm, struct kvm_memslots slots) {}		static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
	static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}		static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
	static inline void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu) {}		static inline void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu) {}
	static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) {}		static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) {}

arch/powerpc/include/asm/kvm_host.h

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -822,7 +822,7 @@ struct kvm_vcpu_arch {
	static inline void kvm_arch_hardware_disable(void) {}		static inline void kvm_arch_hardware_disable(void) {}
	static inline void kvm_arch_hardware_unsetup(void) {}		static inline void kvm_arch_hardware_unsetup(void) {}
	static inline void kvm_arch_sync_events(struct kvm *kvm) {}		static inline void kvm_arch_sync_events(struct kvm *kvm) {}
	static inline void kvm_arch_memslots_updated(struct kvm kvm, struct kvm_memslots slots) {}		static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
	static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}		static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}
	static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}		static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
	static inline void kvm_arch_exit(void) {}		static inline void kvm_arch_exit(void) {}

arch/s390/include/asm/kvm_host.h

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -865,7 +865,7 @@ static inline void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) {}
	static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}		static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
	static inline void kvm_arch_free_memslot(struct kvm *kvm,		static inline void kvm_arch_free_memslot(struct kvm *kvm,
	struct kvm_memory_slot free, struct kvm_memory_slot dont) {}		struct kvm_memory_slot free, struct kvm_memory_slot dont) {}
	static inline void kvm_arch_memslots_updated(struct kvm kvm, struct kvm_memslots slots) {}		static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
	static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}		static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}
	static inline void kvm_arch_flush_shadow_memslot(struct kvm *kvm,		static inline void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
	struct kvm_memory_slot *slot) {}		struct kvm_memory_slot *slot) {}

arch/x86/include/asm/kvm_host.h

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1194,7 +1194,7 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
	struct kvm_memory_slot *slot,		struct kvm_memory_slot *slot,
	gfn_t gfn_offset, unsigned long mask);		gfn_t gfn_offset, unsigned long mask);
	void kvm_mmu_zap_all(struct kvm *kvm);		void kvm_mmu_zap_all(struct kvm *kvm);
	void kvm_mmu_invalidate_mmio_sptes(struct kvm kvm, struct kvm_memslots slots);		void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
	unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);		unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
	void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);		void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);

arch/x86/kvm/mmu.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -5774,13 +5774,13 @@ static bool kvm_has_zapped_obsolete_pages(struct kvm *kvm)
	return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages));		return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages));
	}		}

	void kvm_mmu_invalidate_mmio_sptes(struct kvm kvm, struct kvm_memslots slots)		void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen)
	{		{
	/*		/*
	* The very rare case: if the generation-number is round,		* The very rare case: if the generation-number is round,
	* zap all shadow pages.		* zap all shadow pages.
	*/		*/
	if (unlikely((slots->generation & MMIO_GEN_MASK) == 0)) {		if (unlikely((gen & MMIO_GEN_MASK) == 0)) {
	kvm_debug_ratelimited("kvm: zapping shadow pages for mmio generation wraparound\n");		kvm_debug_ratelimited("kvm: zapping shadow pages for mmio generation wraparound\n");
	kvm_mmu_invalidate_zap_all_pages(kvm);		kvm_mmu_invalidate_zap_all_pages(kvm);
	}		}