From patchwork Mon Aug 18 22:46:07 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Matlack X-Patchwork-Id: 4739601 Return-Path: X-Original-To: patchwork-kvm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 43DA49F3EE for ; Mon, 18 Aug 2014 22:47:24 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4C715200F3 for ; Mon, 18 Aug 2014 22:47:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3D8B820121 for ; Mon, 18 Aug 2014 22:47:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752451AbaHRWrB (ORCPT ); Mon, 18 Aug 2014 18:47:01 -0400 Received: from mail-yk0-f180.google.com ([209.85.160.180]:52469 "EHLO mail-yk0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752396AbaHRWqo (ORCPT ); Mon, 18 Aug 2014 18:46:44 -0400 Received: by mail-yk0-f180.google.com with SMTP id 200so4785732ykr.25 for ; Mon, 18 Aug 2014 15:46:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=s3dXI55hYMrYGTNvwcudsO14eyuBWKcaX5GMPg93W7E=; b=HumUWRE14SwiUkrW/Opizb40tCGQwYrP11jzGH0zSqBnyP85nTV6fLgnXu5/SevGnA aQN8zQblpCIoifxHFX9TMueNOMd+sfS+yrL0DCWLUnk7pV7ZnfvQxgI7Qfryb++Z1dnT Zbxh3V3fJ7iYdEFuISdf9eGVFYMjw6PSMnEOpVXILcbug/V8ZKyhs8Je2is1TvWtsnkx lC64OcJm65dA/LK4/iM4nsS4b/HJDTANwWP5Uraw3SioBBDOO7XWWTb6bJjnkPUZ/ik6 WDRdHZ7DVyAXXknw3uF0m3btqCt9RAPbn0shbNdR7aazcLktvVccWwgM2IM1NTs6fhJx wdDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=s3dXI55hYMrYGTNvwcudsO14eyuBWKcaX5GMPg93W7E=; b=RhunFjfQRptxC1obfVXk8DNObAEJxPAV9O1XfGvTl8kYKPCNweYDXPM351MQLT/8Y7 GFmlGcjvPovgg0xxtK0OKjzc3YjZVAUJytEGPsgcTExRraP/TIqVaFhnWN9VNQt4AVGh nFvVCL7VHuW4wFRsNUzR6j3OEIPjl7THVIGXW2NYDPlYg1ey0oilYVUiPMlOeAdfir+X MjWMwK7/0q+0VTrZP6aaQiUdhxE1B4L2TfVn0m5xya9OSTzu/f9eLCJe4Ggk9/QwZznV eaunySjo43IAZuo0MjGXpgwLRC/TSP5y7cba+W6o6/v9AN+XtoCWDo8zdvv7T4vfXsqr ITmA== X-Gm-Message-State: ALoCoQkxfFhYWu3tC0t5vGxgbwUivz+AuXa/xpRyM+T22cRjxF99BcM9qlVr5ojpV37q3smHggrd X-Received: by 10.236.160.67 with SMTP id t43mr60161399yhk.11.1408402003680; Mon, 18 Aug 2014 15:46:43 -0700 (PDT) Received: from dmatlack-linux.kir.corp.google.com (dmatlack-linux.kir.corp.google.com [172.31.88.63]) by mx.google.com with ESMTPSA id v56sm38460909yha.27.2014.08.18.15.46.41 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 18 Aug 2014 15:46:42 -0700 (PDT) From: David Matlack To: pbonzini@redhat.com Cc: gleb@redhat.com, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, avi.kivity@gmail.com, mtosatti@redhat.com, David Matlack , stable@vger.kernel.org, Xiao Guangrong Subject: [PATCH 2/2] kvm: x86: fix stale mmio cache bug Date: Mon, 18 Aug 2014 15:46:07 -0700 Message-Id: <1408401967-27211-2-git-send-email-dmatlack@google.com> X-Mailer: git-send-email 2.1.0.rc2.206.gedb03e5 In-Reply-To: <1408401967-27211-1-git-send-email-dmatlack@google.com> References: <1408401967-27211-1-git-send-email-dmatlack@google.com> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The following events can lead to an incorrect KVM_EXIT_MMIO bubbling up to userspace: (1) Guest accesses gpa X without a memory slot. The gfn is cached in struct kvm_vcpu_arch (mmio_gfn). On Intel EPT-enabled hosts, KVM sets the SPTE write-execute-noread so that future accesses cause EPT_MISCONFIGs. (2) Host userspace creates a memory slot via KVM_SET_USER_MEMORY_REGION covering the page just accessed. (3) Guest attempts to read or write to gpa X again. On Intel, this generates an EPT_MISCONFIG. The memory slot generation number that was incremented in (2) would normally take care of this but we fast path mmio faults through quickly_check_mmio_pf(), which only checks the per-vcpu mmio cache. Since we hit the cache, KVM passes a KVM_EXIT_MMIO up to userspace. This patch fixes the issue by using the memslot generation number to validate the mmio cache. [ xiaoguangrong: adjust the code to make it simpler for stable-tree fix. ] Cc: stable@vger.kernel.org Signed-off-by: David Matlack Signed-off-by: Xiao Guangrong --- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu.c | 4 ++-- arch/x86/kvm/mmu.h | 2 ++ arch/x86/kvm/x86.h | 21 ++++++++++++++++----- 4 files changed, 21 insertions(+), 7 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 49205d0..f518d14 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -479,6 +479,7 @@ struct kvm_vcpu_arch { u64 mmio_gva; unsigned access; gfn_t mmio_gfn; + unsigned int mmio_gen; struct kvm_pmu pmu; diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index 9314678..e00fbfe 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -234,7 +234,7 @@ static unsigned int get_mmio_spte_generation(u64 spte) return gen; } -static unsigned int kvm_current_mmio_generation(struct kvm *kvm) +unsigned int kvm_current_mmio_generation(struct kvm *kvm) { /* * Init kvm generation close to MMIO_MAX_GEN to easily test the @@ -3163,7 +3163,7 @@ static void mmu_sync_roots(struct kvm_vcpu *vcpu) if (!VALID_PAGE(vcpu->arch.mmu.root_hpa)) return; - vcpu_clear_mmio_info(vcpu, ~0ul); + vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY); kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC); if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) { hpa_t root = vcpu->arch.mmu.root_hpa; diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h index b982112..e2d902a 100644 --- a/arch/x86/kvm/mmu.h +++ b/arch/x86/kvm/mmu.h @@ -76,6 +76,8 @@ enum { }; int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, u64 addr, bool direct); +unsigned int kvm_current_mmio_generation(struct kvm *kvm); + void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context); void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context, bool execonly); diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index 8c97bac..ae7006d 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -3,6 +3,7 @@ #include #include "kvm_cache_regs.h" +#include "mmu.h" static inline void kvm_clear_exception_queue(struct kvm_vcpu *vcpu) { @@ -78,15 +79,23 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu, vcpu->arch.mmio_gva = gva & PAGE_MASK; vcpu->arch.access = access; vcpu->arch.mmio_gfn = gfn; + vcpu->arch.mmio_gen = kvm_current_mmio_generation(vcpu->kvm); +} + +static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu) +{ + return vcpu->arch.mmio_gen == kvm_current_mmio_generation(vcpu->kvm); } /* - * Clear the mmio cache info for the given gva, - * specially, if gva is ~0ul, we clear all mmio cache info. + * Clear the mmio cache info for the given gva. If gva is MMIO_GVA_ANY, we + * clear all mmio cache info. */ +#define MMIO_GVA_ANY (~(gva_t)0) + static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva) { - if (gva != (~0ul) && vcpu->arch.mmio_gva != (gva & PAGE_MASK)) + if (gva != MMIO_GVA_ANY && vcpu->arch.mmio_gva != (gva & PAGE_MASK)) return; vcpu->arch.mmio_gva = 0; @@ -94,7 +103,8 @@ static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva) static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva) { - if (vcpu->arch.mmio_gva && vcpu->arch.mmio_gva == (gva & PAGE_MASK)) + if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gva && + vcpu->arch.mmio_gva == (gva & PAGE_MASK)) return true; return false; @@ -102,7 +112,8 @@ static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva) static inline bool vcpu_match_mmio_gpa(struct kvm_vcpu *vcpu, gpa_t gpa) { - if (vcpu->arch.mmio_gfn && vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT) + if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gfn && + vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT) return true; return false;