From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753300AbdHKPBV (ORCPT ); Fri, 11 Aug 2017 11:01:21 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34490 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753154AbdHKPBT (ORCPT ); Fri, 11 Aug 2017 11:01:19 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 11EF99FFD1 Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH v3] KVM: MMU: Fix guest stuck during boot due to read/write emulation against GVA To: Wanpeng Li , linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Wanpeng Li , Brijesh Singh , David Hildenbrand References: <1502433993-4326-1-git-send-email-wanpeng.li@hotmail.com> From: Paolo Bonzini Message-ID: <63f88e07-70c2-587b-40d1-419943986c05@redhat.com> Date: Fri, 11 Aug 2017 17:01:11 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <1502433993-4326-1-git-send-email-wanpeng.li@hotmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Fri, 11 Aug 2017 15:01:19 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/08/2017 08:46, Wanpeng Li wrote: > From: Wanpeng Li > > Commit c016004494b0 (KVM: x86: Avoid guest page table walk when gpa_available > is set) avoids the page table walk when cr2 has already contained a valid GPA. > However, that is not the truth if ept == 0 and shadow page table is used. In > this scenario cr2 can just contains a valid GVA. The commit results in guest > stuck during boot due to read/write emulation against GVA instead of GPA of > the guest. > > This patch fixes it by setting the gpa_available flag under direct mode. > > Cc: Paolo Bonzini > Cc: Radim Krčmář > Cc: Brijesh Singh > Cc: David Hildenbrand > Signed-off-by: Wanpeng Li > --- > arch/x86/kvm/mmu.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c > index 849312d..4780348 100644 > --- a/arch/x86/kvm/mmu.c > +++ b/arch/x86/kvm/mmu.c > @@ -3791,8 +3791,11 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code, > > if (need_unprotect && kvm_event_needs_reinjection(vcpu)) > kvm_mmu_unprotect_page_virt(vcpu, fault_address); > - vcpu->arch.gpa_available = true; > - vcpu->arch.gpa_val = fault_address; > + /* With shadow page tables, cr2 could contain a GVA, not a GPA */ A GVA or a nested GPA, more precisely. > + if (vcpu->arch.mmu.direct_map) { > + vcpu->arch.gpa_available = true; > + vcpu->arch.gpa_val = fault_address; > + } > r = kvm_mmu_page_fault(vcpu, fault_address, error_code, insn, > insn_len); > break; > Also not enough, we need diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 5fd7ecbf7284..283e94de3853 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -6393,7 +6393,7 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu) error_code |= (exit_qualification & 0x100) != 0 ? PFERR_GUEST_FINAL_MASK : PFERR_GUEST_PAGE_MASK; - vcpu->arch.gpa_available = true; + vcpu->arch.gpa_available = !is_guest_mode(vcpu); vcpu->arch.gpa_val = gpa; vcpu->arch.exit_qualification = exit_qualification; @@ -6412,7 +6412,7 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu) } ret = handle_mmio_page_fault(vcpu, gpa, true); - vcpu->arch.gpa_available = true; + vcpu->arch.gpa_available = !is_guest_mode(vcpu); vcpu->arch.gpa_val = gpa; if (likely(ret == RET_MMIO_PF_EMULATE)) return x86_emulate_instruction(vcpu, gpa, 0, NULL, 0) == Paolo