Skip to contentSkip to conversation

kvm: x86: Do not handle MMIO request in fast_page_fault

PATCH RESEND In review [email protected] 2 participants 3 messages Sep 5, 2017 – Sep 14, 2017

Subsystems (3)
x86 KVM KVM x86
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH RESEND 1/1 kvm: x86: Do not handle MMIO request in fast_page_fault

From: Changbin Du <[email protected]>

If it is a MMIO request, it should be handled by slow path. This patch actually fixed below warning when mmu debug is enabled.

WARNING: CPU: 5 PID: 2282 at arch/x86/kvm/mmu.c:226 fast_page_fault+0x41b/0x520
CPU: 5 PID: 2282 Comm: qemu-system-x86 Not tainted 4.13.0-rc6+ #34
task: ffff9b47f5286000 task.stack: ffffb18d03b28000
RIP: 0010:fast_page_fault+0x41b/0x520
Call Trace:
  tdp_page_fault+0xfb/0x290
  kvm_mmu_page_fault+0x61/0x120
  handle_ept_misconfig+0x1ba/0x1c0
  vmx_handle_exit+0xb8/0xd70
  ? kvm_arch_vcpu_ioctl_run+0x9b6/0x18e0
  kvm_arch_vcpu_ioctl_run+0xa5a/0x18e0
  ? kvm_arch_vcpu_load+0x62/0x230
  kvm_vcpu_ioctl+0x340/0x6c0
  ? kvm_vcpu_ioctl+0x340/0x6c0
  ? lock_acquire+0xf5/0x1f0
  do_vfs_ioctl+0xa2/0x670
  ? __fget+0x107/0x200
  SyS_ioctl+0x79/0x90
  entry_SYSCALL_64_fastpath+0x23/0xc2
Signed-off-by Changbin Du <[email protected]>
---
 arch/x86/kvm/mmu.c | 3 +++
 1 file changed, 3 insertions(+)
arch/x86/kvm/mmu.c +3 -0
index 9d3f275..63c3360 100644
@@ -3180,6 +3180,9 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
 			    iterator.level < level)
 				break;
 
+		if (is_mmio_spte(spte))
+			break;
+
 		sp = page_header(__pa(iterator.sptep));
 		if (!is_last_spte(spte, sp->role.level))
 			break;
Signature · 1 line
2.7.4
#1 lore raw

2017-09-05 18:37+0800, [email protected]:

Quoted 35 lines

From: Changbin Du <[email protected]>

If it is a MMIO request, it should be handled by slow path. This patch actually fixed below warning when mmu debug is enabled.

WARNING: CPU: 5 PID: 2282 at arch/x86/kvm/mmu.c:226 fast_page_fault+0x41b/0x520
CPU: 5 PID: 2282 Comm: qemu-system-x86 Not tainted 4.13.0-rc6+ #34
task: ffff9b47f5286000 task.stack: ffffb18d03b28000
RIP: 0010:fast_page_fault+0x41b/0x520
Call Trace:
  tdp_page_fault+0xfb/0x290
  kvm_mmu_page_fault+0x61/0x120
  handle_ept_misconfig+0x1ba/0x1c0
  vmx_handle_exit+0xb8/0xd70
  ? kvm_arch_vcpu_ioctl_run+0x9b6/0x18e0
  kvm_arch_vcpu_ioctl_run+0xa5a/0x18e0
  ? kvm_arch_vcpu_load+0x62/0x230
  kvm_vcpu_ioctl+0x340/0x6c0
  ? kvm_vcpu_ioctl+0x340/0x6c0
  ? lock_acquire+0xf5/0x1f0
  do_vfs_ioctl+0xa2/0x670
  ? __fget+0x107/0x200
  SyS_ioctl+0x79/0x90
  entry_SYSCALL_64_fastpath+0x23/0xc2
Signed-off-by Changbin Du <[email protected]>
---
 arch/x86/kvm/mmu.c | 3 +++
 1 file changed, 3 insertions(+)
arch/x86/kvm/mmu.c +0 -0
index 9d3f275..63c3360 100644

arch/x86/kvm/mmu.c static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level, · line 3184

Quoted 5 lines
arch/x86/kvm/mmu.c +2 -0
@@ -3180,6 +3180,9 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
 			    iterator.level < level)
 				break;
 
+		if (is_mmio_spte(spte))
+			break;

Hm, handle_ept_misconfig() calls kvm_mmu_page_fault with error_code = PFERR_RSVD_MASK. This error_code gets propagated and checked at the beginning of page_fault_can_be_fast(), where it should break the function execution.

How did the execution get all the way to the loop?

Thanks.

author
#2 lore raw
Quoted 47 lines · Radim Krčmář

2017-09-05 18:37+0800, [email protected]:

Quoted 35 lines

From: Changbin Du <[email protected]>

If it is a MMIO request, it should be handled by slow path. This patch actually fixed below warning when mmu debug is enabled.

WARNING: CPU: 5 PID: 2282 at arch/x86/kvm/mmu.c:226 fast_page_fault+0x41b/0x520
CPU: 5 PID: 2282 Comm: qemu-system-x86 Not tainted 4.13.0-rc6+ #34
task: ffff9b47f5286000 task.stack: ffffb18d03b28000
RIP: 0010:fast_page_fault+0x41b/0x520
Call Trace:
  tdp_page_fault+0xfb/0x290
  kvm_mmu_page_fault+0x61/0x120
  handle_ept_misconfig+0x1ba/0x1c0
  vmx_handle_exit+0xb8/0xd70
  ? kvm_arch_vcpu_ioctl_run+0x9b6/0x18e0
  kvm_arch_vcpu_ioctl_run+0xa5a/0x18e0
  ? kvm_arch_vcpu_load+0x62/0x230
  kvm_vcpu_ioctl+0x340/0x6c0
  ? kvm_vcpu_ioctl+0x340/0x6c0
  ? lock_acquire+0xf5/0x1f0
  do_vfs_ioctl+0xa2/0x670
  ? __fget+0x107/0x200
  SyS_ioctl+0x79/0x90
  entry_SYSCALL_64_fastpath+0x23/0xc2
Signed-off-by Changbin Du <[email protected]>
---
 arch/x86/kvm/mmu.c | 3 +++
 1 file changed, 3 insertions(+)
arch/x86/kvm/mmu.c +0 -0
index 9d3f275..63c3360 100644

arch/x86/kvm/mmu.c static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level, · line 3184

Quoted 5 lines
arch/x86/kvm/mmu.c +2 -0
@@ -3180,6 +3180,9 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
 			    iterator.level < level)
 				break;
 
+		if (is_mmio_spte(spte))
+			break;

Hm, handle_ept_misconfig() calls kvm_mmu_page_fault with error_code = PFERR_RSVD_MASK. This error_code gets propagated and checked at the beginning of page_fault_can_be_fast(), where it should break the function execution.

Quoted 2 lines

How did the execution get all the way to the loop?

hmm, a recent Paolo's cleanup patch already fixed it. e08d26f ("KVM: x86: simplify ept_misconfig")

In the past, PFERR_RSVD_MASK is not set.

So this patch doesnt need any more. thanks.

Quoted 1 line

Thanks.

Signature · 2 lines
Thanks,
Changbin Du