On Aug 2, 2014, at 7:54 AM, David Matlack <dmatlack@xxxxxxxxxx> wrote: > The following events can lead to an incorrect KVM_EXIT_MMIO bubbling > up to userspace: > > (1) Guest accesses gpa X without a memory slot. The gfn is cached in > struct kvm_vcpu_arch (mmio_gfn). On Intel EPT-enabled hosts, KVM sets > the SPTE write-execute-noread so that future accesses cause > EPT_MISCONFIGs. > > (2) Host userspace creates a memory slot via KVM_SET_USER_MEMORY_REGION > covering the page just accessed. > > (3) Guest attempts to read or write to gpa X again. On Intel, this > generates an EPT_MISCONFIG. The memory slot generation number that > was incremented in (2) would normally take care of this but we fast > path mmio faults through quickly_check_mmio_pf(), which only checks > the per-vcpu mmio cache. Since we hit the cache, KVM passes a > KVM_EXIT_MMIO up to userspace. > Good catch, thank you, David! > This patch fixes the issue by clearing the mmio cache in the > KVM_MR_CREATE code path. > - introduce KVM_REQ_CLEAR_MMIO_CACHE for clearing all vcpu mmio > caches. > - extend vcpu_clear_mmio_info to clear mmio_gfn in addition to > mmio_gva, since both can be used to fast path mmio faults. > - issue KVM_REQ_CLEAR_MMIO_CACHE during memslot creation to flush > the mmio cache. > - in mmu_sync_roots, unconditionally clear the mmio cache since > even direct_map (e.g. tdp) hosts use it. I prefer to also caching the spte’s generation number, then check the number in quickly_check_mmio_pf(). -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
