On 07/07/2010 08:16 PM, Gleb Natapov wrote:
When shadow pages are in use sometimes KVM try to emulate an instruction
when it accesses a shadowed page. If emulation fails KVM un-shadows the
page and reenter guest to allow vcpu to execute the instruction. If page
is not in shadow page hash KVM assumes that this was attempt to do MMIO
and reports emulation failure to userspace since there is no way to fix
the situation. This logic has a race though. If two vcpus tries to write
to the same shadowed page simultaneously both will enter emulator, but
only one of them will find the page in shadow page hash since the one who
founds it also removes it from there, so another cpu will report failure
to userspace and will abort the guest.
Fix this by checking (in addition to checking shadowed page hash) that
page that caused the emulation belongs to valid memory slot. If it is
then reenter the guest to allow vcpu to reexecute the instruction.
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 7070b41..dd7b241 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4000,6 +4000,8 @@ int emulate_instruction(struct kvm_vcpu *vcpu,
if (r) {
if (kvm_mmu_unprotect_page_virt(vcpu, cr2))
return EMULATE_DONE;
+ if (!kvm_is_error_hva(gfn_to_hva(vcpu->kvm, cr2)))
+ return EMULATE_DONE;
cr2 is a gva, not a gfn.
cr2 is not always valid, but I guess that's for a later patch.
if (emulation_type& EMULTYPE_SKIP)
return EMULATE_FAIL;
return handle_emulation_failure(vcpu);
@@ -4026,6 +4028,8 @@ restart:
*/
if (kvm_mmu_unprotect_page_virt(vcpu, cr2))
return EMULATE_DONE;
+ if (!kvm_is_error_hva(gfn_to_hva(vcpu->kvm, cr2)))
+ return EMULATE_DONE;
Code is duplicated. Helper?
return handle_emulation_failure(vcpu);
}
--
error compiling committee.c: too many arguments to function
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
