kvm_fixup_and_inject_pf_error() was introduced to fixup the error code(
e.g., to add RSVD flag) and inject the #PF to the guest, when guest
MAXPHYADDR is smaller than the host one.
When it comes to nested, L0 is expected to intercept and fix up the #PF
and then inject to L2 directly if
- L2.MAXPHYADDR < L0.MAXPHYADDR and
- L1 has no intention to intercept L2's #PF (e.g., L2 and L1 have the
same MAXPHYADDR value && L1 is using EPT for L2),
instead of constructing a #PF VM Exit to L1. Currently, with PFEC_MASK
and PFEC_MATCH both set to 0 in vmcs02, the interception and injection
may happen on all L2 #PFs.
However, failing to initialize 'fault' in kvm_fixup_and_inject_pf_error()
may cause the fault.async_page_fault being NOT zeroed, and later the #PF
being treated as a nested async page fault, and then being injected to L1.
Instead of zeroing 'fault' at the beginning of this function, we mannually
set the value of 'fault.async_page_fault', because false is the value we
really expect.
Fixes: 897861479c064 ("KVM: x86: Add helper functions for illegal GPA checking and page fault injection")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216178
Reported-by: Yang Lixiao <[email protected]>
Signed-off-by: Yu Zhang <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
---
v2:
- Set 'fault.async_page_fault' mannually to false, instead of initializing
the whole structure based on Sean's suggestion.
- Commit message changes based on the code change.
---
arch/x86/kvm/x86.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 031678eff28e..ffd8c96cfaa5 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -12999,6 +12999,7 @@ void kvm_fixup_and_inject_pf_error(struct kvm_vcpu *vcpu, gva_t gva, u16 error_c
fault.error_code = error_code;
fault.nested_page_fault = false;
fault.address = gva;
+ fault.async_page_fault = false;
}
vcpu->arch.walk_mmu->inject_page_fault(vcpu, &fault);
}
--
2.25.1
On Mon, Jul 18, 2022, Yu Zhang wrote:
> kvm_fixup_and_inject_pf_error() was introduced to fixup the error code(
> e.g., to add RSVD flag) and inject the #PF to the guest, when guest
> MAXPHYADDR is smaller than the host one.
>
> When it comes to nested, L0 is expected to intercept and fix up the #PF
> and then inject to L2 directly if
> - L2.MAXPHYADDR < L0.MAXPHYADDR and
> - L1 has no intention to intercept L2's #PF (e.g., L2 and L1 have the
> same MAXPHYADDR value && L1 is using EPT for L2),
> instead of constructing a #PF VM Exit to L1. Currently, with PFEC_MASK
> and PFEC_MATCH both set to 0 in vmcs02, the interception and injection
> may happen on all L2 #PFs.
>
> However, failing to initialize 'fault' in kvm_fixup_and_inject_pf_error()
> may cause the fault.async_page_fault being NOT zeroed, and later the #PF
> being treated as a nested async page fault, and then being injected to L1.
> Instead of zeroing 'fault' at the beginning of this function, we mannually
> set the value of 'fault.async_page_fault', because false is the value we
> really expect.
>
> Fixes: 897861479c064 ("KVM: x86: Add helper functions for illegal GPA checking and page fault injection")
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216178
> Reported-by: Yang Lixiao <[email protected]>
> Signed-off-by: Yu Zhang <[email protected]>
> Signed-off-by: Sean Christopherson <[email protected]>
No need for my SoB, I was just providing feedback. Other than that,
Reviewed-by: Sean Christopherson <[email protected]>
On Tue, Jul 19, 2022 at 07:01:41PM +0000, Sean Christopherson wrote:
> On Mon, Jul 18, 2022, Yu Zhang wrote:
> > kvm_fixup_and_inject_pf_error() was introduced to fixup the error code(
> > e.g., to add RSVD flag) and inject the #PF to the guest, when guest
> > MAXPHYADDR is smaller than the host one.
> >
> > When it comes to nested, L0 is expected to intercept and fix up the #PF
> > and then inject to L2 directly if
> > - L2.MAXPHYADDR < L0.MAXPHYADDR and
> > - L1 has no intention to intercept L2's #PF (e.g., L2 and L1 have the
> > same MAXPHYADDR value && L1 is using EPT for L2),
> > instead of constructing a #PF VM Exit to L1. Currently, with PFEC_MASK
> > and PFEC_MATCH both set to 0 in vmcs02, the interception and injection
> > may happen on all L2 #PFs.
> >
> > However, failing to initialize 'fault' in kvm_fixup_and_inject_pf_error()
> > may cause the fault.async_page_fault being NOT zeroed, and later the #PF
> > being treated as a nested async page fault, and then being injected to L1.
> > Instead of zeroing 'fault' at the beginning of this function, we mannually
> > set the value of 'fault.async_page_fault', because false is the value we
> > really expect.
> >
> > Fixes: 897861479c064 ("KVM: x86: Add helper functions for illegal GPA checking and page fault injection")
> > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216178
> > Reported-by: Yang Lixiao <[email protected]>
> > Signed-off-by: Yu Zhang <[email protected]>
> > Signed-off-by: Sean Christopherson <[email protected]>
>
> No need for my SoB, I was just providing feedback. Other than that,
>
Thanks! It's a very detailed suggestion. :)
> Reviewed-by: Sean Christopherson <[email protected]>
>
@Paolo Any comment on this fix, and on the test case change(https://www.spinics.net/lists/kvm/msg283600.html)? Thanks!
B.R.
Yu
On Thu, Jul 21, 2022 at 05:22:14PM +0800, Yu Zhang wrote:
> On Tue, Jul 19, 2022 at 07:01:41PM +0000, Sean Christopherson wrote:
> > On Mon, Jul 18, 2022, Yu Zhang wrote:
> > > kvm_fixup_and_inject_pf_error() was introduced to fixup the error code(
> > > e.g., to add RSVD flag) and inject the #PF to the guest, when guest
> > > MAXPHYADDR is smaller than the host one.
> > >
> > > When it comes to nested, L0 is expected to intercept and fix up the #PF
> > > and then inject to L2 directly if
> > > - L2.MAXPHYADDR < L0.MAXPHYADDR and
> > > - L1 has no intention to intercept L2's #PF (e.g., L2 and L1 have the
> > > same MAXPHYADDR value && L1 is using EPT for L2),
> > > instead of constructing a #PF VM Exit to L1. Currently, with PFEC_MASK
> > > and PFEC_MATCH both set to 0 in vmcs02, the interception and injection
> > > may happen on all L2 #PFs.
> > >
> > > However, failing to initialize 'fault' in kvm_fixup_and_inject_pf_error()
> > > may cause the fault.async_page_fault being NOT zeroed, and later the #PF
> > > being treated as a nested async page fault, and then being injected to L1.
> > > Instead of zeroing 'fault' at the beginning of this function, we mannually
> > > set the value of 'fault.async_page_fault', because false is the value we
> > > really expect.
> > >
> > > Fixes: 897861479c064 ("KVM: x86: Add helper functions for illegal GPA checking and page fault injection")
> > > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216178
> > > Reported-by: Yang Lixiao <[email protected]>
> > > Signed-off-by: Yu Zhang <[email protected]>
> > > Signed-off-by: Sean Christopherson <[email protected]>
> >
> > No need for my SoB, I was just providing feedback. Other than that,
> >
> Thanks! It's a very detailed suggestion. :)
>
> > Reviewed-by: Sean Christopherson <[email protected]>
> >
>
> @Paolo Any comment on this fix, and on the test case change(https://www.spinics.net/lists/kvm/msg283600.html)? Thanks!
>
> B.R.
> Yu
Ping... Or should I send another version? Thanks!
B.R.
Yu
On Thu, Aug 04, 2022, Yu Zhang wrote:
> On Thu, Jul 21, 2022 at 05:22:14PM +0800, Yu Zhang wrote:
> > On Tue, Jul 19, 2022 at 07:01:41PM +0000, Sean Christopherson wrote:
> > > On Mon, Jul 18, 2022, Yu Zhang wrote:
> > > > kvm_fixup_and_inject_pf_error() was introduced to fixup the error code(
> > > > e.g., to add RSVD flag) and inject the #PF to the guest, when guest
> > > > MAXPHYADDR is smaller than the host one.
> > > >
> > > > When it comes to nested, L0 is expected to intercept and fix up the #PF
> > > > and then inject to L2 directly if
> > > > - L2.MAXPHYADDR < L0.MAXPHYADDR and
> > > > - L1 has no intention to intercept L2's #PF (e.g., L2 and L1 have the
> > > > same MAXPHYADDR value && L1 is using EPT for L2),
> > > > instead of constructing a #PF VM Exit to L1. Currently, with PFEC_MASK
> > > > and PFEC_MATCH both set to 0 in vmcs02, the interception and injection
> > > > may happen on all L2 #PFs.
> > > >
> > > > However, failing to initialize 'fault' in kvm_fixup_and_inject_pf_error()
> > > > may cause the fault.async_page_fault being NOT zeroed, and later the #PF
> > > > being treated as a nested async page fault, and then being injected to L1.
> > > > Instead of zeroing 'fault' at the beginning of this function, we mannually
> > > > set the value of 'fault.async_page_fault', because false is the value we
> > > > really expect.
> > > >
> > > > Fixes: 897861479c064 ("KVM: x86: Add helper functions for illegal GPA checking and page fault injection")
> > > > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216178
> > > > Reported-by: Yang Lixiao <[email protected]>
> > > > Signed-off-by: Yu Zhang <[email protected]>
> > > > Signed-off-by: Sean Christopherson <[email protected]>
> > >
> > > No need for my SoB, I was just providing feedback. Other than that,
> > >
> > Thanks! It's a very detailed suggestion. :)
> >
> > > Reviewed-by: Sean Christopherson <[email protected]>
> > >
> >
> > @Paolo Any comment on this fix, and on the test case change(https://www.spinics.net/lists/kvm/msg283600.html)? Thanks!
> >
> > B.R.
> > Yu
>
> Ping... Or should I send another version? Thanks!
Shouldn't need to send a new version.
Paolo, can you grab this for 6.0-rc1?
Queued, thanks.
Paolo