Commit 64531a3b authored Aug 07, 2017 by Brijesh Singh Committed by Paolo Bonzini Aug 10, 2017

KVM: SVM: Limit PFERR_NESTED_GUEST_PAGE error_code check to L1 guest



Commit 14727754 ("kvm: svm: Add support for additional SVM NPF error
codes", 2016-11-23) added a new error code to aid nested page fault
handling.  The commit unprotects (kvm_mmu_unprotect_page) the page when
we get a NPF due to guest page table walk where the page was marked RO.

However, if an L0->L2 shadow nested page table can also be marked read-only
when a page is read only in L1's nested page table.  If such a page
is accessed by L2 while walking page tables it can cause a nested
page fault (page table walks are write accesses).  However, after
kvm_mmu_unprotect_page we may get another page fault, and again in an
endless stream.

To cover this use case, we qualify the new error_code check with
vcpu->arch.mmu_direct_map so that the error_code check would run on L1
guest, and not the L2 guest.  This avoids hitting the above scenario.

Fixes: 14727754
Cc: stable@vger.kernel.org
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Thomas Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent bbeac283

arch/x86/kvm/mmu.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -4840,7 +4840,8 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
		* Note: AMD only (since it supports the PFERR_GUEST_PAGE_MASK used
		* in PFERR_NEXT_GUEST_PAGE)
		*/
		if (error_code == PFERR_NESTED_GUEST_PAGE) {
		if (vcpu->arch.mmu.direct_map &&
		error_code == PFERR_NESTED_GUEST_PAGE) {
		kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(cr2));
		return 1;
		}

Admin message