From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gleb Natapov Subject: [PATCH 3/3] Reenter guest after instruction emulation failure if emulation was due to access to non-mmio address. Date: Wed, 7 Jul 2010 20:16:46 +0300 Message-ID: <1278523006-21645-3-git-send-email-gleb@redhat.com> References: <1278523006-21645-1-git-send-email-gleb@redhat.com> Cc: kvm@vger.kernel.org To: avi@redhat.com, mtosatti@redhat.com Return-path: Received: from mx1.redhat.com ([209.132.183.28]:1025 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753162Ab0GGRQr (ORCPT ); Wed, 7 Jul 2010 13:16:47 -0400 Received: from int-mx05.intmail.prod.int.phx2.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.18]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o67HGlXY031143 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 7 Jul 2010 13:16:47 -0400 In-Reply-To: <1278523006-21645-1-git-send-email-gleb@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: When shadow pages are in use sometimes KVM try to emulate an instruction when it accesses a shadowed page. If emulation fails KVM un-shadows the page and reenter guest to allow vcpu to execute the instruction. If page is not in shadow page hash KVM assumes that this was attempt to do MMIO and reports emulation failure to userspace since there is no way to fix the situation. This logic has a race though. If two vcpus tries to write to the same shadowed page simultaneously both will enter emulator, but only one of them will find the page in shadow page hash since the one who founds it also removes it from there, so another cpu will report failure to userspace and will abort the guest. Fix this by checking (in addition to checking shadowed page hash) that page that caused the emulation belongs to valid memory slot. If it is then reenter the guest to allow vcpu to reexecute the instruction. Signed-off-by: Gleb Natapov --- arch/x86/kvm/x86.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 7070b41..dd7b241 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4000,6 +4000,8 @@ int emulate_instruction(struct kvm_vcpu *vcpu, if (r) { if (kvm_mmu_unprotect_page_virt(vcpu, cr2)) return EMULATE_DONE; + if (!kvm_is_error_hva(gfn_to_hva(vcpu->kvm, cr2))) + return EMULATE_DONE; if (emulation_type & EMULTYPE_SKIP) return EMULATE_FAIL; return handle_emulation_failure(vcpu); @@ -4026,6 +4028,8 @@ restart: */ if (kvm_mmu_unprotect_page_virt(vcpu, cr2)) return EMULATE_DONE; + if (!kvm_is_error_hva(gfn_to_hva(vcpu->kvm, cr2))) + return EMULATE_DONE; return handle_emulation_failure(vcpu); } -- 1.7.1