From patchwork Fri Dec 23 00:57:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 36036 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:e747:0:0:0:0:0 with SMTP id c7csp69716wrn; Thu, 22 Dec 2022 17:00:09 -0800 (PST) X-Google-Smtp-Source: AMrXdXtvNV7VqxXYkWgNIisvRqIYg7D7etE9FCYR8Uo2lwDuktNmrPha+z3ICOSjCEPWcHG48omE X-Received: by 2002:a17:903:54d:b0:190:fbbd:277d with SMTP id jo13-20020a170903054d00b00190fbbd277dmr8089373plb.17.1671757209023; Thu, 22 Dec 2022 17:00:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671757209; cv=none; d=google.com; s=arc-20160816; b=OuZ5E2zDa+HbjmIboorvgbqPCB9CrJgwE5SWfdf3hjxKij0iwpPjGWMjZlZO94RV78 pgu79li/895Gc12qUr3rc9FzsFwI+xSQ6ccJgLvWXLx0dSuurQOZ+pOiD3JdeXR7C9JG bM+IhGv+tO1tW03iQkptkGmkTQ/2L87WZ4j7Zt1gSTkiqz2qMRfedSV2/UCApzpTxqD0 spa6XT88z3FAo42cPJdWGf8jPTq3WJ6/WTuemIEEu1Kcg+S/pK0bmNVz/FZ6cquR3jnw +me3hAzh8xEwNn68XZ7DSW+m43L3WgK/gLLgPPRziTUF+U6xz7BpqFocYzd3ojcx6drE UJ0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:dkim-signature; bh=YKmxahxi7v80+SveRWediRLA4L1C9QoF+MSyKdE1EyE=; b=zD1aWF1K8qVvroM9HwKx6um4c0Ob3KYaZjCvE+uHPWQ12eVVPCsTsInQX9y0htwEhD 59jh+OZsq+PM10wsnvfBikGAd11CRhyMUyfA1gQkhlMkIL9F/qKq1PtmuiIo+RW9zUzY yaQqT9f/7Ythx2xC92FzxkdTb7FwRaE55Fc7oYgdcXkTTAzTnxEGQt+0wQA6xBcyZxuw G2m3R9fpiu89pgmHFoWBgIM1uWJrmmuXYLcZpIkHgcakBO9wAr5i7bvv0bhwRzxUbw+B QPrv9DUsU8CL5w32vf/vyS3o4zjEtmRM9o1CVoUsnhfXPKOkNKYLBEYFVGCpx0bX8lhu KfTg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=pzqHiVzm; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id o9-20020a170903210900b00179c921918esi1704537ple.17.2022.12.22.16.59.55; Thu, 22 Dec 2022 17:00:09 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=pzqHiVzm; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229982AbiLWA7B (ORCPT + 99 others); Thu, 22 Dec 2022 19:59:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58082 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235816AbiLWA61 (ORCPT ); Thu, 22 Dec 2022 19:58:27 -0500 Received: from mail-yw1-x114a.google.com (mail-yw1-x114a.google.com [IPv6:2607:f8b0:4864:20::114a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2757528E38 for ; Thu, 22 Dec 2022 16:58:01 -0800 (PST) Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-3b5da1b3130so36659847b3.5 for ; Thu, 22 Dec 2022 16:58:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=YKmxahxi7v80+SveRWediRLA4L1C9QoF+MSyKdE1EyE=; b=pzqHiVzmbCJVgSP/zZazHvauSNJ1Xggxqch3d5hg80tPjabEMn22M++74adJKCEHyF i8th2MPbAWIBwGjsOYvN4xNxaNewsNAKvovLb2rXUnfjWOTrHbOrCKDA/K+ngWzEvK/d 5IVrlHDUZ81XkD9u3J1N5fEl/6r+EWo7a/PbkGnCH/fzMgJDERcJM+yWgC+7U+OO9Dan 8Wf0dwNRPDADxTTHPsvp8MGs9aoXfmTAfD1xoaNsk3XZ6rkWcyUfkOusx9EOZkJxVvww PReVGLaQZl29hEWj1ns0YlP6p8ukIgWQle5R0AdYGqHPue1OoCFaCL99LHV0hUql2p4C P67g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=YKmxahxi7v80+SveRWediRLA4L1C9QoF+MSyKdE1EyE=; b=y/kUES4M14flyO/fkikIiGW+HAbDZADD85we0wLQ3bCMPO6T+732I7CnbirvW3DT5p ZSiagCPd+IRNunEiV+jSpsAx7f78gxjLCmpH0jhNlUm4bJFRiWKxy/NkSspfeqEE/hNW bK00Qdox86a7hkPNbRddGY82qYWsqteVuFCUWrg3YKR9AD77DcIGoSIrW3Q4oy33YAYr nPq80I9LtOktuLNtewtefEUNX+oWwthBAjfLLmRzWQZQUEC/D9vpBNJFaHPxzrnDTEPt lZyuZIrr0subOTQ4fKgxwCt07Su0MaZSk8iMgjFVjdPAAoSstmO1uUcCtMd0uwZcXDx7 0Ugg== X-Gm-Message-State: AFqh2krgoSWqWEW9v1c+Xyb4WxN13n8yZoouWrAkN2RFufUJKCo6ES6H lT2wNFIR/YOiN2OSbM2kaKmY3soBgZs= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a25:9804:0:b0:6f4:57a4:7838 with SMTP id a4-20020a259804000000b006f457a47838mr811168ybo.648.1671757080342; Thu, 22 Dec 2022 16:58:00 -0800 (PST) Reply-To: Sean Christopherson Date: Fri, 23 Dec 2022 00:57:21 +0000 In-Reply-To: <20221223005739.1295925-1-seanjc@google.com> Mime-Version: 1.0 References: <20221223005739.1295925-1-seanjc@google.com> X-Mailer: git-send-email 2.39.0.314.g84b9a713c41-goog Message-ID: <20221223005739.1295925-10-seanjc@google.com> Subject: [PATCH 09/27] drm/i915/gvt: Protect gfn hash table with dedicated mutex From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Zhenyu Wang , Zhi Wang Cc: kvm@vger.kernel.org, intel-gvt-dev@lists.freedesktop.org, intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yan Zhao , Ben Gardon X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752964487109918523?= X-GMAIL-MSGID: =?utf-8?q?1752964487109918523?= Add and use a new mutex, gfn_lock, to protect accesses to the hash table used to track which gfns are write-protected when shadowing the guest's GTT. This fixes a bug where kvmgt_page_track_write(), which doesn't hold kvm->mmu_lock, could race with intel_gvt_page_track_remove() and trigger a use-after-free. Fixing kvmgt_page_track_write() by taking kvm->mmu_lock is not an option as mmu_lock is a r/w spinlock, and intel_vgpu_page_track_handler() might sleep when acquiring vgpu->cache_lock deep down the callstack: intel_vgpu_page_track_handler() | |-> page_track->handler / ppgtt_write_protection_handler() | |-> ppgtt_handle_guest_write_page_table_bytes() | |-> ppgtt_handle_guest_write_page_table() | |-> ppgtt_handle_guest_entry_removal() | |-> ppgtt_invalidate_pte() | |-> intel_gvt_dma_unmap_guest_page() | |-> mutex_lock(&vgpu->cache_lock); Signed-off-by: Sean Christopherson --- drivers/gpu/drm/i915/gvt/gvt.h | 1 + drivers/gpu/drm/i915/gvt/kvmgt.c | 65 ++++++++++++++++++++------------ drivers/gpu/drm/i915/gvt/vgpu.c | 1 + 3 files changed, 43 insertions(+), 24 deletions(-) diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h index dbf8d7470b2c..fbfd7eafec14 100644 --- a/drivers/gpu/drm/i915/gvt/gvt.h +++ b/drivers/gpu/drm/i915/gvt/gvt.h @@ -176,6 +176,7 @@ struct intel_vgpu { struct vfio_device vfio_device; struct intel_gvt *gvt; struct mutex vgpu_lock; + struct mutex gfn_lock; int id; bool active; bool attached; diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c index ca9926061cd8..a4747e153dad 100644 --- a/drivers/gpu/drm/i915/gvt/kvmgt.c +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c @@ -366,6 +366,8 @@ __kvmgt_protect_table_find(struct intel_vgpu *info, gfn_t gfn) { struct kvmgt_pgfn *p, *res = NULL; + lockdep_assert_held(&info->gfn_lock); + hash_for_each_possible(info->ptable, p, hnode, gfn) { if (gfn == p->gfn) { res = p; @@ -388,6 +390,8 @@ static void kvmgt_protect_table_add(struct intel_vgpu *info, gfn_t gfn) { struct kvmgt_pgfn *p; + lockdep_assert_held(&info->gfn_lock); + if (kvmgt_gfn_is_write_protected(info, gfn)) return; @@ -1563,60 +1567,68 @@ int intel_gvt_page_track_add(struct intel_vgpu *info, u64 gfn) { struct kvm *kvm = info->vfio_device.kvm; struct kvm_memory_slot *slot; - int idx; + int idx, ret = 0; if (!info->attached) return -ESRCH; + mutex_lock(&info->gfn_lock); + + if (kvmgt_gfn_is_write_protected(info, gfn)) + goto out; + idx = srcu_read_lock(&kvm->srcu); slot = gfn_to_memslot(kvm, gfn); if (!slot) { srcu_read_unlock(&kvm->srcu, idx); - return -EINVAL; + ret = -EINVAL; + goto out; } write_lock(&kvm->mmu_lock); - - if (kvmgt_gfn_is_write_protected(info, gfn)) - goto out; - kvm_slot_page_track_add_page(kvm, slot, gfn, KVM_PAGE_TRACK_WRITE); + write_unlock(&kvm->mmu_lock); + + srcu_read_unlock(&kvm->srcu, idx); + kvmgt_protect_table_add(info, gfn); - out: - write_unlock(&kvm->mmu_lock); - srcu_read_unlock(&kvm->srcu, idx); - return 0; + mutex_unlock(&info->gfn_lock); + return ret; } int intel_gvt_page_track_remove(struct intel_vgpu *info, u64 gfn) { struct kvm *kvm = info->vfio_device.kvm; struct kvm_memory_slot *slot; - int idx; + int idx, ret = 0; if (!info->attached) return 0; - idx = srcu_read_lock(&kvm->srcu); - slot = gfn_to_memslot(kvm, gfn); - if (!slot) { - srcu_read_unlock(&kvm->srcu, idx); - return -EINVAL; - } - - write_lock(&kvm->mmu_lock); + mutex_lock(&info->gfn_lock); if (!kvmgt_gfn_is_write_protected(info, gfn)) goto out; + idx = srcu_read_lock(&kvm->srcu); + slot = gfn_to_memslot(kvm, gfn); + if (!slot) { + srcu_read_unlock(&kvm->srcu, idx); + ret = -EINVAL; + goto out; + } + + write_lock(&kvm->mmu_lock); kvm_slot_page_track_remove_page(kvm, slot, gfn, KVM_PAGE_TRACK_WRITE); + write_unlock(&kvm->mmu_lock); + srcu_read_unlock(&kvm->srcu, idx); + kvmgt_protect_table_del(info, gfn); out: - write_unlock(&kvm->mmu_lock); - srcu_read_unlock(&kvm->srcu, idx); - return 0; + mutex_unlock(&info->gfn_lock); + return ret; } static void kvmgt_page_track_write(struct kvm_vcpu *vcpu, gpa_t gpa, @@ -1627,11 +1639,13 @@ static void kvmgt_page_track_write(struct kvm_vcpu *vcpu, gpa_t gpa, container_of(node, struct intel_vgpu, track_node); mutex_lock(&info->vgpu_lock); + mutex_lock(&info->gfn_lock); if (kvmgt_gfn_is_write_protected(info, gpa_to_gfn(gpa))) intel_vgpu_page_track_handler(info, gpa, (void *)val, len); + mutex_unlock(&info->gfn_lock); mutex_unlock(&info->vgpu_lock); } @@ -1644,16 +1658,19 @@ static void kvmgt_page_track_flush_slot(struct kvm *kvm, struct intel_vgpu *info = container_of(node, struct intel_vgpu, track_node); - write_lock(&kvm->mmu_lock); + mutex_lock(&info->gfn_lock); for (i = 0; i < slot->npages; i++) { gfn = slot->base_gfn + i; if (kvmgt_gfn_is_write_protected(info, gfn)) { + write_lock(&kvm->mmu_lock); kvm_slot_page_track_remove_page(kvm, slot, gfn, KVM_PAGE_TRACK_WRITE); + write_unlock(&kvm->mmu_lock); + kvmgt_protect_table_del(info, gfn); } } - write_unlock(&kvm->mmu_lock); + mutex_unlock(&info->gfn_lock); } void intel_vgpu_detach_regions(struct intel_vgpu *vgpu) diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c index 56c71474008a..f2479781b770 100644 --- a/drivers/gpu/drm/i915/gvt/vgpu.c +++ b/drivers/gpu/drm/i915/gvt/vgpu.c @@ -277,6 +277,7 @@ struct intel_vgpu *intel_gvt_create_idle_vgpu(struct intel_gvt *gvt) vgpu->id = IDLE_VGPU_IDR; vgpu->gvt = gvt; mutex_init(&vgpu->vgpu_lock); + mutex_init(&vgpu->gfn_lock); for (i = 0; i < I915_NUM_ENGINES; i++) INIT_LIST_HEAD(&vgpu->submission.workload_q_head[i]);