From patchwork Sat May 13 00:35:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 93457 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp5485953vqo; Fri, 12 May 2023 17:54:28 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6J/dB1ckKV/uvsp0E8fotHTsbLMyE4ECq0s/AfMCqVbH2LoKcqJM/xWK2JeOJKdNknIjiE X-Received: by 2002:a17:902:c405:b0:1ad:d95d:ca9c with SMTP id k5-20020a170902c40500b001add95dca9cmr8380164plk.15.1683939268652; Fri, 12 May 2023 17:54:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683939268; cv=none; d=google.com; s=arc-20160816; b=Z3XGJRngI6bNVO2pRa4Zm7uz1NqIo99W/SP6osvnjh1BPcS87NnHXDajlas8q6Cdf1 HAJgUoOLjKhJZx/kpN6CvhfzOTcD63KlL0HOl5+NJoNqngU7rv3XGJWYtpELfGPbphbg eWRDBuUqcJW91jHskpO1EXliCJ5D5Cx/TaguE171A+zmh1nWPk0Qbv1kMjxM5OiOapC9 w82gPnyssO+GyefnGP7iST7gVK6Ns2CFjBMokmNg7Hy11GbDMqxz5kzaBUbSolEwknUZ Fq9gAQ3zo8pyJ3XNEcX1mR2T7hsCkdwlDtdIpZWXiFs7QnZ4V/kWX7nEP1ygWNJrRwFY byvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:reply-to:dkim-signature; bh=Dpd6gQkAH1gq2UUCXhRbZwdMmtHjG2V07AhbHbITBsg=; b=wut+hNejmhsM3mJ56JXxiOSiQffcytLAVbBzEBGkqYmQC3Ebkdahrq8DZqLnpqn1wX 6KE5BaPdOY5DEY8Rog/rjO9rLThAxHOblW12RW7Y8ODSyQ/9ECSj21FapTT5/9Qtta5X +ydPljDKFWhKBFYOoJXp0Q7IfFSxVMtaTIdTUI01xwOyjglf3d2bjpudiDVQtYOxxTfT yzLyQ7lssYPr5FHGq743jBZfpdIBMZeTyYqoqR2yTgTF4fXYGP8Kj6y9TH4ZD+tNMYmv dUh3c4eiFZdIMHVvUREDXVu8FaBarbsG1t1ficyMg2CdYd6wvHeY3NqAscCa45ySlWeU tRYQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b=kd32jcAW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x2-20020a1709028ec200b001add3e4ee84si4301989plo.132.2023.05.12.17.54.13; Fri, 12 May 2023 17:54:28 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b=kd32jcAW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241617AbjEMAhB (ORCPT + 99 others); Fri, 12 May 2023 20:37:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241604AbjEMAgn (ORCPT ); Fri, 12 May 2023 20:36:43 -0400 Received: from mail-pj1-x1049.google.com (mail-pj1-x1049.google.com [IPv6:2607:f8b0:4864:20::1049]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A23C5FD0 for ; Fri, 12 May 2023 17:36:26 -0700 (PDT) Received: by mail-pj1-x1049.google.com with SMTP id 98e67ed59e1d1-24e0d569a01so5727887a91.2 for ; Fri, 12 May 2023 17:36:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1683938185; x=1686530185; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=Dpd6gQkAH1gq2UUCXhRbZwdMmtHjG2V07AhbHbITBsg=; b=kd32jcAWHgv7bEQ/AOl/anO++S7xJsu084O8mhBxdsCT3KpoFCflHX9hVdrvmbF4ZY NGR/kU3IkSRjTGhXdcC0z9ZzMD/vTZnN3VZyYChMNSdI8UrIbjCrWwdHRffxz0uYo1Kr yG9099A9uCaWCR4sJJ/cQrnlUz7cE70EZR9dlQ+NErwgg/XCfH6BnPC9VPmnEjdXBJ8y QQDvf/OHT55UA8oMgCPeEegwYwPX2Cnsa5tmpa2gyROT2SwmMlR9rG+goAmxfPCxI6jl T8bnvgqxbQoyM3gl6zyD8gcsrzwSya8GpGUGHzo6RycqW7S5cHxPl4jw3QWrO4N2EK9h JgFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683938185; x=1686530185; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Dpd6gQkAH1gq2UUCXhRbZwdMmtHjG2V07AhbHbITBsg=; b=l+y7X2sb+6/cunYRxXkk01khozBNidrJGn9T4w+2x4j/K+ZO+WwPpFsRADRYq7aLn8 eAVRVtsyQ+wW8gPrjbeIWUz5TLGZhpsEBxwlVOFPoY60as58JnNguQr2mJQMyiWeTATp nC5pazIBw0IHu6UWn+aAelyEQC51qZsO1WQIAMTGi+RUWAedYxHB3u8Wb+iwj7bYAqNc N3sHeQ4/35CC4J//n1D1eTGvIbN/G7o+dNnyVSGiLtsjzX95yjVggYhqHC5qtscKCQRQ p+WCs4JyBlXGM4+6GjISBSOpzNAbXUIyhOzhtI8ubWvWPFvuX08V+kkW4ogDUFXgPCwk i4hw== X-Gm-Message-State: AC+VfDxauP9OeV3+ghgQjDjZVjlwLpCyoITfrXO6bZOhX0AawbhHIocT sqtxGyFtqW632cl5d235F2rGd2WY9K0= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:90a:5d01:b0:246:f535:3132 with SMTP id s1-20020a17090a5d0100b00246f5353132mr7976189pji.7.1683938185478; Fri, 12 May 2023 17:36:25 -0700 (PDT) Reply-To: Sean Christopherson Date: Fri, 12 May 2023 17:35:42 -0700 In-Reply-To: <20230513003600.818142-1-seanjc@google.com> Mime-Version: 1.0 References: <20230513003600.818142-1-seanjc@google.com> X-Mailer: git-send-email 2.40.1.606.ga4b1b128d6-goog Message-ID: <20230513003600.818142-11-seanjc@google.com> Subject: [PATCH v3 10/28] drm/i915/gvt: Protect gfn hash table with vgpu_lock From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Zhenyu Wang , Zhi Wang Cc: kvm@vger.kernel.org, intel-gvt-dev@lists.freedesktop.org, intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yan Zhao , Ben Gardon X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765738302679356043?= X-GMAIL-MSGID: =?utf-8?q?1765738302679356043?= Use vgpu_lock instead of KVM's mmu_lock to protect accesses to the hash table used to track which gfns are write-protected when shadowing the guest's GTT, and hoist the acquisition of vgpu_lock from intel_vgpu_page_track_handler() out to its sole caller, kvmgt_page_track_write(). This fixes a bug where kvmgt_page_track_write(), which doesn't hold kvm->mmu_lock, could race with intel_gvt_page_track_remove() and trigger a use-after-free. Fixing kvmgt_page_track_write() by taking kvm->mmu_lock is not an option as mmu_lock is a r/w spinlock, and intel_vgpu_page_track_handler() might sleep when acquiring vgpu->cache_lock deep down the callstack: intel_vgpu_page_track_handler() | |-> page_track->handler / ppgtt_write_protection_handler() | |-> ppgtt_handle_guest_write_page_table_bytes() | |-> ppgtt_handle_guest_write_page_table() | |-> ppgtt_handle_guest_entry_removal() | |-> ppgtt_invalidate_pte() | |-> intel_gvt_dma_unmap_guest_page() | |-> mutex_lock(&vgpu->cache_lock); Reviewed-by: Yan Zhao Signed-off-by: Sean Christopherson --- drivers/gpu/drm/i915/gvt/kvmgt.c | 55 +++++++++++++++------------ drivers/gpu/drm/i915/gvt/page_track.c | 10 +---- 2 files changed, 33 insertions(+), 32 deletions(-) diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c index 117bac85ac2c..0785f9cb2c20 100644 --- a/drivers/gpu/drm/i915/gvt/kvmgt.c +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c @@ -351,6 +351,8 @@ __kvmgt_protect_table_find(struct intel_vgpu *info, gfn_t gfn) { struct kvmgt_pgfn *p, *res = NULL; + lockdep_assert_held(&info->vgpu_lock); + hash_for_each_possible(info->ptable, p, hnode, gfn) { if (gfn == p->gfn) { res = p; @@ -1552,6 +1554,9 @@ int intel_gvt_page_track_add(struct intel_vgpu *info, u64 gfn) if (!test_bit(INTEL_VGPU_STATUS_ATTACHED, info->status)) return -ESRCH; + if (kvmgt_gfn_is_write_protected(info, gfn)) + return 0; + idx = srcu_read_lock(&kvm->srcu); slot = gfn_to_memslot(kvm, gfn); if (!slot) { @@ -1560,16 +1565,12 @@ int intel_gvt_page_track_add(struct intel_vgpu *info, u64 gfn) } write_lock(&kvm->mmu_lock); - - if (kvmgt_gfn_is_write_protected(info, gfn)) - goto out; - kvm_slot_page_track_add_page(kvm, slot, gfn, KVM_PAGE_TRACK_WRITE); + write_unlock(&kvm->mmu_lock); + + srcu_read_unlock(&kvm->srcu, idx); + kvmgt_protect_table_add(info, gfn); - -out: - write_unlock(&kvm->mmu_lock); - srcu_read_unlock(&kvm->srcu, idx); return 0; } @@ -1582,24 +1583,22 @@ int intel_gvt_page_track_remove(struct intel_vgpu *info, u64 gfn) if (!test_bit(INTEL_VGPU_STATUS_ATTACHED, info->status)) return -ESRCH; - idx = srcu_read_lock(&kvm->srcu); - slot = gfn_to_memslot(kvm, gfn); - if (!slot) { - srcu_read_unlock(&kvm->srcu, idx); - return -EINVAL; - } - - write_lock(&kvm->mmu_lock); - if (!kvmgt_gfn_is_write_protected(info, gfn)) - goto out; + return 0; + idx = srcu_read_lock(&kvm->srcu); + slot = gfn_to_memslot(kvm, gfn); + if (!slot) { + srcu_read_unlock(&kvm->srcu, idx); + return -EINVAL; + } + + write_lock(&kvm->mmu_lock); kvm_slot_page_track_remove_page(kvm, slot, gfn, KVM_PAGE_TRACK_WRITE); + write_unlock(&kvm->mmu_lock); + srcu_read_unlock(&kvm->srcu, idx); + kvmgt_protect_table_del(info, gfn); - -out: - write_unlock(&kvm->mmu_lock); - srcu_read_unlock(&kvm->srcu, idx); return 0; } @@ -1610,9 +1609,13 @@ static void kvmgt_page_track_write(struct kvm_vcpu *vcpu, gpa_t gpa, struct intel_vgpu *info = container_of(node, struct intel_vgpu, track_node); + mutex_lock(&info->vgpu_lock); + if (kvmgt_gfn_is_write_protected(info, gpa_to_gfn(gpa))) intel_vgpu_page_track_handler(info, gpa, (void *)val, len); + + mutex_unlock(&info->vgpu_lock); } static void kvmgt_page_track_flush_slot(struct kvm *kvm, @@ -1624,16 +1627,20 @@ static void kvmgt_page_track_flush_slot(struct kvm *kvm, struct intel_vgpu *info = container_of(node, struct intel_vgpu, track_node); - write_lock(&kvm->mmu_lock); + mutex_lock(&info->vgpu_lock); + for (i = 0; i < slot->npages; i++) { gfn = slot->base_gfn + i; if (kvmgt_gfn_is_write_protected(info, gfn)) { + write_lock(&kvm->mmu_lock); kvm_slot_page_track_remove_page(kvm, slot, gfn, KVM_PAGE_TRACK_WRITE); + write_unlock(&kvm->mmu_lock); + kvmgt_protect_table_del(info, gfn); } } - write_unlock(&kvm->mmu_lock); + mutex_unlock(&info->vgpu_lock); } void intel_vgpu_detach_regions(struct intel_vgpu *vgpu) diff --git a/drivers/gpu/drm/i915/gvt/page_track.c b/drivers/gpu/drm/i915/gvt/page_track.c index df34e73cba41..60a65435556d 100644 --- a/drivers/gpu/drm/i915/gvt/page_track.c +++ b/drivers/gpu/drm/i915/gvt/page_track.c @@ -162,13 +162,9 @@ int intel_vgpu_page_track_handler(struct intel_vgpu *vgpu, u64 gpa, struct intel_vgpu_page_track *page_track; int ret = 0; - mutex_lock(&vgpu->vgpu_lock); - page_track = intel_vgpu_find_page_track(vgpu, gpa >> PAGE_SHIFT); - if (!page_track) { - ret = -ENXIO; - goto out; - } + if (!page_track) + return -ENXIO; if (unlikely(vgpu->failsafe)) { /* Remove write protection to prevent furture traps. */ @@ -179,7 +175,5 @@ int intel_vgpu_page_track_handler(struct intel_vgpu *vgpu, u64 gpa, gvt_err("guest page write error, gpa %llx\n", gpa); } -out: - mutex_unlock(&vgpu->vgpu_lock); return ret; }