KVM: MMU: Avoid calling gfn_to_page() in mmu_set_spte()

Since gfn_to_page() is a sleeping function, and we want to make the core mmu
spinlocked, we need to pass the page from the walker context (which can sleep)
to the shadow context (which cannot).

[marcelo: avoid recursive locking of mmap_sem]

Signed-off-by: Avi Kivity <avi@qumranet.com>

1 files changed, 18 insertions, 5 deletions

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 136a65d72b0..3d7846ba26e 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -245,6 +245,7 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
 {
         pt_element_t gpte;
         unsigned pte_access;
+        struct page *npage;
 
         gpte = *(const pt_element_t *)pte;
         if (~gpte & (PT_PRESENT_MASK | PT_ACCESSED_MASK)) {
@@ -256,8 +257,14 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
                 return;
         pgprintk("%s: gpte %llx spte %p\n", __FUNCTION__, (u64)gpte, spte);
         pte_access = page->role.access & FNAME(gpte_access)(vcpu, gpte);
+        if (gpte_to_gfn(gpte) != vcpu->arch.update_pte.gfn)
+                return;
+        npage = vcpu->arch.update_pte.page;
+        if (!npage)
+                return;
+        get_page(npage);
         mmu_set_spte(vcpu, spte, page->role.access, pte_access, 0, 0,
-                     gpte & PT_DIRTY_MASK, NULL, gpte_to_gfn(gpte));
+                     gpte & PT_DIRTY_MASK, NULL, gpte_to_gfn(gpte), npage);
 }
 
 /*
@@ -265,7 +272,8 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
  */
 static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                          struct guest_walker *walker,
-                         int user_fault, int write_fault, int *ptwrite)
+                         int user_fault, int write_fault, int *ptwrite,
+                         struct page *page)
 {
         hpa_t shadow_addr;
         int level;
@@ -321,8 +329,10 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                         r = kvm_read_guest_atomic(vcpu->kvm,
                                                   walker->pte_gpa[level - 2],
                                                   &curr_pte, sizeof(curr_pte));
-                        if (r || curr_pte != walker->ptes[level - 2])
+                        if (r || curr_pte != walker->ptes[level - 2]) {
+                                kvm_release_page_clean(page);
                                 return NULL;
+                        }
                 }
                 shadow_addr = __pa(shadow_page->spt);
                 shadow_pte = shadow_addr | PT_PRESENT_MASK | PT_ACCESSED_MASK
@@ -333,7 +343,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
         mmu_set_spte(vcpu, shadow_ent, access, walker->pte_access & access,
                      user_fault, write_fault,
                      walker->ptes[walker->level-1] & PT_DIRTY_MASK,
-                     ptwrite, walker->gfn);
+                     ptwrite, walker->gfn, page);
 
         return shadow_ent;
 }
@@ -362,6 +372,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
         u64 *shadow_pte;
         int write_pt = 0;
         int r;
+        struct page *page;
 
         pgprintk("%s: addr %lx err %x\n", __FUNCTION__, addr, error_code);
         kvm_mmu_audit(vcpu, "pre page fault");
@@ -388,9 +399,11 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
                 return 0;
         }
 
+        page = gfn_to_page(vcpu->kvm, walker.gfn);
+
         mutex_lock(&vcpu->kvm->lock);
         shadow_pte = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
-                                  &write_pt);
+                                  &write_pt, page);
         pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __FUNCTION__,
                  shadow_pte, *shadow_pte, write_pt);