KVM: MMU: ignore zapped root pagetables

Mark zapped root pagetables as invalid and ignore such pages during lookup.

This is a problem with the cr3-target feature, where a zapped root table fools
the faulting code into creating a read-only mapping. The result is a lockup
if the instruction can't be emulated.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Avi Kivity <avi@qumranet.com>

2 files changed, 22 insertions, 2 deletions

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f7541fe22cd8..103d008dab8b 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -667,7 +667,8 @@ static struct kvm_mmu_page *kvm_mmu_lookup_page(struct kvm *kvm, gfn_t gfn)
         index = kvm_page_table_hashfn(gfn);
         bucket = &kvm->arch.mmu_page_hash[index];
         hlist_for_each_entry(sp, node, bucket, hash_link)
-                if (sp->gfn == gfn && !sp->role.metaphysical) {
+                if (sp->gfn == gfn && !sp->role.metaphysical
+                    && !sp->role.invalid) {
                         pgprintk("%s: found role %x\n",
                                  __FUNCTION__, sp->role.word);
                         return sp;
@@ -792,8 +793,11 @@ static void kvm_mmu_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp)
         if (!sp->root_count) {
                 hlist_del(&sp->hash_link);
                 kvm_mmu_free_page(kvm, sp);
-        } else
+        } else {
                 list_move(&sp->link, &kvm->arch.active_mmu_pages);
+                sp->role.invalid = 1;
+                kvm_reload_remote_mmus(kvm);
+        }
         kvm_mmu_reset_last_pte_updated(kvm);
 }
 
@@ -1073,6 +1077,8 @@ static void mmu_free_roots(struct kvm_vcpu *vcpu)
 
                 sp = page_header(root);
                 --sp->root_count;
+                if (!sp->root_count && sp->role.invalid)
+                        kvm_mmu_zap_page(vcpu->kvm, sp);
                 vcpu->arch.mmu.root_hpa = INVALID_PAGE;
                 spin_unlock(&vcpu->kvm->mmu_lock);
                 return;
@@ -1085,6 +1091,8 @@ static void mmu_free_roots(struct kvm_vcpu *vcpu)
                         root &= PT64_BASE_ADDR_MASK;
                         sp = page_header(root);
                         --sp->root_count;
+                        if (!sp->root_count && sp->role.invalid)
+                                kvm_mmu_zap_page(vcpu->kvm, sp);
                 }
                 vcpu->arch.mmu.pae_root[i] = INVALID_PAGE;
         }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0dd038e7392b..e8e64927bddc 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2658,6 +2658,10 @@ preempted:
                 kvm_x86_ops->guest_debug_pre(vcpu);
 
 again:
+        if (vcpu->requests)
+                if (test_and_clear_bit(KVM_REQ_MMU_RELOAD, &vcpu->requests))
+                        kvm_mmu_unload(vcpu);
+
         r = kvm_mmu_reload(vcpu);
         if (unlikely(r))
                 goto out;
@@ -2689,6 +2693,14 @@ again:
                 goto out;
         }
 
+        if (vcpu->requests)
+                if (test_bit(KVM_REQ_MMU_RELOAD, &vcpu->requests)) {
+                        local_irq_enable();
+                        preempt_enable();
+                        r = 1;
+                        goto out;
+                }
+
         if (signal_pending(current)) {
                 local_irq_enable();
                 preempt_enable();