| Message ID | 20210805205504.2647362-3-wei.huang2@amd.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | SVM 5-level page table support | expand |
On Thu, Aug 05, 2021, Wei Huang wrote: > When the 5-level page table CPU flag is exposed, KVM code needs to handle > this case by pointing mmu->root_hpa to a properly-constructed 5-level page > table. > > Suggested-by: Paolo Bonzini <pbonzini@redhat.com> > Signed-off-by: Wei Huang <wei.huang2@amd.com> > --- > arch/x86/include/asm/kvm_host.h | 1 + > arch/x86/kvm/mmu/mmu.c | 46 +++++++++++++++++++++++---------- > 2 files changed, 34 insertions(+), 13 deletions(-) > > diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h > index 20ddfbac966e..8586ffdf4de8 100644 > --- a/arch/x86/include/asm/kvm_host.h > +++ b/arch/x86/include/asm/kvm_host.h > @@ -447,6 +447,7 @@ struct kvm_mmu { > > u64 *pae_root; > u64 *pml4_root; > + u64 *pml5_root; > > /* > * check zero bits on shadow page table entries, these > diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c > index 44e4561e41f5..b162c3e530aa 100644 > --- a/arch/x86/kvm/mmu/mmu.c > +++ b/arch/x86/kvm/mmu/mmu.c > @@ -3428,7 +3428,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) > * the shadow page table may be a PAE or a long mode page table. > */ > pm_mask = PT_PRESENT_MASK | shadow_me_mask; > - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) { > + if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { > pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK; > > if (WARN_ON_ONCE(!mmu->pml4_root)) { > @@ -3454,11 +3454,17 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) > PT32_ROOT_LEVEL, false); > mmu->pae_root[i] = root | pm_mask; > } > + mmu->root_hpa = __pa(mmu->pae_root); > > - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) > + if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { > + mmu->pml4_root[0] = mmu->root_hpa | pm_mask; > mmu->root_hpa = __pa(mmu->pml4_root); > - else > - mmu->root_hpa = __pa(mmu->pae_root); > + } > + > + if (mmu->shadow_root_level == PT64_ROOT_5LEVEL) { > + mmu->pml5_root[0] = mmu->root_hpa | pm_mask; > + mmu->root_hpa = __pa(mmu->pml5_root); > + } Ouch, the root_hpa chaining is subtle. That's my fault :-) I think it would be better to explicitly chain pae->pml4->pml5? E.g. if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { mmu->pml4_root[0] = __pa(mmu->pae_root) | pm_mask; if (mmu->shadow_root_level == PT64_ROOT_5LEVEL) { mmu->pml5_root[0] = __pa(mmu->pml4_root) | pm_mask; mmu->root_hpa = __pa(mmu->pml5_root); } else { mmu->root_hpa = __pa(mmu->pml4_root); } } else { mmu->root_hpa = __pa(mmu->pae_root); } It'd require more churn if we get to 6-level paging, but that's a risk I'm willing to take ;-) > > set_root_pgd: > mmu->root_pgd = root_pgd; > @@ -3471,7 +3477,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) > static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) > { > struct kvm_mmu *mmu = vcpu->arch.mmu; > - u64 *pml4_root, *pae_root; > + u64 *pml5_root, *pml4_root, *pae_root; > > /* > * When shadowing 32-bit or PAE NPT with 64-bit NPT, the PML4 and PDP > @@ -3487,17 +3493,18 @@ static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) > * This mess only works with 4-level paging and needs to be updated to > * work with 5-level paging. > */ > - if (WARN_ON_ONCE(mmu->shadow_root_level != PT64_ROOT_4LEVEL)) > + if (WARN_ON_ONCE(mmu->shadow_root_level < PT64_ROOT_4LEVEL)) { This is amusingly wrong. The check above this is: if (mmu->direct_map || mmu->root_level >= PT64_ROOT_4LEVEL || mmu->shadow_root_level < PT64_ROOT_4LEVEL) <-------- return 0; meaning this is dead code. It should simply deleted. If we reaaaaaly wanted to future proof the code, we could do: if (WARN_ON_ONCE(mmu->shadow_root_level > PT64_ROOT_5LEVEL) return -EIO; but at that point we're looking at a completely different architecture, so I don't think we need to be that paranoid :-) > return -EIO; > + } > > - if (mmu->pae_root && mmu->pml4_root) > + if (mmu->pae_root && mmu->pml4_root && mmu->pml5_root) > return 0; > > /* > * The special roots should always be allocated in concert. Yell and > * bail if KVM ends up in a state where only one of the roots is valid. > */ > - if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root)) > + if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root || mmu->pml5_root)) > return -EIO; > > /* > @@ -3506,18 +3513,30 @@ static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) > */ > pae_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); > if (!pae_root) > - return -ENOMEM; > + goto err_out; Branching to the error handling here is silly, it's the first allocation. > > pml4_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); > - if (!pml4_root) { > - free_page((unsigned long)pae_root); > - return -ENOMEM; > - } > + if (!pml4_root) > + goto err_out; > + > + pml5_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); This should be guarded by "mmu->shadow_root_level > PT64_ROOT_4LEVEL", there's no need to waste a page on PML5 if it can't exist. > + if (!pml5_root) > + goto err_out; > > mmu->pae_root = pae_root; > mmu->pml4_root = pml4_root; > + mmu->pml5_root = pml5_root; > > return 0; > +err_out: > + if (pae_root) > + free_page((unsigned long)pae_root); > + if (pml4_root) > + free_page((unsigned long)pml4_root); > + if (pml5_root) > + free_page((unsigned long)pml5_root); This is flawed as failure to allocate pml4_root will consume an uninitialized pml5_root. There's also no need to check for non-NULL values as free_page plays nice with NULL pointers. If you drop the unnecessary goto for pae_root allocation failure, than this can become: err_out: free_page((unsigned long)pml4_root); free_page((unsigned long)pae_root); since pml4_root will be NULL if pml4_root allocation failures. IMO that's unnecessarily clever though, and a more standard: err_pml5: free_page((unsigned long)pml4_root); err_pml4: free_page((unsigned long)pae_root); return -ENOMEM; would be far easier to read/maintain. > + > + return -ENOMEM; > } > > void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu) > @@ -5320,6 +5339,7 @@ static void free_mmu_pages(struct kvm_mmu *mmu) > set_memory_encrypted((unsigned long)mmu->pae_root, 1); > free_page((unsigned long)mmu->pae_root); > free_page((unsigned long)mmu->pml4_root); > + free_page((unsigned long)mmu->pml5_root); > } > > static int __kvm_mmu_create(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu) > -- > 2.31.1 >
On 8/6/21 12:58 PM, Sean Christopherson wrote: > On Thu, Aug 05, 2021, Wei Huang wrote: >> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c >> index 44e4561e41f5..b162c3e530aa 100644 >> --- a/arch/x86/kvm/mmu/mmu.c >> +++ b/arch/x86/kvm/mmu/mmu.c >> @@ -3428,7 +3428,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) >> * the shadow page table may be a PAE or a long mode page table. >> */ >> pm_mask = PT_PRESENT_MASK | shadow_me_mask; >> - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) { >> + if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { >> pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK; >> >> if (WARN_ON_ONCE(!mmu->pml4_root)) { >> @@ -3454,11 +3454,17 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) >> PT32_ROOT_LEVEL, false); >> mmu->pae_root[i] = root | pm_mask; >> } >> + mmu->root_hpa = __pa(mmu->pae_root); >> >> - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) >> + if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { >> + mmu->pml4_root[0] = mmu->root_hpa | pm_mask; >> mmu->root_hpa = __pa(mmu->pml4_root); >> - else >> - mmu->root_hpa = __pa(mmu->pae_root); >> + } >> + >> + if (mmu->shadow_root_level == PT64_ROOT_5LEVEL) { >> + mmu->pml5_root[0] = mmu->root_hpa | pm_mask; >> + mmu->root_hpa = __pa(mmu->pml5_root); >> + } > > Ouch, the root_hpa chaining is subtle. That's my fault :-) I think it would be > better to explicitly chain pae->pml4->pml5? E.g. > > if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { > mmu->pml4_root[0] = __pa(mmu->pae_root) | pm_mask; > > if (mmu->shadow_root_level == PT64_ROOT_5LEVEL) { > mmu->pml5_root[0] = __pa(mmu->pml4_root) | pm_mask; > mmu->root_hpa = __pa(mmu->pml5_root); > } else { > mmu->root_hpa = __pa(mmu->pml4_root); > } > } else { > mmu->root_hpa = __pa(mmu->pae_root); > } > > It'd require more churn if we get to 6-level paging, but that's a risk I'm willing > to take ;-) > Thanks for the review. This part of code is indeed subtle. The chaining trick will be easier to understand with a proper explanation. My proposal is to keep the original approach, but add more comments to this group of code. /* * Depending on the shadow_root_level, build the root_hpa table by * chaining either pml5->pml4->pae or pml4->pae. */ mmu->root_hpa = __pa(mmu->pae_root); if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { mmu->pml4_root[0] = mmu->root_hpa | pm_mask; mmu->root_hpa = __pa(mmu->pml4_root); } if (mmu->shadow_root_level == PT64_ROOT_5LEVEL) { mmu->pml5_root[0] = mmu->root_hpa | pm_mask; mmu->root_hpa = __pa(mmu->pml5_root); } This code will be easy to extend for 6-level page table (if needed) in the future. >> >> set_root_pgd: >> mmu->root_pgd = root_pgd; >> @@ -3471,7 +3477,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) >> static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) >> { >> struct kvm_mmu *mmu = vcpu->arch.mmu; >> - u64 *pml4_root, *pae_root; >> + u64 *pml5_root, *pml4_root, *pae_root; >> >> /* >> * When shadowing 32-bit or PAE NPT with 64-bit NPT, the PML4 and PDP >> @@ -3487,17 +3493,18 @@ static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) >> * This mess only works with 4-level paging and needs to be updated to >> * work with 5-level paging. >> */ >> - if (WARN_ON_ONCE(mmu->shadow_root_level != PT64_ROOT_4LEVEL)) >> + if (WARN_ON_ONCE(mmu->shadow_root_level < PT64_ROOT_4LEVEL)) { > > This is amusingly wrong. The check above this is: > > if (mmu->direct_map || mmu->root_level >= PT64_ROOT_4LEVEL || > mmu->shadow_root_level < PT64_ROOT_4LEVEL) <-------- > return 0; > > meaning this is dead code. It should simply deleted. If we reaaaaaly wanted to > future proof the code, we could do: > > if (WARN_ON_ONCE(mmu->shadow_root_level > PT64_ROOT_5LEVEL) > return -EIO; > > but at that point we're looking at a completely different architecture, so I don't > think we need to be that paranoid :-) You are right that this can be removed. > >> return -EIO; >> + } >> >> - if (mmu->pae_root && mmu->pml4_root) >> + if (mmu->pae_root && mmu->pml4_root && mmu->pml5_root) >> return 0; >> >> /* >> * The special roots should always be allocated in concert. Yell and >> * bail if KVM ends up in a state where only one of the roots is valid. >> */ >> - if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root)) >> + if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root || mmu->pml5_root)) >> return -EIO; >> >> /* >> @@ -3506,18 +3513,30 @@ static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) >> */ >> pae_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); >> if (!pae_root) >> - return -ENOMEM; >> + goto err_out; > > Branching to the error handling here is silly, it's the first allocation. > >> >> pml4_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); >> - if (!pml4_root) { >> - free_page((unsigned long)pae_root); >> - return -ENOMEM; >> - } >> + if (!pml4_root) >> + goto err_out; >> + >> + pml5_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); > > This should be guarded by "mmu->shadow_root_level > PT64_ROOT_4LEVEL", there's no > need to waste a page on PML5 if it can't exist. Will do > >> + if (!pml5_root) >> + goto err_out; >> >> mmu->pae_root = pae_root; >> mmu->pml4_root = pml4_root; >> + mmu->pml5_root = pml5_root; >> >> return 0; >> +err_out: >> + if (pae_root) >> + free_page((unsigned long)pae_root); >> + if (pml4_root) >> + free_page((unsigned long)pml4_root); >> + if (pml5_root) >> + free_page((unsigned long)pml5_root); > > This is flawed as failure to allocate pml4_root will consume an uninitialized > pml5_root. There's also no need to check for non-NULL values as free_page plays > nice with NULL pointers. > > If you drop the unnecessary goto for pae_root allocation failure, than this can > become: > > err_out: > free_page((unsigned long)pml4_root); > free_page((unsigned long)pae_root); > > since pml4_root will be NULL if pml4_root allocation failures. IMO that's > unnecessarily clever though, and a more standard: > > err_pml5: > free_page((unsigned long)pml4_root); > err_pml4: > free_page((unsigned long)pae_root); > return -ENOMEM; > > would be far easier to read/maintain. > I will take the advice for this part of code. >> + >> + return -ENOMEM; >> } >> >> void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu) >> @@ -5320,6 +5339,7 @@ static void free_mmu_pages(struct kvm_mmu *mmu) >> set_memory_encrypted((unsigned long)mmu->pae_root, 1); >> free_page((unsigned long)mmu->pae_root); >> free_page((unsigned long)mmu->pml4_root); >> + free_page((unsigned long)mmu->pml5_root); >> } >> >> static int __kvm_mmu_create(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu) >> -- >> 2.31.1 >>
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 20ddfbac966e..8586ffdf4de8 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -447,6 +447,7 @@ struct kvm_mmu { u64 *pae_root; u64 *pml4_root; + u64 *pml5_root; /* * check zero bits on shadow page table entries, these diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 44e4561e41f5..b162c3e530aa 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -3428,7 +3428,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) * the shadow page table may be a PAE or a long mode page table. */ pm_mask = PT_PRESENT_MASK | shadow_me_mask; - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) { + if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK; if (WARN_ON_ONCE(!mmu->pml4_root)) { @@ -3454,11 +3454,17 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) PT32_ROOT_LEVEL, false); mmu->pae_root[i] = root | pm_mask; } + mmu->root_hpa = __pa(mmu->pae_root); - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) + if (mmu->shadow_root_level >= PT64_ROOT_4LEVEL) { + mmu->pml4_root[0] = mmu->root_hpa | pm_mask; mmu->root_hpa = __pa(mmu->pml4_root); - else - mmu->root_hpa = __pa(mmu->pae_root); + } + + if (mmu->shadow_root_level == PT64_ROOT_5LEVEL) { + mmu->pml5_root[0] = mmu->root_hpa | pm_mask; + mmu->root_hpa = __pa(mmu->pml5_root); + } set_root_pgd: mmu->root_pgd = root_pgd; @@ -3471,7 +3477,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) { struct kvm_mmu *mmu = vcpu->arch.mmu; - u64 *pml4_root, *pae_root; + u64 *pml5_root, *pml4_root, *pae_root; /* * When shadowing 32-bit or PAE NPT with 64-bit NPT, the PML4 and PDP @@ -3487,17 +3493,18 @@ static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) * This mess only works with 4-level paging and needs to be updated to * work with 5-level paging. */ - if (WARN_ON_ONCE(mmu->shadow_root_level != PT64_ROOT_4LEVEL)) + if (WARN_ON_ONCE(mmu->shadow_root_level < PT64_ROOT_4LEVEL)) { return -EIO; + } - if (mmu->pae_root && mmu->pml4_root) + if (mmu->pae_root && mmu->pml4_root && mmu->pml5_root) return 0; /* * The special roots should always be allocated in concert. Yell and * bail if KVM ends up in a state where only one of the roots is valid. */ - if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root)) + if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->pml4_root || mmu->pml5_root)) return -EIO; /* @@ -3506,18 +3513,30 @@ static int mmu_alloc_special_roots(struct kvm_vcpu *vcpu) */ pae_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); if (!pae_root) - return -ENOMEM; + goto err_out; pml4_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); - if (!pml4_root) { - free_page((unsigned long)pae_root); - return -ENOMEM; - } + if (!pml4_root) + goto err_out; + + pml5_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); + if (!pml5_root) + goto err_out; mmu->pae_root = pae_root; mmu->pml4_root = pml4_root; + mmu->pml5_root = pml5_root; return 0; +err_out: + if (pae_root) + free_page((unsigned long)pae_root); + if (pml4_root) + free_page((unsigned long)pml4_root); + if (pml5_root) + free_page((unsigned long)pml5_root); + + return -ENOMEM; } void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu) @@ -5320,6 +5339,7 @@ static void free_mmu_pages(struct kvm_mmu *mmu) set_memory_encrypted((unsigned long)mmu->pae_root, 1); free_page((unsigned long)mmu->pae_root); free_page((unsigned long)mmu->pml4_root); + free_page((unsigned long)mmu->pml5_root); } static int __kvm_mmu_create(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)
When the 5-level page table CPU flag is exposed, KVM code needs to handle this case by pointing mmu->root_hpa to a properly-constructed 5-level page table. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Wei Huang <wei.huang2@amd.com> --- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu/mmu.c | 46 +++++++++++++++++++++++---------- 2 files changed, 34 insertions(+), 13 deletions(-)