From mboxrd@z Thu Jan 1 00:00:00 1970 From: Xiao Guangrong Subject: Re: [PATCH v3 03/11] KVM: x86: retry non-page-table writing instruction Date: Wed, 14 Sep 2011 02:24:18 +0800 Message-ID: <4E6F9FD2.4010407@cn.fujitsu.com> References: <4E5C4C20.3000403@cn.fujitsu.com> <4E5C4C5C.8030602@cn.fujitsu.com> <4E6F34CF.1060302@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: Marcelo Tosatti , LKML , KVM To: Avi Kivity Return-path: Received: from cn.fujitsu.com ([222.73.24.84]:59991 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1755870Ab1IMSVt convert rfc822-to-8bit (ORCPT ); Tue, 13 Sep 2011 14:21:49 -0400 In-Reply-To: <4E6F34CF.1060302@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 09/13/2011 06:47 PM, Avi Kivity wrote: > On 08/30/2011 05:35 AM, Xiao Guangrong wrote: >> If the emulation is caused by #PF and it is non-page_table writing i= nstruction, >> it means the VM-EXIT is caused by shadow page protected, we can zap = the shadow >> page and retry this instruction directly >> >> The idea is from Avi >> >> >> int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int= insn_len); >> +bool page_table_writing_insn(struct x86_emulate_ctxt *ctxt); >=20 > Please use the usual x86_ prefix used in the emulator interface. >=20 OK, will fix. >> @@ -3720,10 +3721,18 @@ void __kvm_mmu_free_some_pages(struct kvm_vc= pu *vcpu) >> kvm_mmu_commit_zap_page(vcpu->kvm,&invalid_list); >> } >> >> +static bool is_mmio_page_fault(struct kvm_vcpu *vcpu, gva_t addr) >> +{ >> + if (vcpu->arch.mmu.direct_map || mmu_is_nested(vcpu)) >> + return vcpu_match_mmio_gpa(vcpu, addr); >> + >> + return vcpu_match_mmio_gva(vcpu, addr); >> +} >> + >> int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u32 error= _code, >> void *insn, int insn_len) >> { >> - int r; >> + int r, emulation_type =3D EMULTYPE_RETRY; >> enum emulation_result er; >> >> r =3D vcpu->arch.mmu.page_fault(vcpu, cr2, error_code, false); >> @@ -3735,7 +3744,10 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu,= gva_t cr2, u32 error_code, >> goto out; >> } >> >> - er =3D x86_emulate_instruction(vcpu, cr2, 0, insn, insn_len); >> + if (is_mmio_page_fault(vcpu, cr2)) >> + emulation_type =3D 0; >> + >> + er =3D x86_emulate_instruction(vcpu, cr2, emulation_type, insn,= insn_len); >> >> switch (er) { >> case EMULATE_DONE: >> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c >> index 6b37f18..1afe59e 100644 >> --- a/arch/x86/kvm/x86.c >> +++ b/arch/x86/kvm/x86.c >> @@ -4814,6 +4814,50 @@ static bool reexecute_instruction(struct kvm_= vcpu *vcpu, gva_t gva) >> return false; >> } >> >> +static bool retry_instruction(struct x86_emulate_ctxt *ctxt, >> + unsigned long cr2, int emulation_type) >> +{ >> + if (!vcpu->arch.mmu.direct_map&& !mmu_is_nested(vcpu)) >> + gpa =3D kvm_mmu_gva_to_gpa_write(vcpu, cr2, NULL); >=20 > If mmu_is_nested() cr2 is an ngpa, we have to translate it to a gpa, = no? >=20 Yeah, will fix it. And this bug also exists in the current code: it always uses L2 gpa to = emulate write operation. I guess the reason that it is not triggered is: the gpa of L2's shadow = page can not be touched by L2, it means no page table is write-protected by L2. > btw, I don't see mmu.direct_map initialized for nested npt? >=20 nested_svm_vmrun() -> nested_svm_init_mmu_context(): static int nested_svm_init_mmu_context(struct kvm_vcpu *vcpu) { int r; r =3D kvm_init_shadow_mmu(vcpu, &vcpu->arch.mmu); vcpu->arch.mmu.set_cr3 =3D nested_svm_set_tdp_cr3; vcpu->arch.mmu.get_cr3 =3D nested_svm_get_tdp_cr3; vcpu->arch.mmu.get_pdptr =3D nested_svm_get_tdp_pdptr; vcpu->arch.mmu.inject_page_fault =3D nested_svm_inject_npf_exit; vcpu->arch.mmu.shadow_root_level =3D get_npt_level(); vcpu->arch.walk_mmu =3D &vcpu->arch.nested_mmu; return r; } It is initialized in kvm_init_shadow_mmu=E3=80=80:-)