2010-04-22 06:15:26

by Xiao Guangrong

Subject: [PATCH 1/10] KVM MMU: fix for calculating gpa in invlpg code

If the guest is 32-bit, we should use 'quadrant' to adjust gpa
offset

Signed-off-by: Xiao Guangrong <[email protected]>
---
arch/x86/kvm/paging_tmpl.h | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index d0cc07e..46d80d6 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -478,9 +478,14 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
((level == PT_DIRECTORY_LEVEL && is_large_pte(*sptep))) ||
((level == PT_PDPE_LEVEL && is_large_pte(*sptep)))) {
struct kvm_mmu_page *sp = page_header(__pa(sptep));
+ int offset = 0;
+
+ if (PTTYPE == 32)
+ offset = sp->role.quadrant << PT64_LEVEL_BITS;;

pte_gpa = (sp->gfn << PAGE_SHIFT);
- pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t);
+ pte_gpa += (sptep - sp->spt + offset) *
+ sizeof(pt_element_t);

if (is_shadow_present_pte(*sptep)) {
rmap_remove(vcpu->kvm, sptep);
--
1.6.1.2

2010-04-23 11:23:56

by Avi Kivity

Subject: Re: [PATCH 1/10] KVM MMU: fix for calculating gpa in invlpg code

On 04/22/2010 09:12 AM, Xiao Guangrong wrote:
> If the guest is 32-bit, we should use 'quadrant' to adjust gpa
> offset
>
>

Good catch. Only affects kvm_mmu_pte_write(), so I don't think this had
ill effects other than not prefetching the correct address?

> @@ -478,9 +478,14 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
> ((level == PT_DIRECTORY_LEVEL&& is_large_pte(*sptep))) ||
> ((level == PT_PDPE_LEVEL&& is_large_pte(*sptep)))) {
> struct kvm_mmu_page *sp = page_header(__pa(sptep));
> + int offset = 0;
> +
> + if (PTTYPE == 32)
> + offset = sp->role.quadrant<< PT64_LEVEL_BITS;;
>

Wrong for PT_DIRECTORY_LEVEL (should be q << 8). Also, too many
semicolons.

--
Do not meddle in the internals of kernels, for they are subtle and quick to panic.

2010-04-23 12:08:27

by Xiao Guangrong

Subject: Re: [PATCH 1/10] KVM MMU: fix for calculating gpa in invlpg code

Avi Kivity wrote:
> On 04/22/2010 09:12 AM, Xiao Guangrong wrote:
>> If the guest is 32-bit, we should use 'quadrant' to adjust gpa
>> offset
>>
>>
>
> Good catch. Only affects kvm_mmu_pte_write(), so I don't think this had
> ill effects other than not prefetching the correct address?
>

Yes

>> @@ -478,9 +478,14 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu,
>> gva_t gva)
>> ((level == PT_DIRECTORY_LEVEL&& is_large_pte(*sptep))) ||
>> ((level == PT_PDPE_LEVEL&& is_large_pte(*sptep)))) {
>> struct kvm_mmu_page *sp = page_header(__pa(sptep));
>> + int offset = 0;
>> +
>> + if (PTTYPE == 32)
>> + offset = sp->role.quadrant<< PT64_LEVEL_BITS;;
>>
>
> Wrong for PT_DIRECTORY_LEVEL (should be q << 8). Also, too many
> semicolons.
>

I guess you mean 'PT64_LEVEL_BITS' not 'PT_DIRECTORY_LEVEL' here :-)

It should be q << 8 here? it hardly understand, take leve = 1 for example,
32-bit guest PTE page table mapping range is 2^(10+12), PAE's PTE page table
mapping range is 2^(9+12), so, i think it's quadrant << 9 here, and other
function like FNAME(prefetch_page), FNAME(sync_page) also are q << 9

Sorry for the double semicolons here, will fix it

Thanks,
Xiao

2010-04-23 12:11:42

by Avi Kivity

Subject: Re: [PATCH 1/10] KVM MMU: fix for calculating gpa in invlpg code

On 04/23/2010 03:05 PM, Xiao Guangrong wrote:
>
>
>>> @@ -478,9 +478,14 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu,
>>> gva_t gva)
>>> ((level == PT_DIRECTORY_LEVEL&& is_large_pte(*sptep))) ||
>>> ((level == PT_PDPE_LEVEL&& is_large_pte(*sptep)))) {
>>> struct kvm_mmu_page *sp = page_header(__pa(sptep));
>>> + int offset = 0;
>>> +
>>> + if (PTTYPE == 32)
>>> + offset = sp->role.quadrant<< PT64_LEVEL_BITS;;
>>>
>>>
>> Wrong for PT_DIRECTORY_LEVEL (should be q<< 8). Also, too many
>> semicolons.
>>
>>
> I guess you mean 'PT64_LEVEL_BITS' not 'PT_DIRECTORY_LEVEL' here :-)
>

No, I mean if level == PT_DIRECTORY_LEVEL, then we want role.quadrant <<
8, not 9.

> It should be q<< 8 here? it hardly understand, take leve = 1 for example,
> 32-bit guest PTE page table mapping range is 2^(10+12), PAE's PTE page table
> mapping range is 2^(9+12),

For level == PT_DIRECTORY_LEVEL, quadrant is in the range 0..3. Each sp
maps 1GB, while the guest page table maps 4GB. So the upper two bits
become the quadrant.

> so, i think it's quadrant<< 9 here, and other
> function like FNAME(prefetch_page), FNAME(sync_page) also are q<< 9
>

They only work for PT_PAGE_TABLE_LEVEL, so for them 9 is correct.

--
Do not meddle in the internals of kernels, for they are subtle and quick to panic.