| Message ID | 1502848704-7474-1-git-send-email-tianyu.lan@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 16/08/2017 03:58, Lan Tianyu wrote: > These CR3 VMEXITs was introduced for platform without "unrestricted guest" > support. This is to set ept identity table to guest CR3 in guest real > mode because these platforms don't support ept real mode(CR0.PE and CR0.PG > must be set to 1). But these VMEXITs is redundant for platforms with > "unrestricted guest" support. This is true, but I'm not sure it's a good idea to make things more complex... It is working code and is not a bottleneck anywhere. Paolo > Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> > --- > arch/x86/kvm/vmx.c | 22 +++++++++++++--------- > 1 file changed, 13 insertions(+), 9 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index 9b21b12..46dcf50 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0, > vmx_decache_cr3(vcpu); > if (!(cr0 & X86_CR0_PG)) { > /* From paging/starting to nonpaging */ > - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, > - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | > - (CPU_BASED_CR3_LOAD_EXITING | > - CPU_BASED_CR3_STORE_EXITING)); > + if (!enable_unrestricted_guest) > + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, > + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | > + (CPU_BASED_CR3_LOAD_EXITING | > + CPU_BASED_CR3_STORE_EXITING)); > vcpu->arch.cr0 = cr0; > vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); > } else if (!is_paging(vcpu)) { > /* From nonpaging to paging */ > - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, > - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & > - ~(CPU_BASED_CR3_LOAD_EXITING | > - CPU_BASED_CR3_STORE_EXITING)); > + if (!enable_unrestricted_guest) > + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, > + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & > + ~(CPU_BASED_CR3_LOAD_EXITING | > + CPU_BASED_CR3_STORE_EXITING)); > vcpu->arch.cr0 = cr0; > vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); > } > @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) > } > > vmx_flush_tlb(vcpu); > - vmcs_writel(GUEST_CR3, guest_cr3); > + > + if (!enable_unrestricted_guest || !enable_ept) > + vmcs_writel(GUEST_CR3, guest_cr3); > } > > static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) >
2017-08-15 21:58-0400, Lan Tianyu: > These CR3 VMEXITs was introduced for platform without "unrestricted guest" > support. This is to set ept identity table to guest CR3 in guest real > mode because these platforms don't support ept real mode(CR0.PE and CR0.PG > must be set to 1). But these VMEXITs is redundant for platforms with > "unrestricted guest" support. > > Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> > --- > arch/x86/kvm/vmx.c | 22 +++++++++++++--------- > 1 file changed, 13 insertions(+), 9 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) > } > > vmx_flush_tlb(vcpu); > - vmcs_writel(GUEST_CR3, guest_cr3); > + > + if (!enable_unrestricted_guest || !enable_ept) > + vmcs_writel(GUEST_CR3, guest_cr3); This looks wrong -- it would prevent update GUEST_CR3 outside of non-root mode with enable_unrestricted_guest.
On 2017年08月16日 21:26, Radim Krčmář wrote: > 2017-08-15 21:58-0400, Lan Tianyu: >> These CR3 VMEXITs was introduced for platform without "unrestricted guest" >> support. This is to set ept identity table to guest CR3 in guest real >> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG >> must be set to 1). But these VMEXITs is redundant for platforms with >> "unrestricted guest" support. >> >> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> >> --- >> arch/x86/kvm/vmx.c | 22 +++++++++++++--------- >> 1 file changed, 13 insertions(+), 9 deletions(-) >> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) >> } >> >> vmx_flush_tlb(vcpu); >> - vmcs_writel(GUEST_CR3, guest_cr3); >> + >> + if (!enable_unrestricted_guest || !enable_ept) >> + vmcs_writel(GUEST_CR3, guest_cr3); > > This looks wrong -- it would prevent update GUEST_CR3 outside of > non-root mode with enable_unrestricted_guest. > OK. Do you mean nest mode? I didn't consider that case. I thought there were three cases here. 1) Shadow page mode(enable_ept=0) 2) ept mode without unrestricted guest mode (ept=1, enable_unrestricted_guest = 0) 3) ept mode with unrestricted guest mode (ept=1, enable_unrestricted_guest = 1) From my understanding, only (1) and (2) need to update guest cr3. If nest mode is still needed to update guest CR3, we can add is_guest_mode() in the if condition. Other choice is to just ignore setting guest cr3 for case3. The condition maybe changed to if (!(enable_unrestricted_guest && enable_ept)) vmcs_writel(GUEST_CR3, guest_cr3);
On 2017年08月16日 17:25, Paolo Bonzini wrote: > On 16/08/2017 03:58, Lan Tianyu wrote: >> These CR3 VMEXITs was introduced for platform without "unrestricted guest" >> support. This is to set ept identity table to guest CR3 in guest real >> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG >> must be set to 1). But these VMEXITs is redundant for platforms with >> "unrestricted guest" support. > > This is true, but I'm not sure it's a good idea to make things more > complex... It is working code and is not a bottleneck anywhere. Yes, this is just code clear up and will not affect function. I thought this change was missed when introduced unrestricted guest support.
2017-08-16 17:25 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>: > On 16/08/2017 03:58, Lan Tianyu wrote: >> These CR3 VMEXITs was introduced for platform without "unrestricted guest" >> support. This is to set ept identity table to guest CR3 in guest real >> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG >> must be set to 1). But these VMEXITs is redundant for platforms with >> "unrestricted guest" support. > > This is true, but I'm not sure it's a good idea to make things more > complex... It is working code and is not a bottleneck anywhere. Sorry, I have another question. There is no A20 emulation in kvm currently, then whether or not the vm8086 which is emulated by kvm can guarantee real mode guest which access occurs at 1 MByte will incur address-wraparound? Regards, Wanpeng Li > > Paolo > >> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> >> --- >> arch/x86/kvm/vmx.c | 22 +++++++++++++--------- >> 1 file changed, 13 insertions(+), 9 deletions(-) >> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >> index 9b21b12..46dcf50 100644 >> --- a/arch/x86/kvm/vmx.c >> +++ b/arch/x86/kvm/vmx.c >> @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0, >> vmx_decache_cr3(vcpu); >> if (!(cr0 & X86_CR0_PG)) { >> /* From paging/starting to nonpaging */ >> - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >> - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | >> - (CPU_BASED_CR3_LOAD_EXITING | >> - CPU_BASED_CR3_STORE_EXITING)); >> + if (!enable_unrestricted_guest) >> + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >> + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | >> + (CPU_BASED_CR3_LOAD_EXITING | >> + CPU_BASED_CR3_STORE_EXITING)); >> vcpu->arch.cr0 = cr0; >> vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); >> } else if (!is_paging(vcpu)) { >> /* From nonpaging to paging */ >> - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >> - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & >> - ~(CPU_BASED_CR3_LOAD_EXITING | >> - CPU_BASED_CR3_STORE_EXITING)); >> + if (!enable_unrestricted_guest) >> + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >> + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & >> + ~(CPU_BASED_CR3_LOAD_EXITING | >> + CPU_BASED_CR3_STORE_EXITING)); >> vcpu->arch.cr0 = cr0; >> vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); >> } >> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) >> } >> >> vmx_flush_tlb(vcpu); >> - vmcs_writel(GUEST_CR3, guest_cr3); >> + >> + if (!enable_unrestricted_guest || !enable_ept) >> + vmcs_writel(GUEST_CR3, guest_cr3); >> } >> >> static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) >> >
Cc Nadav, 2017-08-17 13:58 GMT+08:00 Wanpeng Li <kernellwp@gmail.com>: > 2017-08-16 17:25 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>: >> On 16/08/2017 03:58, Lan Tianyu wrote: >>> These CR3 VMEXITs was introduced for platform without "unrestricted guest" >>> support. This is to set ept identity table to guest CR3 in guest real >>> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG >>> must be set to 1). But these VMEXITs is redundant for platforms with >>> "unrestricted guest" support. >> >> This is true, but I'm not sure it's a good idea to make things more >> complex... It is working code and is not a bottleneck anywhere. > > Sorry, I have another question. There is no A20 emulation in kvm > currently, then whether or not the vm8086 which is emulated by kvm can > guarantee real mode guest which access occurs at 1 MByte will incur > address-wraparound? > > Regards, > Wanpeng Li > >> >> Paolo >> >>> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> >>> --- >>> arch/x86/kvm/vmx.c | 22 +++++++++++++--------- >>> 1 file changed, 13 insertions(+), 9 deletions(-) >>> >>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >>> index 9b21b12..46dcf50 100644 >>> --- a/arch/x86/kvm/vmx.c >>> +++ b/arch/x86/kvm/vmx.c >>> @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0, >>> vmx_decache_cr3(vcpu); >>> if (!(cr0 & X86_CR0_PG)) { >>> /* From paging/starting to nonpaging */ >>> - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >>> - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | >>> - (CPU_BASED_CR3_LOAD_EXITING | >>> - CPU_BASED_CR3_STORE_EXITING)); >>> + if (!enable_unrestricted_guest) >>> + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >>> + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | >>> + (CPU_BASED_CR3_LOAD_EXITING | >>> + CPU_BASED_CR3_STORE_EXITING)); >>> vcpu->arch.cr0 = cr0; >>> vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); >>> } else if (!is_paging(vcpu)) { >>> /* From nonpaging to paging */ >>> - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >>> - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & >>> - ~(CPU_BASED_CR3_LOAD_EXITING | >>> - CPU_BASED_CR3_STORE_EXITING)); >>> + if (!enable_unrestricted_guest) >>> + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, >>> + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & >>> + ~(CPU_BASED_CR3_LOAD_EXITING | >>> + CPU_BASED_CR3_STORE_EXITING)); >>> vcpu->arch.cr0 = cr0; >>> vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); >>> } >>> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) >>> } >>> >>> vmx_flush_tlb(vcpu); >>> - vmcs_writel(GUEST_CR3, guest_cr3); >>> + >>> + if (!enable_unrestricted_guest || !enable_ept) >>> + vmcs_writel(GUEST_CR3, guest_cr3); >>> } >>> >>> static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) >>> >>
2017-08-17 13:00+0800, Lan Tianyu: > On 2017年08月16日 21:26, Radim Krčmář wrote: > > 2017-08-15 21:58-0400, Lan Tianyu: > >> These CR3 VMEXITs was introduced for platform without "unrestricted guest" > >> support. This is to set ept identity table to guest CR3 in guest real > >> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG > >> must be set to 1). But these VMEXITs is redundant for platforms with > >> "unrestricted guest" support. > >> > >> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> > >> --- > >> arch/x86/kvm/vmx.c | 22 +++++++++++++--------- > >> 1 file changed, 13 insertions(+), 9 deletions(-) > >> > >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > >> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) > >> } > >> > >> vmx_flush_tlb(vcpu); > >> - vmcs_writel(GUEST_CR3, guest_cr3); > >> + > >> + if (!enable_unrestricted_guest || !enable_ept) > >> + vmcs_writel(GUEST_CR3, guest_cr3); > > > > This looks wrong -- it would prevent update GUEST_CR3 outside of > > non-root mode with enable_unrestricted_guest. > > > > OK. Do you mean nest mode? I didn't consider that case. > I thought there were three cases here. > > 1) Shadow page mode(enable_ept=0) > > 2) ept mode without unrestricted guest mode > (ept=1, enable_unrestricted_guest = 0) > > 3) ept mode with unrestricted guest mode > (ept=1, enable_unrestricted_guest = 1) > > From my understanding, only (1) and (2) need to update guest cr3. > If nest mode is still needed to update guest CR3, we can add > is_guest_mode() in the if condition. Other choice is to just ignore > setting guest cr3 for case3. The condition maybe changed to That too, but I was thinking about a more common (3) with enabled paging, where GUEST_CR3 should reflect what the guest wants there. Consider a case where the userspace changed CR3 (e.g. after migration), how would it get propagated to the guest? > if (!(enable_unrestricted_guest && enable_ept)) > vmcs_writel(GUEST_CR3, guest_cr3); It is the same. :) I would think that checking the condition is about as fast as doing the vmcs write, so we don't need to complicate the code.
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 9b21b12..46dcf50 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0, vmx_decache_cr3(vcpu); if (!(cr0 & X86_CR0_PG)) { /* From paging/starting to nonpaging */ - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | - (CPU_BASED_CR3_LOAD_EXITING | - CPU_BASED_CR3_STORE_EXITING)); + if (!enable_unrestricted_guest) + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) | + (CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING)); vcpu->arch.cr0 = cr0; vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); } else if (!is_paging(vcpu)) { /* From nonpaging to paging */ - vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, - vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & - ~(CPU_BASED_CR3_LOAD_EXITING | - CPU_BASED_CR3_STORE_EXITING)); + if (!enable_unrestricted_guest) + vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, + vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) & + ~(CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING)); vcpu->arch.cr0 = cr0; vmx_set_cr4(vcpu, kvm_read_cr4(vcpu)); } @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) } vmx_flush_tlb(vcpu); - vmcs_writel(GUEST_CR3, guest_cr3); + + if (!enable_unrestricted_guest || !enable_ept) + vmcs_writel(GUEST_CR3, guest_cr3); } static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
These CR3 VMEXITs was introduced for platform without "unrestricted guest" support. This is to set ept identity table to guest CR3 in guest real mode because these platforms don't support ept real mode(CR0.PE and CR0.PG must be set to 1). But these VMEXITs is redundant for platforms with "unrestricted guest" support. Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> --- arch/x86/kvm/vmx.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)