KVM: x86: Minor emulator cleanup
cover KVM: x86: Minor emulator cleanup
Three small patches to move emulator specific variables from 'struct kvm_vcpu_arch' to 'struct x86_emulate_ctxt'.
Sean Christopherson (3):
KVM: x86: Add EMULTYPE_PF when emulation is triggered by a page fault
KVM: x86: Move gpa_val and gpa_available into the emulator context
KVM: x86: Move #PF retry tracking variables into emulation context
arch/x86/include/asm/kvm_emulate.h | 8 ++++++ arch/x86/include/asm/kvm_host.h | 19 ++++++------- arch/x86/kvm/mmu/mmu.c | 10 ++----- arch/x86/kvm/x86.c | 45 +++++++++++++++++++----------- 4 files changed, 48 insertions(+), 34 deletions(-)
Signature · 1 line
2.24.0
PATCH 1/3 KVM: x86: Add EMULTYPE_PF when emulation is triggered by a page fault
Add a new emulation type flag to explicitly mark emulation related to a page fault. Use the new flag, EMULTYPE_PF, to move the propagation of the GPA into the emulator context from the page fault handler into x86_emulate_instruction.
Similarly, to help clarify how cr2 is used, don't propagate cr2 into the exception.address when it's *not* valid and instead explicitly zero out exception.address. Functionally this is a nop, as all non-EMULTYPE_PF callers pass zero for cr2, i.e. it's effectively a documentation update. Zeroing exception.address is probably unnecessary as it shouldn't be exposed to the guest for non-#PF exceptions, but keep the current behavior to avoid introducing an unintentional function change.
Append _PF to EMULTYPE_ALLOW_RETRY to make it clear retrying is only intended for use when emulating after a #PF, and add WARNs to enforce that notion.
Signed-off-by Sean Christopherson <[email protected]>
--- arch/x86/include/asm/kvm_host.h | 12 +++++++++--- arch/x86/kvm/mmu/mmu.c | 10 ++-------- arch/x86/kvm/x86.c | 25 +++++++++++++++++++------ 3 files changed, 30 insertions(+), 17 deletions(-)
arch/x86/include/asm/kvm_host.h +9 -3
@@ -1347,8 +1347,9 @@ extern u64 kvm_mce_cap_supported;* decode the instruction length. For use *only* by * kvm_x86_ops->skip_emulated_instruction() implementations. * -* EMULTYPE_ALLOW_RETRY - Set when the emulator should resume the guest to -* retry native execution under certain conditions. +* EMULTYPE_ALLOW_RETRY_PF - Set when the emulator should resume the guest to +* retry native execution under certain conditions, +* Can only be set in conjunction with EMULTYPE_PF. * * EMULTYPE_TRAP_UD_FORCED - Set when emulating an intercepted #UD that was * triggered by KVM's magic "force emulation" prefix,
@@ -1361,13 +1362,18 @@ extern u64 kvm_mce_cap_supported;* backdoor emulation, which is opt in via module param. * VMware backoor emulation handles select instructions * and reinjects the #GP for all other cases. +* +* EMULTYPE_PF - Set when emulating MMIO by way of an intercepted #PF, in which +* case the CR2/GPA value pass on the stack is valid. */ #define EMULTYPE_NO_DECODE (1 << 0)#define EMULTYPE_TRAP_UD (1 << 1)#define EMULTYPE_SKIP (1 << 2) -#define EMULTYPE_ALLOW_RETRY (1 << 3) +#define EMULTYPE_ALLOW_RETRY_PF (1 << 3)#define EMULTYPE_TRAP_UD_FORCED (1 << 4)#define EMULTYPE_VMWARE_GP (1 << 5) +#define EMULTYPE_PF (1 << 6) +int kvm_emulate_instruction (struct kvm_vcpu *vcpu,int emulation_type);int kvm_emulate_instruction_from_buffer (struct kvm_vcpu *vcpu,void *insn,int insn_len);
arch/x86/kvm/mmu/mmu.c +2 -8
@@ -5519,15 +5519,9 @@ static int make_mmu_pages_available(struct kvm_vcpu *vcpu)int kvm_mmu_page_fault (struct kvm_vcpu *vcpu,gva_t cr2,u64 error_code,void *insn,int insn_len) { -int r, emulation_type =0 ; +int r, emulation_type =EMULTYPE_PF ;bool direct = vcpu->arch.mmu->direct_map; -/* With shadow page tables, fault_address contains a GVA or nGPA. */ -if (vcpu->arch.mmu->direct_map) { - vcpu->arch.gpa_available = true; - vcpu->arch.gpa_val = cr2; - } - r =RET_PF_INVALID ;if (unlikely (error_code &PFERR_RSVD_MASK )) { r =handle_mmio_page_fault (vcpu, cr2, direct);
@@ -5572,7 +5566,7 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,* for L1 isn't going to magically fix whatever issue cause L2 to fail. */ if (!mmio_info_in_cache (vcpu, cr2, direct) && !is_guest_mode (vcpu)) - emulation_type =EMULTYPE_ALLOW_RETRY ; + emulation_type |=EMULTYPE_ALLOW_RETRY_PF ; emulate:/* * On AMD platforms, under certain conditions insn_len may be zero on #NPF.
arch/x86/kvm/x86.c +19 -6
@@ -6393,10 +6393,11 @@ static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2,gpa_t gpa = cr2;kvm_pfn_t pfn; -if (!(emulation_type &EMULTYPE_ALLOW_RETRY )) +if (!(emulation_type &EMULTYPE_ALLOW_RETRY_PF ))return false; -if (WARN_ON_ONCE (is_guest_mode (vcpu))) +if (WARN_ON_ONCE (is_guest_mode (vcpu)) || +WARN_ON_ONCE (!(emulation_type &EMULTYPE_PF )))return false;if (!vcpu->arch.mmu->direct_map) {
@@ -6484,10 +6485,11 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,*/ vcpu->arch.last_retry_eip = vcpu->arch.last_retry_addr =0 ; -if (!(emulation_type &EMULTYPE_ALLOW_RETRY )) +if (!(emulation_type &EMULTYPE_ALLOW_RETRY_PF ))return false; -if (WARN_ON_ONCE (is_guest_mode (vcpu))) +if (WARN_ON_ONCE (is_guest_mode (vcpu)) || +WARN_ON_ONCE (!(emulation_type &EMULTYPE_PF )))return false;if (x86_page_table_writing_insn (ctxt))
@@ -6742,8 +6744,19 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, } restart: -/* Save the faulting GPA (cr2) in the address field */ - ctxt->exception.address = cr2; +if (emulation_type &EMULTYPE_PF ) { +/* Save the faulting GPA (cr2) in the address field */ + ctxt->exception.address = cr2; + +/* With shadow page tables, cr2 contains a GVA or nGPA. */ +if (vcpu->arch.mmu->direct_map) { + vcpu->arch.gpa_available = true; + vcpu->arch.gpa_val = cr2; + } + }else { +/* Sanitize the address out of an abundance of paranoia. */ + ctxt->exception.address =0 ; + } r =x86_emulate_insn (ctxt);
Signature · 1 line
2.24.0
PATCH 2/3 KVM: x86: Move gpa_val and gpa_available into the emulator context
In reply to Sean ChristophersonMove the GPA tracking into the emulator context to prevent it from being abused in the standard page fault flow. All paths into the emulator go through init_emulate_ctxt(), so there's no need to clear gpa_available after every VM-Exit. The only partial exception is EMULTYPE_NO_DECODE, but in that case the emulator is simply being re-entered, i.e. retaining gpa_available is correct and consistent with current behavior.
Signed-off-by Sean Christopherson <[email protected]>
--- arch/x86/include/asm/kvm_emulate.h | 4 ++++ arch/x86/include/asm/kvm_host.h | 4 ---- arch/x86/kvm/x86.c | 13 ++++++------- 3 files changed, 10 insertions(+), 11 deletions(-)
arch/x86/include/asm/kvm_emulate.h +4 -0
@@ -307,6 +307,10 @@ struct x86_emulate_ctxt {bool have_exception;struct x86_exception exception; +/* GPA available */ +bool gpa_available; +gpa_t gpa_val; +/* * decode cache */
arch/x86/include/asm/kvm_host.h +0 -4
@@ -791,10 +791,6 @@ struct kvm_vcpu_arch {int pending_ioapic_eoi;int pending_external_vector; -/* GPA available */ -bool gpa_available; -gpa_t gpa_val; -/* be preempted when it's in kernel-mode(cpl=0) */ bool preempted_in_kernel;
arch/x86/kvm/x86.c +6 -7
@@ -5664,10 +5664,9 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,* operation using rep will only have the initial GPA from the NPF * occurred. */ -if (vcpu->arch.gpa_available && -emulator_can_use_gpa (ctxt) && - (addr & ~PAGE_MASK ) == (vcpu->arch.gpa_val & ~PAGE_MASK )) { - gpa = vcpu->arch.gpa_val; +if (ctxt->gpa_available &&emulator_can_use_gpa (ctxt) && + (addr & ~PAGE_MASK ) == (ctxt->gpa_val & ~PAGE_MASK )) { + gpa = ctxt->gpa_val; ret =vcpu_is_mmio_gpa (vcpu, addr, gpa, write); }else { ret =vcpu_mmio_gva_to_gpa (vcpu, addr, &gpa, exception, write);
@@ -6318,6 +6317,7 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) kvm_x86_ops->get_cs_db_l_bits (vcpu, &cs_db, &cs_l); + ctxt->gpa_available = false; ctxt->eflags =kvm_get_rflags (vcpu); ctxt->tf = (ctxt->eflags &X86_EFLAGS_TF ) !=0 ;
@@ -6750,8 +6750,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,/* With shadow page tables, cr2 contains a GVA or nGPA. */ if (vcpu->arch.mmu->direct_map) { - vcpu->arch.gpa_available = true; - vcpu->arch.gpa_val = cr2; + ctxt->gpa_available = true; + ctxt->gpa_val = cr2; } }else {/* Sanitize the address out of an abundance of paranoia. */
@@ -8306,7 +8306,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)if (vcpu->arch.apic_attention)kvm_lapic_sync_from_vapic (vcpu); - vcpu->arch.gpa_available = false; r = kvm_x86_ops->handle_exit (vcpu);return r;
Signature · 1 line
2.24.0
PATCH 3/3 KVM: x86: Move #PF retry tracking variables into emulation context
In reply to Sean ChristophersonMove last_retry_eip and last_retry_addr into the emulation context as they are specific to retrying an instruction after emulation failure.
Signed-off-by Sean Christopherson <[email protected]>
--- arch/x86/include/asm/kvm_emulate.h | 4 ++++ arch/x86/include/asm/kvm_host.h | 3 --- arch/x86/kvm/x86.c | 11 ++++++----- 3 files changed, 10 insertions(+), 8 deletions(-)
arch/x86/include/asm/kvm_emulate.h +4 -0
@@ -311,6 +311,10 @@ struct x86_emulate_ctxt {bool gpa_available;gpa_t gpa_val; +/* Track EIP and CR2/GPA when retrying faulting instruction on #PF. */ +unsigned long last_retry_eip; +unsigned long last_retry_addr; +/* * decode cache */
arch/x86/include/asm/kvm_host.h +0 -3
@@ -745,9 +745,6 @@ struct kvm_vcpu_arch {cpumask_var_t wbinvd_dirty_mask; -unsigned long last_retry_eip; -unsigned long last_retry_addr; -struct {bool halted;gfn_t gfns[roundup_pow_of_two (ASYNC_PF_PER_VCPU )];
arch/x86/kvm/x86.c +6 -5
@@ -6317,6 +6317,7 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) kvm_x86_ops->get_cs_db_l_bits (vcpu, &cs_db, &cs_l); +/* last_retry_{eip,addr} are persistent and must not be init'd here. */ ctxt->gpa_available = false; ctxt->eflags =kvm_get_rflags (vcpu); ctxt->tf = (ctxt->eflags &X86_EFLAGS_TF ) !=0 ;
@@ -6467,8 +6468,8 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,struct kvm_vcpu *vcpu =emul_to_vcpu (ctxt);unsigned long last_retry_eip, last_retry_addr, gpa = cr2; - last_retry_eip = vcpu->arch.last_retry_eip; - last_retry_addr = vcpu->arch.last_retry_addr; + last_retry_eip = ctxt->last_retry_eip; + last_retry_addr = ctxt->last_retry_addr;/* * If the emulation is caused by #PF and it is non-page_table
@@ -6483,7 +6484,7 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,* and the address again, we can break out of the potential infinite * loop. */ - vcpu->arch.last_retry_eip = vcpu->arch.last_retry_addr =0 ; + ctxt->last_retry_eip = ctxt->last_retry_addr =0 ;if (!(emulation_type &EMULTYPE_ALLOW_RETRY_PF ))return false;
@@ -6498,8 +6499,8 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,if (ctxt->eip == last_retry_eip && last_retry_addr == cr2)return false; - vcpu->arch.last_retry_eip = ctxt->eip; - vcpu->arch.last_retry_addr = cr2; + ctxt->last_retry_eip = ctxt->eip; + ctxt->last_retry_addr = cr2;if (!vcpu->arch.mmu->direct_map) gpa =kvm_mmu_gva_to_gpa_write (vcpu, cr2,NULL );
Signature · 1 line
2.24.0