KVM x86: Infinite loop on updating accessed bit in r/o page table
Hi,
I noticed that KVM (with VMX at least) enters an inifite loop of vmentries and ept-violations when it has to set the accessed bit in a guest page table that is in read-only memory (namely: the F-segment of the BIOS). I don't think this is the proper reaction...
Jan
Signature · 2 lines
Siemens AG, Corporate Technology, CT RTC ITP SES-DE Corporate Competence Center Embedded Linux
Il 24/02/2014 19:29, Jan Kiszka ha scritto:
Quoted 8 lines
Hi,
I noticed that KVM (with VMX at least) enters an inifite loop of vmentries and ept-violations when it has to set the accessed bit in a guest page table that is in read-only memory (namely: the F-segment of the BIOS). I don't think this is the proper reaction...
Jan
Thanks, I'll try to reproduce this. Does it work with shadow page tables? I'm asking because this commit wanted to fix something similar for the shadow page table case:
commit ba6a3541545542721ce821d1e7e5ce35752e6fdf
Author: Paolo Bonzini <[email protected]>
Date: Mon Sep 9 13:52:33 2013 +0200
KVM: mmu: allow page tables to be in read-only slots
Page tables in a read-only memory slot will currently cause a triple fault because the page walker uses gfn_to_hva and it fails on such a slot.
OVMF uses such a page table; however, real hardware seems to be fine with that as long as the accessed/dirty bits are set. Save whether the slot is readonly, and later check it when updating the accessed and dirty bits.
even though OVMF sets the accessed/dirty bits so it's not exactly the same scenario.
Note that NPT simply does not support this. Page tables must be writable in the NPT page tables, according to the AMD manual.
Paolo
Quoted 11 lines · Paolo Bonzini
Il 24/02/2014 19:29, Jan Kiszka ha scritto:
Quoted 8 lines
Hi,
I noticed that KVM (with VMX at least) enters an inifite loop of vmentries and ept-violations when it has to set the accessed bit in a guest page table that is in read-only memory (namely: the F-segment of the BIOS). I don't think this is the proper reaction...
Jan
Thanks, I'll try to reproduce this. Does it work with shadow page tables?
It gets beyond the point where Accessed should be set but loops over trying to update Dirty in the page table. QEMU in emulation mode simply ignores both write attempts. I think our ROM should behave like this, i.e. simply swallow writes.
Quoted 20 lines
I'm asking because this commit wanted to fix something similar for the shadow page table case:
commit
ba6a3541545542721ce821d1e7e5ce35752e6fdf
Author: Paolo Bonzini <[email protected]>
Date: Mon Sep 9 13:52:33 2013 +0200KVM: mmu: allow page tables to be in read-only slots
Page tables in a read-only memory slot will currently cause a triple fault because the page walker uses
gfn_to_hvaand it fails on such a slot.OVMF uses such a page table; however, real hardware seems to be fine with that as long as the accessed/dirty bits are set. Save whether the slot is readonly, and later check it when updating the accessed and dirty bits.
Reviewed-by Xiao Guangrong <[email protected]>Reviewed-by Gleb Natapov <[email protected]>Signed-off-by Paolo Bonzini <[email protected]>
Quoted 5 lines
even though OVMF sets the accessed/dirty bits so it's not exactly the same scenario.
Note that NPT simply does not support this. Page tables must be writable in the NPT page tables, according to the AMD manual.
We could still emulate the instruction in such a case to get beyond the write fault. Slow but more correct, I suppose.
Jan
Signature · 2 lines
Siemens AG, Corporate Technology, CT RTC ITP SES-DE Corporate Competence Center Embedded Linux
Paolo Bonzini
maintainerIl 25/02/2014 12:23, Jan Kiszka ha scritto:
Quoted 7 lines
Quoted 5 lines
Quoted 5 lines
even though OVMF sets the accessed/dirty bits so it's not exactly the same scenario.
Note that NPT simply does not support this. Page tables must be writable in the NPT page tables, according to the AMD manual.
We could still emulate the instruction in such a case to get beyond the write fault. Slow but more correct, I suppose.
They must be writable always, even if A=D=1. So the only solution would be to emulate everything that puts page tables in ROMs, which is really too slow to be viable. We're really talking 50-100 times slower than bare metal.
Paolo