From: "wangyanan (Y)" <wangyanan55@huawei.com>
To: Marc Zyngier <maz@kernel.org>
Cc: <linux-kernel@vger.kernel.org>,
<linux-arm-kernel@lists.infradead.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>, James Morse <james.morse@arm.com>,
Julien Thierry <julien.thierry.kdev@gmail.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Gavin Shan <gshan@redhat.com>,
Quentin Perret <qperret@google.com>, <wanghaibin.wang@huawei.com>,
<yezengruan@huawei.com>, <zhukeqian1@huawei.com>,
<yuzenghui@huawei.com>, <jiangkunkun@huawei.com>,
<wangjingyi11@huawei.com>, <lushenming@huawei.com>
Subject: Re: [RFC PATCH] KVM: arm64: Add prejudgement for relaxing permissions only case in stage2 translation fault handler
Date: Mon, 14 Dec 2020 15:20:49 +0800 [thread overview]
Message-ID: <8adf8bda-58da-bddd-0522-f750a2d030c2@huawei.com> (raw)
In-Reply-To: <8d006755e5afce7e49b03993316c4fcc@kernel.org>
On 2020/12/11 17:49, Marc Zyngier wrote:
> Hi Yanan,
>
> On 2020-12-11 08:01, Yanan Wang wrote:
>> In dirty-logging, or dirty-logging-stopped time, even normal running
>> time of a guest configed with huge mappings and numbers of vCPUs,
>> translation faults by different vCPUs on the same GPA could occur
>> successively almost at the same time. There are two reasons for it.
>>
>> (1) If there are some vCPUs accessing the same GPA at the same time
>> and the leaf PTE is not set yet, then they will all cause translation
>> faults and the first vCPU holding mmu_lock will set valid leaf PTE,
>> and the others will later choose to update the leaf PTE or not.
>>
>> (2) When changing a leaf entry or a table entry with break-before-make,
>> if there are some vCPUs accessing the same GPA just catch the moment
>> when the target PTE is set invalid in a BBM procedure coincidentally,
>> they will all cause translation faults and will later choose to update
>> the leaf PTE or not.
>>
>> The worst case can be like this: some vCPUs cause translation faults
>> on the same GPA with different prots, they will fight each other by
>> changing back access permissions of the PTE with break-before-make.
>> And the BBM-invalid moment might trigger more unnecessary translation
>> faults. As a result, some useless small loops will occur, which could
>> lead to vCPU stuck.
>>
>> To avoid unnecessary update and small loops, add prejudgement in the
>> translation fault handler: Skip updating the valid leaf PTE if we are
>> trying to recreate exactly the same mapping or to reduce access
>> permissions only(such as RW-->RO). And update the valid leaf PTE without
>> break-before-make if we are trying to add more permissions only.
>
> I'm a bit perplexed with this: why are you skipping the update if the
> permissions need to be reduced? Even more, how can we reduce the
> permissions from a vCPU fault? I can't really think of a scenario where
> that happens.
>
> Or are you describing a case where two vcpus fault simultaneously with
> conflicting permissions:
>
> - Both vcpus fault on translation fault
> - vcpu A wants W access
> - vpcu B wants R access
>
> and 'A' gets in first, set the permissions to RW (because R is
> implicitly added to W), followed by 'B' which downgrades it to RO?
>
> If that's what you are describing, then I agree we could do better.
Yes, this is exactly what I want to describe.
>
>>
>> Signed-off-by: Yanan Wang <wangyanan55@huawei.com>
>> ---
>> arch/arm64/kvm/hyp/pgtable.c | 73 +++++++++++++++++++++++++-----------
>> 1 file changed, 52 insertions(+), 21 deletions(-)
>>
>> diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c
>> index 23a01dfcb27a..f8b3248cef1c 100644
>> --- a/arch/arm64/kvm/hyp/pgtable.c
>> +++ b/arch/arm64/kvm/hyp/pgtable.c
>> @@ -45,6 +45,8 @@
>>
>> #define KVM_PTE_LEAF_ATTR_HI_S2_XN BIT(54)
>>
>> +#define KVM_PTE_LEAF_ATTR_PERMS (GENMASK(7, 6) | BIT(54))
>> +
>> struct kvm_pgtable_walk_data {
>> struct kvm_pgtable *pgt;
>> struct kvm_pgtable_walker *walker;
>> @@ -170,10 +172,9 @@ static void kvm_set_table_pte(kvm_pte_t *ptep,
>> kvm_pte_t *childp)
>> smp_store_release(ptep, pte);
>> }
>>
>> -static bool kvm_set_valid_leaf_pte(kvm_pte_t *ptep, u64 pa,
>> kvm_pte_t attr,
>> - u32 level)
>> +static kvm_pte_t kvm_init_valid_leaf_pte(u64 pa, kvm_pte_t attr, u32
>> level)
>> {
>> - kvm_pte_t old = *ptep, pte = kvm_phys_to_pte(pa);
>> + kvm_pte_t pte = kvm_phys_to_pte(pa);
>> u64 type = (level == KVM_PGTABLE_MAX_LEVELS - 1) ?
>> KVM_PTE_TYPE_PAGE :
>> KVM_PTE_TYPE_BLOCK;
>>
>> @@ -181,12 +182,7 @@ static bool kvm_set_valid_leaf_pte(kvm_pte_t
>> *ptep, u64 pa, kvm_pte_t attr,
>> pte |= FIELD_PREP(KVM_PTE_TYPE, type);
>> pte |= KVM_PTE_VALID;
>>
>> - /* Tolerate KVM recreating the exact same mapping. */
>> - if (kvm_pte_valid(old))
>> - return old == pte;
>> -
>> - smp_store_release(ptep, pte);
>> - return true;
>> + return pte;
>> }
>>
>> static int kvm_pgtable_visitor_cb(struct kvm_pgtable_walk_data
>> *data, u64 addr,
>> @@ -341,12 +337,17 @@ static int hyp_map_set_prot_attr(enum
>> kvm_pgtable_prot prot,
>> static bool hyp_map_walker_try_leaf(u64 addr, u64 end, u32 level,
>> kvm_pte_t *ptep, struct hyp_map_data *data)
>> {
>> + kvm_pte_t new, old = *ptep;
>> u64 granule = kvm_granule_size(level), phys = data->phys;
>>
>> if (!kvm_block_mapping_supported(addr, end, phys, level))
>> return false;
>>
>> - WARN_ON(!kvm_set_valid_leaf_pte(ptep, phys, data->attr, level));
>> + /* Tolerate KVM recreating the exact same mapping. */
>> + new = kvm_init_valid_leaf_pte(phys, data->attr, level);
>> + if (old != new && !WARN_ON(kvm_pte_valid(old)))
>> + smp_store_release(ptep, new);
>> +
>> data->phys += granule;
>> return true;
>> }
>> @@ -461,25 +462,56 @@ static int stage2_map_set_prot_attr(enum
>> kvm_pgtable_prot prot,
>> return 0;
>> }
>>
>> +static bool stage2_set_valid_leaf_pte_pre(u64 addr, u32 level,
>> + kvm_pte_t *ptep, kvm_pte_t new,
>> + struct stage2_map_data *data)
>> +{
>> + kvm_pte_t old = *ptep, old_attr, new_attr;
>> +
>> + if ((old ^ new) & (~KVM_PTE_LEAF_ATTR_PERMS))
>> + return false;
>> +
>> + /*
>> + * Skip updating if we are trying to recreate exactly the same
>> mapping
>> + * or to reduce the access permissions only. And update the
>> valid leaf
>> + * PTE without break-before-make if we are trying to add more
>> access
>> + * permissions only.
>> + */
>> + old_attr = (old & KVM_PTE_LEAF_ATTR_PERMS) ^
>> KVM_PTE_LEAF_ATTR_HI_S2_XN;
>> + new_attr = (new & KVM_PTE_LEAF_ATTR_PERMS) ^
>> KVM_PTE_LEAF_ATTR_HI_S2_XN;
>> + if (new_attr <= old_attr)
>> + return true;
>> +
>> + WRITE_ONCE(*ptep, new);
>> + kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, data->mmu, addr, level);
>
> I think what bothers me the most here is that we are turning a mapping
> into
> a permission update, which makes the code really hard to read, and mixes
> two things that were so far separate.
>
> I wonder whether we should instead abort the update and simply take
> the fault
> again, if we ever need to do it.
>
> Thanks,
>
> M.
next prev parent reply other threads:[~2020-12-14 7:22 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-11 8:01 [RFC PATCH 0/1] Add prejudgement for relaxing permissions only case Yanan Wang
2020-12-11 8:01 ` [RFC PATCH] KVM: arm64: Add prejudgement for relaxing permissions only case in stage2 translation fault handler Yanan Wang
2020-12-11 9:49 ` Marc Zyngier
2020-12-11 10:00 ` Will Deacon
2020-12-14 7:20 ` wangyanan (Y)
2020-12-15 13:18 ` Marc Zyngier
2020-12-14 7:20 ` wangyanan (Y) [this message]
2020-12-11 9:53 ` Will Deacon
2020-12-14 7:20 ` wangyanan (Y)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8adf8bda-58da-bddd-0522-f750a2d030c2@huawei.com \
--to=wangyanan55@huawei.com \
--cc=catalin.marinas@arm.com \
--cc=gshan@redhat.com \
--cc=james.morse@arm.com \
--cc=jiangkunkun@huawei.com \
--cc=julien.thierry.kdev@gmail.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lushenming@huawei.com \
--cc=maz@kernel.org \
--cc=qperret@google.com \
--cc=suzuki.poulose@arm.com \
--cc=wanghaibin.wang@huawei.com \
--cc=wangjingyi11@huawei.com \
--cc=will@kernel.org \
--cc=yezengruan@huawei.com \
--cc=yuzenghui@huawei.com \
--cc=zhukeqian1@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).