Re: [PATCH v7 06/15] VMX/altp2m: add code to support EPTP switching and #VE.

["Sahita, Ravi" <ravi.sahita@intel.com>]

>From: Jan Beulich [mailto:JBeulich@suse.com]
>Sent: Thursday, July 23, 2015 2:43 AM
>
>>>> On 23.07.15 at 01:01, <edmund.h.white@intel.com> wrote:
>> @@ -1770,6 +1771,105 @@ static bool_t
>vmx_is_singlestep_supported(void)
>>      return cpu_has_monitor_trap_flag;  }
>>
>> +static void vmx_vcpu_update_eptp(struct vcpu *v) {
>> +    struct domain *d = v->domain;
>> +    struct p2m_domain *p2m = NULL;
>> +    struct ept_data *ept;
>> +
>> +    if ( altp2m_active(d) )
>> +        p2m = p2m_get_altp2m(v);
>> +    if ( !p2m )
>> +        p2m = p2m_get_hostp2m(d);
>> +
>> +    ept = &p2m->ept;
>> +    ept->asr = pagetable_get_pfn(p2m_get_pagetable(p2m));
>> +
>> +    vmx_vmcs_enter(v);
>> +
>> +    __vmwrite(EPT_POINTER, ept_get_eptp(ept));
>> +
>> +    if ( v->arch.hvm_vmx.secondary_exec_control &
>> +        SECONDARY_EXEC_ENABLE_VIRT_EXCEPTIONS )
>
>Indentation.
>

Ok.

>> +static void vmx_vcpu_update_vmfunc_ve(struct vcpu *v) {
>> +    struct domain *d = v->domain;
>> +    u32 mask = SECONDARY_EXEC_ENABLE_VM_FUNCTIONS;
>> +
>> +    if ( !cpu_has_vmx_vmfunc )
>> +        return;
>> +
>> +    if ( cpu_has_vmx_virt_exceptions )
>> +        mask |= SECONDARY_EXEC_ENABLE_VIRT_EXCEPTIONS;
>> +
>> +    vmx_vmcs_enter(v);
>> +
>> +    if ( !d->is_dying && altp2m_active(d) )
>> +    {
>> +        v->arch.hvm_vmx.secondary_exec_control |= mask;
>> +        __vmwrite(VM_FUNCTION_CONTROL,
>VMX_VMFUNC_EPTP_SWITCHING);
>> +        __vmwrite(EPTP_LIST_ADDR,
>> + virt_to_maddr(d->arch.altp2m_eptp));
>> +
>> +        if ( cpu_has_vmx_virt_exceptions )
>> +        {
>> +            p2m_type_t t;
>> +            mfn_t mfn;
>> +
>> +            mfn = get_gfn_query_unlocked(d,
>> + gfn_x(vcpu_altp2m(v).veinfo_gfn), &t);
>> +
>> +            if ( mfn_x(mfn) != INVALID_MFN )
>> +                __vmwrite(VIRT_EXCEPTION_INFO, mfn_x(mfn) <<
>> + PAGE_SHIFT);
>
>Considering that the VMCS field holds a byte-aligned address, why do you
>have the (later introduced) hvmop specify a GFN instead of a GPA?
>

The SDM states:
" If the "EPT-violation #VE" VM-execution control is 1, the virtualization-exception information address must
satisfy the following checks:
- Bits 11:0 of the address must be 0.
- The address must not set any bits beyond the processor's physical-address width."

>Also you shouldn't be open coding pfn_to_paddr().
>

ok

thanks,
Ravi

>> +            else
>> +                v->arch.hvm_vmx.secondary_exec_control &=
>> +                    ~SECONDARY_EXEC_ENABLE_VIRT_EXCEPTIONS;
>> +        }
>> +    }
>> +    else
>> +        v->arch.hvm_vmx.secondary_exec_control &= ~mask;
>> +
>> +    __vmwrite(SECONDARY_VM_EXEC_CONTROL,
>> +        v->arch.hvm_vmx.secondary_exec_control);
>
>Indentation again.
>
>Jan