KVM: x86/mmu: Remove FNAME(is_self_change_mapping)

Drop FNAME(is_self_change_mapping) and instead rely on
kvm_mmu_hugepage_adjust() to adjust the hugepage accordingly.  Prior to
commit 4cd071d13c5c ("KVM: x86/mmu: Move calls to thp_adjust() down a
level"), the hugepage adjustment was done before allocating new shadow
pages, i.e. failed to restrict the hugepage sizes if a new shadow page
resulted in account_shadowed() changing the disallowed hugepage tracking.

Removing FNAME(is_self_change_mapping) fixes a bug reported by Huang Hang
where KVM unnecessarily forces a 4KiB page.  FNAME(is_self_change_mapping)
has a defect in that it blindly disables _all_ hugepage mappings rather
than trying to reduce the size of the hugepage.  If the guest is writing
to a 1GiB page and the 1GiB is self-referential but a 2MiB page is not,
then KVM can and should create a 2MiB mapping.

Add a comment above the call to kvm_mmu_hugepage_adjust() to call out the
new dependency on adjusting the hugepage size after walking indirect PTEs.

Reported-by: Huang Hang <hhuang@linux.alibaba.com>
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
Link: https://lore.kernel.org/r/20221213125538.81209-1-jiangshanlai@gmail.com
[sean: rework changelog after separating out the emulator change]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20230202182817.407394-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index f57d9074fb9b4560dc1a09e8ad8476a5b515e97c..a056f2773dd9014c200afdc60b354e59d8c7589d 100644 (file)
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -690,6 +690,12 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault,
                        fault->write_fault_to_shadow_pgtable = true;
        }
 
+       /*
+        * Adjust the hugepage size _after_ resolving indirect shadow pages.
+        * KVM doesn't support mapping hugepages into the guest for gfns that
+        * are being shadowed by KVM, i.e. allocating a new shadow page may
+        * affect the allowed hugepage size.
+        */
        kvm_mmu_hugepage_adjust(vcpu, fault);
 
        trace_kvm_mmu_spte_requested(fault);
@@ -734,41 +740,6 @@ out_gpte_changed:
        return RET_PF_RETRY;
 }
 
- /*
- * To see whether the mapped gfn can write its page table in the current
- * mapping.
- *
- * It is the helper function of FNAME(page_fault). When guest uses large page
- * size to map the writable gfn which is used as current page table, we should
- * force kvm to use small page size to map it because new shadow page will be
- * created when kvm establishes shadow page table that stop kvm using large
- * page size. Do it early can avoid unnecessary #PF and emulation.
- *
- * Note: the PDPT page table is not checked for PAE-32 bit guest. It is ok
- * since the PDPT is always shadowed, that means, we can not use large page
- * size to map the gfn which is used as PDPT.
- */
-static bool
-FNAME(is_self_change_mapping)(struct kvm_vcpu *vcpu,
-                             struct guest_walker *walker, bool user_fault)
-{
-       int level;
-       gfn_t mask = ~(KVM_PAGES_PER_HPAGE(walker->level) - 1);
-       bool self_changed = false;
-
-       if (!(walker->pte_access & ACC_WRITE_MASK ||
-           (!is_cr0_wp(vcpu->arch.mmu) && !user_fault)))
-               return false;
-
-       for (level = walker->level; level <= walker->max_level; level++) {
-               gfn_t gfn = walker->gfn ^ walker->table_gfn[level - 1];
-
-               self_changed |= !(gfn & mask);
-       }
-
-       return self_changed;
-}
-
 /*
  * Page fault handler.  There are several causes for a page fault:
  *   - there is no shadow pte for the guest pte
@@ -787,7 +758,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 {
        struct guest_walker walker;
        int r;
-       bool is_self_change_mapping;
 
        pgprintk("%s: addr %lx err %x\n", __func__, fault->addr, fault->error_code);
        WARN_ON_ONCE(fault->is_tdp);
@@ -812,6 +782,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
        }
 
        fault->gfn = walker.gfn;
+       fault->max_level = walker.level;
        fault->slot = kvm_vcpu_gfn_to_memslot(vcpu, fault->gfn);
 
        if (page_fault_handle_page_track(vcpu, fault)) {
@@ -823,14 +794,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
        if (r)
                return r;
 
-       is_self_change_mapping = FNAME(is_self_change_mapping)(vcpu,
-             &walker, fault->user);
-
-       if (is_self_change_mapping)
-               fault->max_level = PG_LEVEL_4K;
-       else
-               fault->max_level = walker.level;
-
        r = kvm_faultin_pfn(vcpu, fault, walker.pte_access);
        if (r != RET_PF_CONTINUE)
                return r;