> From: Sean Christopherson > Sent: Thursday, August 22, 2019 4:11 AM > [...] > > > From there I added back the gfn range test, but I left out the gfn_mask > > because I'm not doing the level filtering and I think(?) this is just > > another optimization. So essentially I only add: > > > > if (sp->gfn < slot->base_gfn || > > sp->gfn > (slot->base_gfn + slot->npages - 1)) > > continue; > > This doesn't work because of what sp->gfn contains. The shadow page is > the page/table holding the spt entries, e.g. a level 1 sp refers to a page > table for entries defining 4k pages. sp->gfn holds the base gfn of the > range of gfns covered by the sp, which allows finding all parent sps for a > given gfn. E.g. for level 1 sp, sp->gfn is found by masking the gfn of a > given page by 0xFFFFFFFFFFFFFE00, level 2 sp by 0xFFFFFFFFFFFC0000, and so > on up the chain. > > This is what the original code botched, as it would only find all sps for > a memslot if the base of the memslot were 2mb aligned for 4k pages, 1gb > aligned for 2mb pages, etc... This just happened to mostly work since > memslots are usually aligned to such requirements. In the original code, > removing the "sp->gfn != gfn" check caused KVM to zap random sps that just > happened to hash to the same entry. Likewise, omitting the gfn filter in > this code means everything gets zapped. > > What I don't understand is why zapping everything, or at least userspace > MMIO addresses, is necessary when removing the GPU BAR memslot. The > IOAPIC sp in particular makes no sense. AIUI, the IOAPIC is always > emulated, i.e. not passed through, and its base/size is static (or at > least static after init). Zapping an IOAPIC sp will send KVM down > different paths but AFAIK the final outsome should be unaffected. > I have the same feeling. the base address of IOAPIC is described by ACPI MADT thus static. It is possible to reprogram LAPIC base but no commodity OS does it today. btw I found Alex mentioned gfn 0x100000 in earlier post. This one is usually the starting of high memory. If true, it becomes even more weird, not just about MMIO thing. Thanks Kevin
