Detect if 5-level paging is actually enabled on the host.

The CPUID can indicate support for 5-level paging (57 virtual address bits),
 but the kernel might not have it enabled. This change adds a check using
`mmap` to see if addresses above 2^48 are usable. If not,
`VirtualAddressBits` is capped at 48, even if CPUID suggests 57.

Fixes #12308

PiperOrigin-RevId: 832518109

Author: tranji-cloud

pkg/cpuid/BUILD

@@ -22,8 +22,11 @@ go_library(
     ],
     visibility = ["//:sandbox"],
     deps = [
+        "//pkg/hostarch",
+        "//pkg/hostsyscall",
         "//pkg/log",
         "//pkg/sync",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
 

pkg/cpuid/native_amd64.go

@@ -23,6 +23,9 @@ import (
 	"os"
 	"strconv"
 
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/log"
 )
 
@@ -192,6 +195,9 @@ func HostFeatureSet() FeatureSet {
 var (
 	// cpuFreqMHz is the native CPU frequency.
 	cpuFreqMHz float64
+
+	// IsFiveLevelPagingEnabled is true if 5-level paging is enabled on the host.
+	IsFiveLevelPagingEnabled bool
 )
 
 // Reads max cpu frequency from host /proc/cpuinfo. Must run before syscall
@@ -241,6 +247,20 @@ func readMaxCPUFreq() {
 // xgetbv reads an extended control register.
 func xgetbv(reg uintptr) uint64
 
+// fiveLevelPagingEnabled checks if 5-level paging is enabled on the host.
+func fiveLevelPagingEnabled() bool {
+	addr := uintptr(1 << 48)
+	p, errno := hostsyscall.RawSyscall6(unix.SYS_MMAP,
+		addr, hostarch.PageSize, unix.PROT_NONE, unix.MAP_PRIVATE|unix.MAP_ANONYMOUS|unix.MAP_FIXED, 0, 0)
+	if errno != 0 {
+		log.Infof("5-level paging is not enabled: Failed to mmap a page size %d at 0x%x: %v", hostarch.PageSize, addr, errno)
+		return false
+	} else {
+		hostsyscall.RawSyscall(unix.SYS_MUNMAP, p, hostarch.PageSize, 0)
+	}
+	return true
+}
+
 // archInitialize initializes hostFeatureSet.
 func archInitialize() {
 	hostFeatureSet = FeatureSet{
@@ -249,4 +269,5 @@ func archInitialize() {
 
 	readMaxCPUFreq()
 	initHWCap()
+	IsFiveLevelPagingEnabled = fiveLevelPagingEnabled()
 }

pkg/ring0/kernel_amd64.go

@@ -205,7 +205,7 @@ func (c *CPU) CR4() uint64 {
 	if hasUMIP {
 		cr4 |= _CR4_UMIP
 	}
-	if hasLA57 {
+	if hasLA57 && cpuid.IsFiveLevelPagingEnabled {
 		cr4 |= _CR4_LA57
 	}
 	return cr4
@@ -222,6 +222,9 @@ func (c *CPU) EFER() uint64 {
 //
 //go:nosplit
 func IsCanonical(addr uint64) bool {
+	if hasLA57 && cpuid.IsFiveLevelPagingEnabled {
+		return addr <= 0x00ffffffffffffff || addr >= 0xff00000000000000
+	}
 	return addr <= 0x00007fffffffffff || addr >= 0xffff800000000000
 }
 

pkg/ring0/lib_amd64.go

@@ -100,7 +100,11 @@ var (
 // another time with a  different FeatureSet.
 func Init(fs cpuid.FeatureSet) {
 	// Initialize all sizes.
-	VirtualAddressBits = uintptr(fs.VirtualAddressBits())
+	if fs.VirtualAddressBits() > 48 && !cpuid.IsFiveLevelPagingEnabled {
+		VirtualAddressBits = 48
+	} else {
+		VirtualAddressBits = uintptr(fs.VirtualAddressBits())
+	}
 	if PhysicalAddressBits == 0 {
 		PhysicalAddressBits = uintptr(fs.PhysicalAddressBits())
 	}

pkg/ring0/pagetables/pagetables_amd64.go

@@ -54,7 +54,7 @@ const (
 //go:nosplit
 func (p *PageTables) InitArch(allocator Allocator) {
 	featureSet := cpuid.HostFeatureSet()
-	if featureSet.HasFeature(cpuid.X86FeatureLA57) {
+	if featureSet.HasFeature(cpuid.X86FeatureLA57) && cpuid.IsFiveLevelPagingEnabled {
 		p.largeAddressesEnabled = true
 		lowerTop = 0x00FFFFFFFFFFFFFF
 		upperBottom = 0xFF00000000000000

pkg/ring0/pagetables/pagetables_amd64_test.go

@@ -31,7 +31,7 @@ var (
 
 func getLargeAddressesEnabled() bool {
 	featureSet := cpuid.HostFeatureSet()
-	return featureSet.HasFeature(cpuid.X86FeatureLA57)
+	return featureSet.HasFeature(cpuid.X86FeatureLA57) && cpuid.IsFiveLevelPagingEnabled
 }
 
 func getLowerTopAligned() uintptr {

pkg/tcpip/BUILD

@@ -72,6 +72,8 @@ deps_test(
         "//pkg/buffer",
         "//pkg/cpuid",
         "//pkg/gohacks",
+        "//pkg/hostarch",
+        "//pkg/hostsyscall",
         "//pkg/goid",
         "//pkg/ilist",
         "//pkg/linewriter",