KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter (04f11ef4) · Commits · 戴 / test

Write the desired L2 CR3 into vmcs02.GUEST_CR3 during nested VM-Enter instead of deferring the VMWRITE until vmx_set_cr3(). If the VMWRITE is deferred, then KVM can consume a stale vmcs02.GUEST_CR3 when it refreshes vmcs12->guest_cr3 during nested_vmx_vmexit() if the emulated VM-Exit occurs without actually entering L2, e.g. if the nested run is squashed because nested VM-Enter (from L1) is putting L2 into HLT. Note, the above scenario can occur regardless of whether L1 is intercepting HLT, e.g. L1 can intercept HLT and then re-enter L2 with vmcs.GUEST_ACTIVITY_STATE=HALTED. But practically speaking, a VMM will likely put a guest into HALTED if and only if it's not intercepting HLT. In an ideal world where EPT *requires* unrestricted guest (and vice versa), VMX could handle CR3 similar to how it handles RSP and RIP, e.g. mark CR3 dirty and conditionally load it at vmx_vcpu_run(). But the unrestricted guest silliness complicates the dirty tracking logic to the point that explicitly handling vmcs02.GUEST_CR3 during nested VM-Enter is a simpler overall implementation. Cc: stable@vger.kernel.org Reported-and-tested-by:

Reto Buerki <reet@codelabs.ch> Tested-by:

Vitaly Kuznetsov <vkuznets@redhat.com> Reviewed-by:

Liran Alon <liran.alon@oracle.com> Signed-off-by:

Sean Christopherson <sean.j.christopherson@intel.com> Reviewed-by:

Jim Mattson <jmattson@google.com> Signed-off-by:

Paolo Bonzini <pbonzini@redhat.com>

arch/x86/kvm/vmx/nested.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -2418,6 +2418,16 @@ static int prepare_vmcs02(struct kvm_vcpu vcpu, struct vmcs12 vmcs12,
		entry_failure_code))
		return -EINVAL;

		/*
		* Immediately write vmcs02.GUEST_CR3. It will be propagated to vmcs12
		* on nested VM-Exit, which can occur without actually running L2 and
		* thus without hitting vmx_set_cr3(), e.g. if L1 is entering L2 with
		* vmcs12.GUEST_ACTIVITYSTATE=HLT, in which case KVM will intercept the
		* transition to HLT instead of running L2.
		*/
		if (enable_ept)
		vmcs_writel(GUEST_CR3, vmcs12->guest_cr3);

		/* Late preparation of GUEST_PDPTRs now that EFER and CRs are set. */
		if (load_guest_pdptrs_vmcs12 && nested_cpu_has_ept(vmcs12) &&
		is_pae_paging(vcpu)) {

arch/x86/kvm/vmx/vmx.c

+7 −3

Original line number	Diff line number	Diff line
		@@ -2989,6 +2989,7 @@ u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa)
		void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
		{
		struct kvm *kvm = vcpu->kvm;
		bool update_guest_cr3 = true;
		unsigned long guest_cr3;
		u64 eptp;

		@@ -3005,14 +3006,17 @@ void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
		spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
		}

		if (enable_unrestricted_guest \|\| is_paging(vcpu) \|\|
		is_guest_mode(vcpu))
		/* Loading vmcs02.GUEST_CR3 is handled by nested VM-Enter. */
		if (is_guest_mode(vcpu))
		update_guest_cr3 = false;
		else if (enable_unrestricted_guest \|\| is_paging(vcpu))
		guest_cr3 = kvm_read_cr3(vcpu);
		else
		guest_cr3 = to_kvm_vmx(kvm)->ept_identity_map_addr;
		ept_load_pdptrs(vcpu);
		}

		if (update_guest_cr3)
		vmcs_writel(GUEST_CR3, guest_cr3);
		}

Admin message