* [PATCH] KVM: nVMX: fix nested EPT detection
@ 2017-03-22 17:09 Ladi Prosek
2017-03-22 17:42 ` Radim Krčmář
0 siblings, 1 reply; 3+ messages in thread
From: Ladi Prosek @ 2017-03-22 17:09 UTC (permalink / raw)
To: kvm; +Cc: pbonzini, rkrcmar, wanpeng.li
The nested_ept_enabled flag introduced in commit 7ca29de2136 was not
computed correctly. We are interested only in L1's EPT state, not the
the combined L0+L1 value.
In particular, if L0 uses EPT but L1 does not, nested_ept_enabled must
be false to make sure that PDPSTRs are loaded based on CR3 as usual,
because the special case described in 26.3.2.4 Loading Page-Directory-
Pointer-Table Entries does not apply.
Reported-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
---
arch/x86/kvm/vmx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 98e82ee..a525c72 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10105,8 +10105,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
SECONDARY_EXEC_APIC_REGISTER_VIRT);
if (nested_cpu_has(vmcs12,
- CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))
+ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)) {
exec_control |= vmcs12->secondary_vm_exec_control;
+ nested_ept_enabled = (vmcs12->secondary_vm_exec_control &
+ SECONDARY_EXEC_ENABLE_EPT) != 0;
+ }
if (exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) {
vmcs_write64(EOI_EXIT_BITMAP0,
@@ -10121,8 +10124,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
vmcs12->guest_intr_status);
}
- nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
-
/*
* Write an illegal value to APIC_ACCESS_ADDR. Later,
* nested_get_vmcs12_pages will either fix it up or
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: nVMX: fix nested EPT detection
2017-03-22 17:09 [PATCH] KVM: nVMX: fix nested EPT detection Ladi Prosek
@ 2017-03-22 17:42 ` Radim Krčmář
2017-03-22 20:45 ` Ladi Prosek
0 siblings, 1 reply; 3+ messages in thread
From: Radim Krčmář @ 2017-03-22 17:42 UTC (permalink / raw)
To: Ladi Prosek; +Cc: kvm, pbonzini, wanpeng.li
2017-03-22 18:09+0100, Ladi Prosek:
> The nested_ept_enabled flag introduced in commit 7ca29de2136 was not
> computed correctly. We are interested only in L1's EPT state, not the
> the combined L0+L1 value.
>
> In particular, if L0 uses EPT but L1 does not, nested_ept_enabled must
> be false to make sure that PDPSTRs are loaded based on CR3 as usual,
> because the special case described in 26.3.2.4 Loading Page-Directory-
> Pointer-Table Entries does not apply.
>
> Reported-by: Wanpeng Li <wanpeng.li@hotmail.com>
> Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Adding a standardized "Fixes:" tag even if you mention the commit in
text allows simpler automated backports to stable kernels,
Fixes: 7ca29de21362 ("KVM: nVMX: fix CR3 load if L2 uses PAE paging and EPT")
> ---
> arch/x86/kvm/vmx.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 98e82ee..a525c72 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -10105,8 +10105,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
> SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
> SECONDARY_EXEC_APIC_REGISTER_VIRT);
> if (nested_cpu_has(vmcs12,
> - CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))
> + CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)) {
> exec_control |= vmcs12->secondary_vm_exec_control;
> + nested_ept_enabled = (vmcs12->secondary_vm_exec_control &
> + SECONDARY_EXEC_ENABLE_EPT) != 0;
I'd prefer to get rid of nested_ept_enabled and directly call
'nested_cpu_has_ept(vmcs12)' instead, like the other place in
prepare_vmcs02() that asks whether we have nested ept.
The change looks correct,
Reviewed-by: Radim Krčmář <rkrcmar@redhat.com>
Thanks.
> + }
>
> if (exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) {
> vmcs_write64(EOI_EXIT_BITMAP0,
> @@ -10121,8 +10124,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
> vmcs12->guest_intr_status);
> }
>
> - nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
> -
> /*
> * Write an illegal value to APIC_ACCESS_ADDR. Later,
> * nested_get_vmcs12_pages will either fix it up or
> --
> 2.7.4
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] KVM: nVMX: fix nested EPT detection
2017-03-22 17:42 ` Radim Krčmář
@ 2017-03-22 20:45 ` Ladi Prosek
0 siblings, 0 replies; 3+ messages in thread
From: Ladi Prosek @ 2017-03-22 20:45 UTC (permalink / raw)
To: Radim Krčmář; +Cc: KVM list, Paolo Bonzini, Wanpeng Li
On Wed, Mar 22, 2017 at 6:42 PM, Radim Krčmář <rkrcmar@redhat.com> wrote:
> 2017-03-22 18:09+0100, Ladi Prosek:
>> The nested_ept_enabled flag introduced in commit 7ca29de2136 was not
>> computed correctly. We are interested only in L1's EPT state, not the
>> the combined L0+L1 value.
>>
>> In particular, if L0 uses EPT but L1 does not, nested_ept_enabled must
>> be false to make sure that PDPSTRs are loaded based on CR3 as usual,
>> because the special case described in 26.3.2.4 Loading Page-Directory-
>> Pointer-Table Entries does not apply.
>>
>> Reported-by: Wanpeng Li <wanpeng.li@hotmail.com>
>> Signed-off-by: Ladi Prosek <lprosek@redhat.com>
>
> Adding a standardized "Fixes:" tag even if you mention the commit in
> text allows simpler automated backports to stable kernels,
>
> Fixes: 7ca29de21362 ("KVM: nVMX: fix CR3 load if L2 uses PAE paging and EPT")
>
>> ---
>> arch/x86/kvm/vmx.c | 7 ++++---
>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> index 98e82ee..a525c72 100644
>> --- a/arch/x86/kvm/vmx.c
>> +++ b/arch/x86/kvm/vmx.c
>> @@ -10105,8 +10105,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>> SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
>> SECONDARY_EXEC_APIC_REGISTER_VIRT);
>> if (nested_cpu_has(vmcs12,
>> - CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))
>> + CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)) {
>> exec_control |= vmcs12->secondary_vm_exec_control;
>> + nested_ept_enabled = (vmcs12->secondary_vm_exec_control &
>> + SECONDARY_EXEC_ENABLE_EPT) != 0;
>
> I'd prefer to get rid of nested_ept_enabled and directly call
> 'nested_cpu_has_ept(vmcs12)' instead, like the other place in
> prepare_vmcs02() that asks whether we have nested ept.
Oops, I completely missed that. I'll send a v2, thanks!
> The change looks correct,
>
> Reviewed-by: Radim Krčmář <rkrcmar@redhat.com>
>
> Thanks.
>
>> + }
>>
>> if (exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) {
>> vmcs_write64(EOI_EXIT_BITMAP0,
>> @@ -10121,8 +10124,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>> vmcs12->guest_intr_status);
>> }
>>
>> - nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
>> -
>> /*
>> * Write an illegal value to APIC_ACCESS_ADDR. Later,
>> * nested_get_vmcs12_pages will either fix it up or
>> --
>> 2.7.4
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-22 20:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-22 17:09 [PATCH] KVM: nVMX: fix nested EPT detection Ladi Prosek
2017-03-22 17:42 ` Radim Krčmář
2017-03-22 20:45 ` Ladi Prosek
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.