Re: [PATCH v2 5/8] KVM: nVMX: Fix guest CR3 read-back on VM-exit

[Gleb Natapov <gleb@redhat.com>]

On Tue, Aug 06, 2013 at 02:12:51PM +0000, Zhang, Yang Z wrote:
> Gleb Natapov wrote on 2013-08-06:
> > On Tue, Aug 06, 2013 at 11:44:41AM +0000, Zhang, Yang Z wrote:
> >> Gleb Natapov wrote on 2013-08-06:
> >>> On Tue, Aug 06, 2013 at 10:39:59AM +0200, Jan Kiszka wrote:
> >>>> From: Jan Kiszka <jan.kiszka@siemens.com>
> >>>> 
> >>>> If nested EPT is enabled, the L2 guest may change CR3 without any exits.
> >>>> We therefore have to read the current value from the VMCS when
> >>>> switching to L1. However, if paging wasn't enabled, L0 tracks
> >>>> L2's CR3, and
> >>>> GUEST_CR3 rather contains the real-mode identity map. So we need
> >>>> to retrieve CR3 from the architectural state after conditionally
> >>>> updating it - and this is what kvm_read_cr3 does.
> >>>> 
> >>> I have a headache from trying to think about it already, but
> >>> shouldn't
> >>> L1 be the one who setups identity map for L2? I traced what
> >>> vmcs_read64(GUEST_CR3)/kvm_read_cr3(vcpu) return here and do not
> >>> see
> >> Here is my understanding:
> >> In vmx_set_cr3(), if enabled ept, it will check whether target vcpu
> >> is enabling
> > paging. When L2 running in real mode, then target vcpu is not enabling
> > paging and it will use L0's identity map for L2. If you read GUEST_CR3
> > from VMCS, then you may get the L2's identity map not L1's.
> >> 
> > Yes, but why it makes sense to use L0 identity map for L2? I didn't see
> > different vmcs_read64(GUEST_CR3)/kvm_read_cr3(vcpu) values because L0
> > and L1 use the same identity map address. When I changed identity
> > address L1 configures vmcs_read64(GUEST_CR3)/kvm_read_cr3(vcpu) are
> > indeed different, but the real CR3 L2 uses points to L0 identity map. If
> > I zero L1 identity map page L2 still works.
> >
> If L2 in real mode, then L2PA == L1PA. So L0's identity map also works if L2 is in real mode.
> 
That not the point. It may work accidentally for kvm on kvm, but what
if other hypervisor plays different tricks and builds different ident map
for its guest?
 
--
			Gleb.