From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Tosatti Subject: Re: [PATCH] KVM: nVMX: Unconditionally uninit the MMU on nested vmexit Date: Thu, 2 Jan 2014 11:22:46 -0200 Message-ID: <20140102132246.GA7080@amt.cnet> References: <52BEEEE8.7080506@web.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Paolo Bonzini , Gleb Natapov , kvm To: Jan Kiszka Return-path: Received: from mx1.redhat.com ([209.132.183.28]:28557 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750740AbaABNmq (ORCPT ); Thu, 2 Jan 2014 08:42:46 -0500 Content-Disposition: inline In-Reply-To: <52BEEEE8.7080506@web.de> Sender: kvm-owner@vger.kernel.org List-ID: On Sat, Dec 28, 2013 at 04:31:52PM +0100, Jan Kiszka wrote: > Three reasons for doing this: 1. arch.walk_mmu points to arch.mmu anyway > in case nested EPT wasn't in use. 2. this aligns VMX with SVM. But 3. is > most important: nested_cpu_has_ept(vmcs12) queries the VMCS page, and if > one guest VCPU manipulates the page of another VCPU in L2, we may be > fooled to skip over the nested_ept_uninit_mmu_context, leaving mmu in > nested state. That can crash the host later on if nested_ept_get_cr3 is > invoked while L1 already left vmxon and nested.current_vmcs12 became > NULL therefore. > > Signed-off-by: Jan Kiszka > --- > arch/x86/kvm/vmx.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index 1d9b0ec..48d0b46 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -8366,8 +8366,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, > vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK); > kvm_set_cr4(vcpu, vmcs12->host_cr4); > > - if (nested_cpu_has_ept(vmcs12)) > - nested_ept_uninit_mmu_context(vcpu); > + nested_ept_uninit_mmu_context(vcpu); > > kvm_set_cr3(vcpu, vmcs12->host_cr3); > kvm_mmu_reset_context(vcpu); > -- Applied to master branch, thanks.