[PATCH RFC] KVM: nVMX: validate eptp pointer

[PATCH RFC] KVM: nVMX: validate eptp pointer

[David Hildenbrand]

Let's reuse the function introduced with eptp switching.

We don't explicitly have to check against enable_ept_ad_bits, as this
is implicitly done when checking against nested_vmx_ept_caps in
valid_ept_address().

Signed-off-by: David Hildenbrand <david@redhat.com>
---

Am I missing these checks at some other place?

 arch/x86/kvm/vmx.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index d97f9e4..972d205 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -9725,18 +9725,15 @@ static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu)
 
 static int nested_ept_init_mmu_context(struct kvm_vcpu *vcpu)
 {
-	bool wants_ad;
-
 	WARN_ON(mmu_is_nested(vcpu));
-	wants_ad = nested_ept_ad_enabled(vcpu);
-	if (wants_ad && !enable_ept_ad_bits)
+	if (!valid_ept_address(vcpu, nested_ept_get_cr3(vcpu)))
 		return 1;
 
 	kvm_mmu_unload(vcpu);
 	kvm_init_shadow_ept_mmu(vcpu,
 			to_vmx(vcpu)->nested.nested_vmx_ept_caps &
 			VMX_EPT_EXECUTE_ONLY_BIT,
-			wants_ad);
+			nested_ept_ad_enabled(vcpu));
 	vcpu->arch.mmu.set_cr3           = vmx_set_cr3;
 	vcpu->arch.mmu.get_cr3           = nested_ept_get_cr3;
 	vcpu->arch.mmu.inject_page_fault = nested_ept_inject_page_fault;
-- 
2.9.4

Re: [PATCH RFC] KVM: nVMX: validate eptp pointer

[Paolo Bonzini]

On 10/08/2017 23:36, David Hildenbrand wrote:
> Let's reuse the function introduced with eptp switching.
> 
> We don't explicitly have to check against enable_ept_ad_bits, as this
> is implicitly done when checking against nested_vmx_ept_caps in
> valid_ept_address().
> 
> Signed-off-by: David Hildenbrand <david@redhat.com>
> ---
> 
> Am I missing these checks at some other place?

No, there is mmu_check_root but it's not what we want here.

Paolo