[PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Lan Tianyu]

These CR3 VMEXITs was introduced for platform without "unrestricted guest"
support. This is to set ept identity table to guest CR3 in guest real
mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
must be set to 1). But these VMEXITs is redundant for platforms with
"unrestricted guest" support.

Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
---
 arch/x86/kvm/vmx.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 9b21b12..46dcf50 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
 		vmx_decache_cr3(vcpu);
 	if (!(cr0 & X86_CR0_PG)) {
 		/* From paging/starting to nonpaging */
-		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
-			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
-			     (CPU_BASED_CR3_LOAD_EXITING |
-			      CPU_BASED_CR3_STORE_EXITING));
+		if (!enable_unrestricted_guest)
+			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
+				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
+				     (CPU_BASED_CR3_LOAD_EXITING |
+				      CPU_BASED_CR3_STORE_EXITING));
 		vcpu->arch.cr0 = cr0;
 		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
 	} else if (!is_paging(vcpu)) {
 		/* From nonpaging to paging */
-		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
-			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
-			     ~(CPU_BASED_CR3_LOAD_EXITING |
-			       CPU_BASED_CR3_STORE_EXITING));
+		if (!enable_unrestricted_guest)
+			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
+				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
+				     ~(CPU_BASED_CR3_LOAD_EXITING |
+				       CPU_BASED_CR3_STORE_EXITING));
 		vcpu->arch.cr0 = cr0;
 		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
 	}
@@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 	}
 
 	vmx_flush_tlb(vcpu);
-	vmcs_writel(GUEST_CR3, guest_cr3);
+
+	if (!enable_unrestricted_guest || !enable_ept)
+		vmcs_writel(GUEST_CR3, guest_cr3);
 }
 
 static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
-- 
1.8.3.1

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Paolo Bonzini]

On 16/08/2017 03:58, Lan Tianyu wrote:
> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
> support. This is to set ept identity table to guest CR3 in guest real
> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
> must be set to 1). But these VMEXITs is redundant for platforms with
> "unrestricted guest" support.

This is true, but I'm not sure it's a good idea to make things more
complex...  It is working code and is not a bottleneck anywhere.

Paolo

> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
> ---
>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
>  1 file changed, 13 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 9b21b12..46dcf50 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
>  		vmx_decache_cr3(vcpu);
>  	if (!(cr0 & X86_CR0_PG)) {
>  		/* From paging/starting to nonpaging */
> -		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
> -			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
> -			     (CPU_BASED_CR3_LOAD_EXITING |
> -			      CPU_BASED_CR3_STORE_EXITING));
> +		if (!enable_unrestricted_guest)
> +			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
> +				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
> +				     (CPU_BASED_CR3_LOAD_EXITING |
> +				      CPU_BASED_CR3_STORE_EXITING));
>  		vcpu->arch.cr0 = cr0;
>  		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>  	} else if (!is_paging(vcpu)) {
>  		/* From nonpaging to paging */
> -		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
> -			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
> -			     ~(CPU_BASED_CR3_LOAD_EXITING |
> -			       CPU_BASED_CR3_STORE_EXITING));
> +		if (!enable_unrestricted_guest)
> +			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
> +				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
> +				     ~(CPU_BASED_CR3_LOAD_EXITING |
> +				       CPU_BASED_CR3_STORE_EXITING));
>  		vcpu->arch.cr0 = cr0;
>  		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>  	}
> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>  	}
>  
>  	vmx_flush_tlb(vcpu);
> -	vmcs_writel(GUEST_CR3, guest_cr3);
> +
> +	if (!enable_unrestricted_guest || !enable_ept)
> +		vmcs_writel(GUEST_CR3, guest_cr3);
>  }
>  
>  static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
> 

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Lan Tianyu]

On 2017年08月16日 17:25, Paolo Bonzini wrote:
> On 16/08/2017 03:58, Lan Tianyu wrote:
>> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
>> support. This is to set ept identity table to guest CR3 in guest real
>> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
>> must be set to 1). But these VMEXITs is redundant for platforms with
>> "unrestricted guest" support.
> 
> This is true, but I'm not sure it's a good idea to make things more
> complex...  It is working code and is not a bottleneck anywhere.

Yes, this is just code clear up and will not affect function.
I thought this change was missed when introduced unrestricted guest support.

-- 
Best regards
Tianyu Lan
> 
> Paolo
> 
>> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
>> ---
>>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
>>  1 file changed, 13 insertions(+), 9 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> index 9b21b12..46dcf50 100644
>> --- a/arch/x86/kvm/vmx.c
>> +++ b/arch/x86/kvm/vmx.c
>> @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
>>  		vmx_decache_cr3(vcpu);
>>  	if (!(cr0 & X86_CR0_PG)) {
>>  		/* From paging/starting to nonpaging */
>> -		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> -			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
>> -			     (CPU_BASED_CR3_LOAD_EXITING |
>> -			      CPU_BASED_CR3_STORE_EXITING));
>> +		if (!enable_unrestricted_guest)
>> +			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> +				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
>> +				     (CPU_BASED_CR3_LOAD_EXITING |
>> +				      CPU_BASED_CR3_STORE_EXITING));
>>  		vcpu->arch.cr0 = cr0;
>>  		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>>  	} else if (!is_paging(vcpu)) {
>>  		/* From nonpaging to paging */
>> -		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> -			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
>> -			     ~(CPU_BASED_CR3_LOAD_EXITING |
>> -			       CPU_BASED_CR3_STORE_EXITING));
>> +		if (!enable_unrestricted_guest)
>> +			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> +				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
>> +				     ~(CPU_BASED_CR3_LOAD_EXITING |
>> +				       CPU_BASED_CR3_STORE_EXITING));
>>  		vcpu->arch.cr0 = cr0;
>>  		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>>  	}
>> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>>  	}
>>  
>>  	vmx_flush_tlb(vcpu);
>> -	vmcs_writel(GUEST_CR3, guest_cr3);
>> +
>> +	if (!enable_unrestricted_guest || !enable_ept)
>> +		vmcs_writel(GUEST_CR3, guest_cr3);
>>  }
>>  
>>  static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
>>
> 

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Wanpeng Li]

2017-08-16 17:25 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>:
> On 16/08/2017 03:58, Lan Tianyu wrote:
>> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
>> support. This is to set ept identity table to guest CR3 in guest real
>> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
>> must be set to 1). But these VMEXITs is redundant for platforms with
>> "unrestricted guest" support.
>
> This is true, but I'm not sure it's a good idea to make things more
> complex...  It is working code and is not a bottleneck anywhere.

Sorry, I have another question. There is no A20 emulation in kvm
currently, then whether or not the vm8086 which is emulated by kvm can
guarantee real mode guest which access occurs at 1 MByte will incur
address-wraparound?

Regards,
Wanpeng Li

>
> Paolo
>
>> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
>> ---
>>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
>>  1 file changed, 13 insertions(+), 9 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> index 9b21b12..46dcf50 100644
>> --- a/arch/x86/kvm/vmx.c
>> +++ b/arch/x86/kvm/vmx.c
>> @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
>>               vmx_decache_cr3(vcpu);
>>       if (!(cr0 & X86_CR0_PG)) {
>>               /* From paging/starting to nonpaging */
>> -             vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> -                          vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
>> -                          (CPU_BASED_CR3_LOAD_EXITING |
>> -                           CPU_BASED_CR3_STORE_EXITING));
>> +             if (!enable_unrestricted_guest)
>> +                     vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> +                                  vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
>> +                                  (CPU_BASED_CR3_LOAD_EXITING |
>> +                                   CPU_BASED_CR3_STORE_EXITING));
>>               vcpu->arch.cr0 = cr0;
>>               vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>>       } else if (!is_paging(vcpu)) {
>>               /* From nonpaging to paging */
>> -             vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> -                          vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
>> -                          ~(CPU_BASED_CR3_LOAD_EXITING |
>> -                            CPU_BASED_CR3_STORE_EXITING));
>> +             if (!enable_unrestricted_guest)
>> +                     vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>> +                                  vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
>> +                                  ~(CPU_BASED_CR3_LOAD_EXITING |
>> +                                    CPU_BASED_CR3_STORE_EXITING));
>>               vcpu->arch.cr0 = cr0;
>>               vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>>       }
>> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>>       }
>>
>>       vmx_flush_tlb(vcpu);
>> -     vmcs_writel(GUEST_CR3, guest_cr3);
>> +
>> +     if (!enable_unrestricted_guest || !enable_ept)
>> +             vmcs_writel(GUEST_CR3, guest_cr3);
>>  }
>>
>>  static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
>>
>

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Wanpeng Li]

Cc Nadav,
2017-08-17 13:58 GMT+08:00 Wanpeng Li <kernellwp@gmail.com>:
> 2017-08-16 17:25 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>:
>> On 16/08/2017 03:58, Lan Tianyu wrote:
>>> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
>>> support. This is to set ept identity table to guest CR3 in guest real
>>> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
>>> must be set to 1). But these VMEXITs is redundant for platforms with
>>> "unrestricted guest" support.
>>
>> This is true, but I'm not sure it's a good idea to make things more
>> complex...  It is working code and is not a bottleneck anywhere.
>
> Sorry, I have another question. There is no A20 emulation in kvm
> currently, then whether or not the vm8086 which is emulated by kvm can
> guarantee real mode guest which access occurs at 1 MByte will incur
> address-wraparound?
>
> Regards,
> Wanpeng Li
>
>>
>> Paolo
>>
>>> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
>>> ---
>>>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
>>>  1 file changed, 13 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>>> index 9b21b12..46dcf50 100644
>>> --- a/arch/x86/kvm/vmx.c
>>> +++ b/arch/x86/kvm/vmx.c
>>> @@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
>>>               vmx_decache_cr3(vcpu);
>>>       if (!(cr0 & X86_CR0_PG)) {
>>>               /* From paging/starting to nonpaging */
>>> -             vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>>> -                          vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
>>> -                          (CPU_BASED_CR3_LOAD_EXITING |
>>> -                           CPU_BASED_CR3_STORE_EXITING));
>>> +             if (!enable_unrestricted_guest)
>>> +                     vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>>> +                                  vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
>>> +                                  (CPU_BASED_CR3_LOAD_EXITING |
>>> +                                   CPU_BASED_CR3_STORE_EXITING));
>>>               vcpu->arch.cr0 = cr0;
>>>               vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>>>       } else if (!is_paging(vcpu)) {
>>>               /* From nonpaging to paging */
>>> -             vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>>> -                          vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
>>> -                          ~(CPU_BASED_CR3_LOAD_EXITING |
>>> -                            CPU_BASED_CR3_STORE_EXITING));
>>> +             if (!enable_unrestricted_guest)
>>> +                     vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
>>> +                                  vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
>>> +                                  ~(CPU_BASED_CR3_LOAD_EXITING |
>>> +                                    CPU_BASED_CR3_STORE_EXITING));
>>>               vcpu->arch.cr0 = cr0;
>>>               vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
>>>       }
>>> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>>>       }
>>>
>>>       vmx_flush_tlb(vcpu);
>>> -     vmcs_writel(GUEST_CR3, guest_cr3);
>>> +
>>> +     if (!enable_unrestricted_guest || !enable_ept)
>>> +             vmcs_writel(GUEST_CR3, guest_cr3);
>>>  }
>>>
>>>  static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
>>>
>>

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Radim Krčmář]

2017-08-15 21:58-0400, Lan Tianyu:
> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
> support. This is to set ept identity table to guest CR3 in guest real
> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
> must be set to 1). But these VMEXITs is redundant for platforms with
> "unrestricted guest" support.
> 
> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
> ---
>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
>  1 file changed, 13 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>  	}
>  
>  	vmx_flush_tlb(vcpu);
> -	vmcs_writel(GUEST_CR3, guest_cr3);
> +
> +	if (!enable_unrestricted_guest || !enable_ept)
> +		vmcs_writel(GUEST_CR3, guest_cr3);

This looks wrong -- it would prevent update GUEST_CR3 outside of
non-root mode with enable_unrestricted_guest.

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Lan Tianyu]

On 2017年08月16日 21:26, Radim Krčmář wrote:
> 2017-08-15 21:58-0400, Lan Tianyu:
>> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
>> support. This is to set ept identity table to guest CR3 in guest real
>> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
>> must be set to 1). But these VMEXITs is redundant for platforms with
>> "unrestricted guest" support.
>>
>> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
>> ---
>>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
>>  1 file changed, 13 insertions(+), 9 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>>  	}
>>  
>>  	vmx_flush_tlb(vcpu);
>> -	vmcs_writel(GUEST_CR3, guest_cr3);
>> +
>> +	if (!enable_unrestricted_guest || !enable_ept)
>> +		vmcs_writel(GUEST_CR3, guest_cr3);
> 
> This looks wrong -- it would prevent update GUEST_CR3 outside of
> non-root mode with enable_unrestricted_guest.
> 

OK. Do you mean nest mode? I didn't consider that case.
I thought there were three cases here.

1) Shadow page mode(enable_ept=0)

2) ept mode without unrestricted guest mode
   (ept=1, enable_unrestricted_guest = 0)

3) ept mode with unrestricted guest mode
   (ept=1, enable_unrestricted_guest = 1)

>From my understanding, only (1) and (2) need to update guest cr3.
If nest mode is still needed to update guest CR3, we can add
is_guest_mode() in the if condition. Other choice is to just ignore
setting guest cr3 for case3. The condition maybe changed to

if (!(enable_unrestricted_guest && enable_ept))
	vmcs_writel(GUEST_CR3, guest_cr3);





-- 
Best regards
Tianyu Lan

Re: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

[Radim Krčmář]

2017-08-17 13:00+0800, Lan Tianyu:
> On 2017年08月16日 21:26, Radim Krčmář wrote:
> > 2017-08-15 21:58-0400, Lan Tianyu:
> >> These CR3 VMEXITs was introduced for platform without "unrestricted guest"
> >> support. This is to set ept identity table to guest CR3 in guest real
> >> mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
> >> must be set to 1). But these VMEXITs is redundant for platforms with
> >> "unrestricted guest" support.
> >>
> >> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
> >> ---
> >>  arch/x86/kvm/vmx.c | 22 +++++++++++++---------
> >>  1 file changed, 13 insertions(+), 9 deletions(-)
> >>
> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> >> @@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
> >>  	}
> >>  
> >>  	vmx_flush_tlb(vcpu);
> >> -	vmcs_writel(GUEST_CR3, guest_cr3);
> >> +
> >> +	if (!enable_unrestricted_guest || !enable_ept)
> >> +		vmcs_writel(GUEST_CR3, guest_cr3);
> > 
> > This looks wrong -- it would prevent update GUEST_CR3 outside of
> > non-root mode with enable_unrestricted_guest.
> > 
> 
> OK. Do you mean nest mode? I didn't consider that case.
> I thought there were three cases here.
> 
> 1) Shadow page mode(enable_ept=0)
> 
> 2) ept mode without unrestricted guest mode
>    (ept=1, enable_unrestricted_guest = 0)
> 
> 3) ept mode with unrestricted guest mode
>    (ept=1, enable_unrestricted_guest = 1)
> 
> From my understanding, only (1) and (2) need to update guest cr3.
> If nest mode is still needed to update guest CR3, we can add
> is_guest_mode() in the if condition. Other choice is to just ignore
> setting guest cr3 for case3. The condition maybe changed to

That too, but I was thinking about a more common (3) with enabled
paging, where GUEST_CR3 should reflect what the guest wants there.
Consider a case where the userspace changed CR3 (e.g. after migration),
how would it get propagated to the guest?

> if (!(enable_unrestricted_guest && enable_ept))
> 	vmcs_writel(GUEST_CR3, guest_cr3);

It is the same. :)

I would think that checking the condition is about as fast as doing the
vmcs write, so we don't need to complicate the code.