From patchwork Sat Dec 28 15:31:52 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 3414021 Return-Path: X-Original-To: patchwork-kvm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id B33EFC02DC for ; Sat, 28 Dec 2013 15:32:01 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id DCF3E2012B for ; Sat, 28 Dec 2013 15:32:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1A64320127 for ; Sat, 28 Dec 2013 15:32:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755293Ab3L1Pb4 (ORCPT ); Sat, 28 Dec 2013 10:31:56 -0500 Received: from mout.web.de ([212.227.15.4]:51672 "EHLO mout.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754677Ab3L1Pb4 (ORCPT ); Sat, 28 Dec 2013 10:31:56 -0500 Received: from mchn199C.mchp.siemens.de ([178.11.213.8]) by smtp.web.de (mrweb101) with ESMTPSA (Nemesis) id 0M8zFx-1Vl3tH0wLl-00CSpN for ; Sat, 28 Dec 2013 16:31:54 +0100 Message-ID: <52BEEEE8.7080506@web.de> Date: Sat, 28 Dec 2013 16:31:52 +0100 From: Jan Kiszka User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.8.1.12) Gecko/20080226 SUSE/2.0.0.12-1.1 Thunderbird/2.0.0.12 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: Paolo Bonzini , Gleb Natapov CC: kvm Subject: [PATCH] KVM: nVMX: Unconditionally uninit the MMU on nested vmexit X-Enigmail-Version: 1.6 X-Provags-ID: V03:K0:H8UEyzIQL3FR+KHR9QaFv+cOAmUex5MogpUyVm1rZ0bXYbt5C5p 7q5/RWB/a1M0X7LBpxBc+BFQk1tqAXYvT3dDT3BQ3FCb8eDZj0jmSTPjWQ6RM8l7NgZrJKL BnlqoLk5Zimw93pu4OMcSYyttH25VZE1WRLoXOm74PrQglO+T7EjkUZ8ZqNL5lwzmsEhptX h3xLaEx5u4ljhkWg+42dg== Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Three reasons for doing this: 1. arch.walk_mmu points to arch.mmu anyway in case nested EPT wasn't in use. 2. this aligns VMX with SVM. But 3. is most important: nested_cpu_has_ept(vmcs12) queries the VMCS page, and if one guest VCPU manipulates the page of another VCPU in L2, we may be fooled to skip over the nested_ept_uninit_mmu_context, leaving mmu in nested state. That can crash the host later on if nested_ept_get_cr3 is invoked while L1 already left vmxon and nested.current_vmcs12 became NULL therefore. Signed-off-by: Jan Kiszka --- arch/x86/kvm/vmx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 1d9b0ec..48d0b46 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -8366,8 +8366,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK); kvm_set_cr4(vcpu, vmcs12->host_cr4); - if (nested_cpu_has_ept(vmcs12)) - nested_ept_uninit_mmu_context(vcpu); + nested_ept_uninit_mmu_context(vcpu); kvm_set_cr3(vcpu, vmcs12->host_cr3); kvm_mmu_reset_context(vcpu);