[v2,0/2] VMX: nested migration fixes for 32 bit nested guests

Message

Maxim Levitsky Nov. 15, 2021, 1:18 p.m. UTC

This is hopefully the last issue I was tracking in regard to nested migration,
as far as I know.

The issue is that migration of L1 which is normal 64 bit guest,
but is running a 32 bit nested guest is broken on VMX and I finally found out why.

There are two bugs, both related to the fact that qemu first restores SREGS
of L2, and only then sets the nested state. That haunts us till this day.

First issue is that vmx_set_nested_state does some checks on the host
state stored in vmcs12, but it uses the current IA32_EFER which is from L2.
Thus, consistency checks fail.

Second issue (happens on both VMX and SVM with npt/ept enabled in both L0 and L1)
is that after migration L1 mmu (aka root_mmu) is initialized by L2's IA32_EFER
due to the way qemu loads SREGS before the nested state, and later is not
initialized again because in this particular case the 32 bitness of L2's IA32_EFER
is not captured in mmu role.

V2:
Thanks to Sean and Paolo for helping me make more correct fixes for both of the issues.

I still haven't researched the 'fixes' tag, since I suspect that 32 bit nested
migration wasn't tested much ever, so this bug might be present since long time ago.

Best regards,
	Maxim Levitsky

Maxim Levitsky (2):
  KVM: nVMX: don't use vcpu->arch.efer when checking host state on
    nested state load
  KVM: x86/mmu: include efer.lma in extended mmu role

 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/kvm/mmu/mmu.c          |  1 +
 arch/x86/kvm/vmx/nested.c       | 22 +++++++++++++++++-----
 3 files changed, 19 insertions(+), 5 deletions(-)