| Message ID | 20220708144223.610080-20-vkuznets@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: VMX: Support updated eVMCSv1 revision + use vmcs_config for L1 VMX MSRs | expand |
On Fri, 2022-07-08 at 16:42 +0200, Vitaly Kuznetsov wrote: > From: Sean Christopherson <seanjc@google.com> > > Clear the CR3 and INVLPG interception controls at runtime based on > whether or not EPT is being _used_, as opposed to clearing the bits at > setup if EPT is _supported_ in hardware, and then restoring them when EPT > is not used. Not mucking with the base config will allow using the base > config as the starting point for emulating the VMX capability MSRs. > > Signed-off-by: Sean Christopherson <seanjc@google.com> > Reviewed-by: Jim Mattson <jmattson@google.com> > Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> > --- > arch/x86/kvm/vmx/vmx.c | 18 +++++++----------- > 1 file changed, 7 insertions(+), 11 deletions(-) > > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > index 9771c771c8f5..eca6875d6732 100644 > --- a/arch/x86/kvm/vmx/vmx.c > +++ b/arch/x86/kvm/vmx/vmx.c > @@ -2501,13 +2501,8 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf, > rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP, > &vmx_cap->ept, &vmx_cap->vpid); > > - if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) { > - /* CR3 accesses and invlpg don't need to cause VM Exits when EPT > - enabled */ > - _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING | > - CPU_BASED_CR3_STORE_EXITING | > - CPU_BASED_INVLPG_EXITING); > - } else if (vmx_cap->ept) { > + if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) && > + vmx_cap->ept) { > pr_warn_once("EPT CAP should not exist if not support " > "1-setting enable EPT VM-execution control\n"); > > @@ -4264,10 +4259,11 @@ static u32 vmx_exec_control(struct vcpu_vmx *vmx) > exec_control |= CPU_BASED_CR8_STORE_EXITING | > CPU_BASED_CR8_LOAD_EXITING; > #endif > - if (!enable_ept) > - exec_control |= CPU_BASED_CR3_STORE_EXITING | > - CPU_BASED_CR3_LOAD_EXITING | > - CPU_BASED_INVLPG_EXITING; > + /* No need to intercept CR3 access or INVPLG when using EPT. */ > + if (enable_ept) > + exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING | > + CPU_BASED_CR3_STORE_EXITING | > + CPU_BASED_INVLPG_EXITING); > if (kvm_mwait_in_guest(vmx->vcpu.kvm)) > exec_control &= ~(CPU_BASED_MWAIT_EXITING | > CPU_BASED_MONITOR_EXITING); Makes sense, although the 'runtime' word a bit misleading, as we don't allow to change 'enable_ept' after kvm_intel is loaded I think. Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Best regards, Maxim Levitsky
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 9771c771c8f5..eca6875d6732 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -2501,13 +2501,8 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf, rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP, &vmx_cap->ept, &vmx_cap->vpid); - if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) { - /* CR3 accesses and invlpg don't need to cause VM Exits when EPT - enabled */ - _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING | - CPU_BASED_CR3_STORE_EXITING | - CPU_BASED_INVLPG_EXITING); - } else if (vmx_cap->ept) { + if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) && + vmx_cap->ept) { pr_warn_once("EPT CAP should not exist if not support " "1-setting enable EPT VM-execution control\n"); @@ -4264,10 +4259,11 @@ static u32 vmx_exec_control(struct vcpu_vmx *vmx) exec_control |= CPU_BASED_CR8_STORE_EXITING | CPU_BASED_CR8_LOAD_EXITING; #endif - if (!enable_ept) - exec_control |= CPU_BASED_CR3_STORE_EXITING | - CPU_BASED_CR3_LOAD_EXITING | - CPU_BASED_INVLPG_EXITING; + /* No need to intercept CR3 access or INVPLG when using EPT. */ + if (enable_ept) + exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING | + CPU_BASED_CR3_STORE_EXITING | + CPU_BASED_INVLPG_EXITING); if (kvm_mwait_in_guest(vmx->vcpu.kvm)) exec_control &= ~(CPU_BASED_MWAIT_EXITING | CPU_BASED_MONITOR_EXITING);