| Message ID | 52BEEEE8.7080506@web.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Sat, Dec 28, 2013 at 04:31:52PM +0100, Jan Kiszka wrote: > Three reasons for doing this: 1. arch.walk_mmu points to arch.mmu anyway > in case nested EPT wasn't in use. 2. this aligns VMX with SVM. But 3. is > most important: nested_cpu_has_ept(vmcs12) queries the VMCS page, and if > one guest VCPU manipulates the page of another VCPU in L2, we may be > fooled to skip over the nested_ept_uninit_mmu_context, leaving mmu in > nested state. That can crash the host later on if nested_ept_get_cr3 is > invoked while L1 already left vmxon and nested.current_vmcs12 became > NULL therefore. > > Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> > --- > arch/x86/kvm/vmx.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c > index 1d9b0ec..48d0b46 100644 > --- a/arch/x86/kvm/vmx.c > +++ b/arch/x86/kvm/vmx.c > @@ -8366,8 +8366,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, > vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK); > kvm_set_cr4(vcpu, vmcs12->host_cr4); > > - if (nested_cpu_has_ept(vmcs12)) > - nested_ept_uninit_mmu_context(vcpu); > + nested_ept_uninit_mmu_context(vcpu); > > kvm_set_cr3(vcpu, vmcs12->host_cr3); > kvm_mmu_reset_context(vcpu); > -- Applied to master branch, thanks. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 1d9b0ec..48d0b46 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -8366,8 +8366,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK); kvm_set_cr4(vcpu, vmcs12->host_cr4); - if (nested_cpu_has_ept(vmcs12)) - nested_ept_uninit_mmu_context(vcpu); + nested_ept_uninit_mmu_context(vcpu); kvm_set_cr3(vcpu, vmcs12->host_cr3); kvm_mmu_reset_context(vcpu);
Three reasons for doing this: 1. arch.walk_mmu points to arch.mmu anyway in case nested EPT wasn't in use. 2. this aligns VMX with SVM. But 3. is most important: nested_cpu_has_ept(vmcs12) queries the VMCS page, and if one guest VCPU manipulates the page of another VCPU in L2, we may be fooled to skip over the nested_ept_uninit_mmu_context, leaving mmu in nested state. That can crash the host later on if nested_ept_get_cr3 is invoked while L1 already left vmxon and nested.current_vmcs12 became NULL therefore. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> --- arch/x86/kvm/vmx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)