2017-03-28 16:10 GMT+08:00 Paolo Bonzini <pbonzini@xxxxxxxxxx>:
>
>
> On 23/03/2017 07:18, Ladi Prosek wrote:
>> The nested_ept_enabled flag introduced in commit 7ca29de2136 was not
>> computed correctly. We are interested only in L1's EPT state, not the
>> the combined L0+L1 value.
>>
>> In particular, if L0 uses EPT but L1 does not, nested_ept_enabled must
>> be false to make sure that PDPSTRs are loaded based on CR3 as usual,
>> because the special case described in 26.3.2.4 Loading Page-Directory-
>> Pointer-Table Entries does not apply.
>>
>> Fixes: 7ca29de21362 ("KVM: nVMX: fix CR3 load if L2 uses PAE paging and EPT")
>> Reported-by: Wanpeng Li <wanpeng.li@xxxxxxxxxxx>
>> Signed-off-by: Ladi Prosek <lprosek@xxxxxxxxxx>
>> ---
>>
>> v1->v2:
>>
>> * deleted the nested_ept_enabled local and switched to nested_cpu_has_ept()
>> as suggested by Radim
>>
>>
>> arch/x86/kvm/vmx.c | 5 +----
>> 1 file changed, 1 insertion(+), 4 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> index 98e82ee..152c672 100644
>> --- a/arch/x86/kvm/vmx.c
>> +++ b/arch/x86/kvm/vmx.c
>> @@ -9974,7 +9974,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>> {
>> struct vcpu_vmx *vmx = to_vmx(vcpu);
>> u32 exec_control;
>> - bool nested_ept_enabled = false;
>>
>> vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
>> vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
>> @@ -10121,8 +10120,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>> vmcs12->guest_intr_status);
>> }
>>
>> - nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
>> -
>> /*
>> * Write an illegal value to APIC_ACCESS_ADDR. Later,
>> * nested_get_vmcs12_pages will either fix it up or
>> @@ -10282,7 +10279,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>> vmx_set_efer(vcpu, vcpu->arch.efer);
>>
>> /* Shadow page tables on either EPT or shadow page tables. */
>> - if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_ept_enabled,
>> + if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
>> entry_failure_code))
>> return 1;
>>
>>
>
> Applied. Wanpeng, can you please take a look at unit tests for this?
>
The kvm-unit-tests has already detect EPT bits in vmcs12 exec control
before enable EPT in L1.
Regards,
Wanpeng Li
