Even when neither L0 nor L1 configured to trap *_BASE MSR accesses from its own VMs, the current KVM L0 always traps *_BASE MSR accesses from L2. Let's check if both L0 and L1 disabled trap for *_BASE MSR for its VMs respectively, and let L2 access to*_BASE MSR without trap if that's the case. Signed-off-by: Jintack Lim <jintack@xxxxxxxxxxxxxxx> --- Changes since v1: - Added GS_BASE and KENREL_GS_BASE (Jim, Sean) - Changed to allow reads as well as writes (Sean) --- arch/x86/kvm/vmx/nested.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 0c601d0..d167bb6 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -537,6 +537,10 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, */ bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD); bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL); + bool fs_base = !msr_write_intercepted_l01(vcpu, MSR_FS_BASE); + bool gs_base = !msr_write_intercepted_l01(vcpu, MSR_GS_BASE); + bool kernel_gs_base = !msr_write_intercepted_l01(vcpu, + MSR_KERNEL_GS_BASE); /* Nothing to do if the MSR bitmap is not in use. */ if (!cpu_has_vmx_msr_bitmap() || @@ -544,7 +548,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, return false; if (!nested_cpu_has_virt_x2apic_mode(vmcs12) && - !pred_cmd && !spec_ctrl) + !pred_cmd && !spec_ctrl && !fs_base && !gs_base && !kernel_gs_base) return false; page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->msr_bitmap); @@ -592,6 +596,24 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, } } + if (fs_base) + nested_vmx_disable_intercept_for_msr( + msr_bitmap_l1, msr_bitmap_l0, + MSR_FS_BASE, + MSR_TYPE_RW); + + if (gs_base) + nested_vmx_disable_intercept_for_msr( + msr_bitmap_l1, msr_bitmap_l0, + MSR_GS_BASE, + MSR_TYPE_RW); + + if (kernel_gs_base) + nested_vmx_disable_intercept_for_msr( + msr_bitmap_l1, msr_bitmap_l0, + MSR_KERNEL_GS_BASE, + MSR_TYPE_RW); + if (spec_ctrl) nested_vmx_disable_intercept_for_msr( msr_bitmap_l1, msr_bitmap_l0, -- 1.9.1
