On Sat, 2023-04-22 at 12:51 +0800, Chao Gao wrote: > On Fri, Apr 21, 2023 at 11:32:17PM +0800, Chao Gao wrote: > > > For case 2) I _think_ we need new code to check both VMCS12's HOST_CR3 and > > > GUEST_CR3 against active control bits. The key code path is > > > > ... > > > > > > > > nested_vmx_run() -> > > > -> nested_vmx_check_host_state() > > > -> nested_vmx_enter_non_root_mode() > > > -> prepare_vmcs02_early() > > > -> prepare_vmcs02() > > > > > > Since nested_vmx_load_cr3() is used in both VMENTER using VMCS12's HOST_CR3 > > > (VMEXIT to L1) and GUEST_CR3 (VMENTER to L2), and it currently already checks > > > kvm_vcpu_is_illegal_gpa(vcpu, cr3), changing it to additionally check guest CR3 > > > active control bits seems just enough. > > > > IMO, current KVM relies on hardware to do consistency check on the GUEST_CR3 > > during VM entry. > > Please disregard my remark on the consistency check on GUEST_CR3. I just took > a closer look at the code. It is indeed done by KVM in nested_vmx_load_cr3(). > Sorry for the noise. Right. You cannot just simply rely on hardware to do CR3 check in VMENTER, because at least there's a nasty case that L1's MAXPHYSADDR can be smaller than L0.
