On 31/03/2017 11:05, Ladi Prosek wrote:
> The nested_ept_enabled flag introduced in commit 7ca29de2136 was not
> computed correctly. We are interested only in L1's EPT state, not the
> the combined L0+L1 value.
>
> In particular, if L0 uses EPT but L1 does not, nested_ept_enabled must
> be false to make sure that PDPSTRs are loaded based on CR3 as usual,
> because the special case described in 26.3.2.4 Loading Page-Directory-
> Pointer-Table Entries does not apply.
>
> Fixes: 7ca29de21362 ("KVM: nVMX: fix CR3 load if L2 uses PAE paging and EPT")
> Cc: qemu-stable@xxxxxxxxxx
> Reported-by: Wanpeng Li <wanpeng.li@xxxxxxxxxxx>
> Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>
> Signed-off-by: Ladi Prosek <lprosek@xxxxxxxxxx>
> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> ---
>
> This is 7ad658b693536741c37b16aeb07840a2ce75f5b9 backported to 4.10-stable.
> The original commit does not apply cleanly due to an unrelated change:
>
> commit 6beb7bd52e482c213dfa6c1c88e27a579df5bf4d
> Author: Jim Mattson <jmattson@xxxxxxxxxx>
> Date: Wed Nov 30 12:03:45 2016 -0800
>
> kvm: nVMX: Refactor nested_get_vmcs12_pages()
>
> arch/x86/kvm/vmx.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 2c22aef..e54f818e 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -10026,7 +10026,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
> {
> struct vcpu_vmx *vmx = to_vmx(vcpu);
> u32 exec_control;
> - bool nested_ept_enabled = false;
>
> vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
> vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
> @@ -10191,7 +10190,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
> vmcs12->guest_intr_status);
> }
>
> - nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
> vmcs_write32(SECONDARY_VM_EXEC_CONTROL, exec_control);
> }
>
> @@ -10343,7 +10341,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
> vmx_set_efer(vcpu, vcpu->arch.efer);
>
> /* Shadow page tables on either EPT or shadow page tables. */
> - if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_ept_enabled,
> + if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
> entry_failure_code))
> return 1;
>
>
Acked-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Thanks Ladi!
Paolo