lkml.org 
[lkml]   [2022]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v3 19/25] KVM: VMX: Adjust CR3/INVPLG interception for EPT=y at runtime, not setup
    From
    Date
    On Fri, 2022-07-08 at 16:42 +0200, Vitaly Kuznetsov wrote:
    > From: Sean Christopherson <seanjc@google.com>
    >
    > Clear the CR3 and INVLPG interception controls at runtime based on
    > whether or not EPT is being _used_, as opposed to clearing the bits at
    > setup if EPT is _supported_ in hardware, and then restoring them when EPT
    > is not used.  Not mucking with the base config will allow using the base
    > config as the starting point for emulating the VMX capability MSRs.
    >
    > Signed-off-by: Sean Christopherson <seanjc@google.com>
    > Reviewed-by: Jim Mattson <jmattson@google.com>
    > Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
    > ---
    >  arch/x86/kvm/vmx/vmx.c | 18 +++++++-----------
    >  1 file changed, 7 insertions(+), 11 deletions(-)
    >
    > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
    > index 9771c771c8f5..eca6875d6732 100644
    > --- a/arch/x86/kvm/vmx/vmx.c
    > +++ b/arch/x86/kvm/vmx/vmx.c
    > @@ -2501,13 +2501,8 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
    >         rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,
    >                 &vmx_cap->ept, &vmx_cap->vpid);
    >  
    > -       if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
    > -               /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
    > -                  enabled */
    > -               _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
    > -                                            CPU_BASED_CR3_STORE_EXITING |
    > -                                            CPU_BASED_INVLPG_EXITING);
    > -       } else if (vmx_cap->ept) {
    > +       if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&
    > +           vmx_cap->ept) {
    >                 pr_warn_once("EPT CAP should not exist if not support "
    >                                 "1-setting enable EPT VM-execution control\n");
    >  
    > @@ -4264,10 +4259,11 @@ static u32 vmx_exec_control(struct vcpu_vmx *vmx)
    >                 exec_control |= CPU_BASED_CR8_STORE_EXITING |
    >                                 CPU_BASED_CR8_LOAD_EXITING;
    >  #endif
    > -       if (!enable_ept)
    > -               exec_control |= CPU_BASED_CR3_STORE_EXITING |
    > -                               CPU_BASED_CR3_LOAD_EXITING  |
    > -                               CPU_BASED_INVLPG_EXITING;
    > +       /* No need to intercept CR3 access or INVPLG when using EPT. */
    > +       if (enable_ept)
    > +               exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
    > +                                 CPU_BASED_CR3_STORE_EXITING |
    > +                                 CPU_BASED_INVLPG_EXITING);
    >         if (kvm_mwait_in_guest(vmx->vcpu.kvm))
    >                 exec_control &= ~(CPU_BASED_MWAIT_EXITING |
    >                                 CPU_BASED_MONITOR_EXITING);


    Makes sense, although the 'runtime' word a bit misleading, as we don't allow to change
    'enable_ept' after kvm_intel is loaded I think.


    Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>

    Best regards,
    Maxim Levitsky

    \
     
     \ /
      Last update: 2022-07-12 14:00    [W:2.095 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site