Commit 64f80ea7 authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: VMX: Adjust CR3/INVPLG interception for EPT=y at runtime, not setup 



Clear the CR3 and INVLPG interception controls at runtime based on
whether or not EPT is being _used_, as opposed to clearing the bits at
setup if EPT is _supported_ in hardware, and then restoring them when EPT
is not used.  Not mucking with the base config will allow using the base
config as the starting point for emulating the VMX capability MSRs.

Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Reviewed-by: default avatarJim Mattson <jmattson@google.com>
Reviewed-by: default avatarMaxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20220830133737.1539624-28-vkuznets@redhat.com


Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent a83bea73

arch/x86/kvm/vmx/vmx.c

+7 −11
Original line number Original line Diff line number Diff line
@@ -2578,13 +2578,8 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf, 
	rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,

	rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,

		&vmx_cap->ept, &vmx_cap->vpid);

		&vmx_cap->ept, &vmx_cap->vpid);





	if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {

	if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&

		/* CR3 accesses and invlpg don't need to cause VM Exits when EPT

	    vmx_cap->ept) {

		   enabled */

		_cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |

					     CPU_BASED_CR3_STORE_EXITING |

					     CPU_BASED_INVLPG_EXITING);

	} else if (vmx_cap->ept) {

		pr_warn_once("EPT CAP should not exist if not support "

		pr_warn_once("EPT CAP should not exist if not support "

				"1-setting enable EPT VM-execution control\n");

				"1-setting enable EPT VM-execution control\n");
@@ -4353,10 +4348,11 @@ static u32 vmx_exec_control(struct vcpu_vmx *vmx) 
		exec_control |= CPU_BASED_CR8_STORE_EXITING |

		exec_control |= CPU_BASED_CR8_STORE_EXITING |

				CPU_BASED_CR8_LOAD_EXITING;

				CPU_BASED_CR8_LOAD_EXITING;

#endif

#endif

	if (!enable_ept)

	/* No need to intercept CR3 access or INVPLG when using EPT. */

		exec_control |= CPU_BASED_CR3_STORE_EXITING |

	if (enable_ept)

				CPU_BASED_CR3_LOAD_EXITING  |

		exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |

				CPU_BASED_INVLPG_EXITING;

				  CPU_BASED_CR3_STORE_EXITING |

				  CPU_BASED_INVLPG_EXITING);

	if (kvm_mwait_in_guest(vmx->vcpu.kvm))

	if (kvm_mwait_in_guest(vmx->vcpu.kvm))

		exec_control &= ~(CPU_BASED_MWAIT_EXITING |

		exec_control &= ~(CPU_BASED_MWAIT_EXITING |

				CPU_BASED_MONITOR_EXITING);

				CPU_BASED_MONITOR_EXITING);