linux-kernel - [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 15 Aug 2017 21:58:24 -0400
From:   Lan Tianyu <tianyu.lan@...el.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Lan Tianyu <tianyu.lan@...el.com>, pbonzini@...hat.com,
        rkrcmar@...hat.com, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] KVM/VMX: Avoid CR3 VMEXIT during guest real mode when "unrestricted guest" is supported.

These CR3 VMEXITs was introduced for platform without "unrestricted guest"
support. This is to set ept identity table to guest CR3 in guest real
mode because these platforms don't support ept real mode(CR0.PE and CR0.PG
must be set to 1). But these VMEXITs is redundant for platforms with
"unrestricted guest" support.

Signed-off-by: Lan Tianyu <tianyu.lan@...el.com>
---
 arch/x86/kvm/vmx.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 9b21b12..46dcf50 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4221,18 +4221,20 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
 		vmx_decache_cr3(vcpu);
 	if (!(cr0 & X86_CR0_PG)) {
 		/* From paging/starting to nonpaging */
-		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
-			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
-			     (CPU_BASED_CR3_LOAD_EXITING |
-			      CPU_BASED_CR3_STORE_EXITING));
+		if (!enable_unrestricted_guest)
+			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
+				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
+				     (CPU_BASED_CR3_LOAD_EXITING |
+				      CPU_BASED_CR3_STORE_EXITING));
 		vcpu->arch.cr0 = cr0;
 		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
 	} else if (!is_paging(vcpu)) {
 		/* From nonpaging to paging */
-		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
-			     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
-			     ~(CPU_BASED_CR3_LOAD_EXITING |
-			       CPU_BASED_CR3_STORE_EXITING));
+		if (!enable_unrestricted_guest)
+			vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
+				     vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
+				     ~(CPU_BASED_CR3_LOAD_EXITING |
+				       CPU_BASED_CR3_STORE_EXITING));
 		vcpu->arch.cr0 = cr0;
 		vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
 	}
@@ -4311,7 +4313,9 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
 	}
 
 	vmx_flush_tlb(vcpu);
-	vmcs_writel(GUEST_CR3, guest_cr3);
+
+	if (!enable_unrestricted_guest || !enable_ept)
+		vmcs_writel(GUEST_CR3, guest_cr3);
 }
 
 static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
-- 
1.8.3.1