linux-kernel - Re: [PATCH v3 09/10] KVM: nVMX: Switch to vmcs01 to set virtual APICv mode on-demand if L2 is active

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aU4aH/3j6w9Yw1hu@intel.com>
Date: Fri, 26 Dec 2025 13:16:15 +0800
From: Chao Gao <chao.gao@...el.com>
To: Sean Christopherson <seanjc@...gle.com>
CC: Paolo Bonzini <pbonzini@...hat.com>, <kvm@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, Dongli Zhang <dongli.zhang@...cle.com>
Subject: Re: [PATCH v3 09/10] KVM: nVMX: Switch to vmcs01 to set virtual
 APICv mode on-demand if L2 is active

On Fri, Dec 05, 2025 at 03:19:12PM -0800, Sean Christopherson wrote:
>If L1's virtual APIC mode changes while L2 is active, e.g. because L1
>doesn't intercept writes to the APIC_BASE MSR and L2 changes the mode,
>temporarily load vmcs01 and do all of the necessary actions instead of
>deferring the update until the next nested VM-Exit.
>
>This will help in fixing yet more issues related to updates while L2 is
>active, e.g. KVM neglects to update vmcs02 MSR intercepts if vmcs01's MSR
>intercepts are modified while L2 is active.  Not updating x2APIC MSRs is
>benign because vmcs01's settings are not factored into vmcs02's bitmap, but
>deferring the x2APIC MSR updates would create a weird, inconsistent state.
>
>Signed-off-by: Sean Christopherson <seanjc@...gle.com>

Reviewed-by: Chao Gao <chao.gao@...el.com>

>@@ -6869,8 +6865,17 @@ void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
> 			 * only do so if its physical address has changed, but
> 			 * the guest may have inserted a non-APIC mapping into
> 			 * the TLB while the APIC access page was disabled.
>+			 *
>+			 * If L2 is active, immediately flush L1's TLB instead
>+			 * of requesting a flush of the current TLB, because
>+			 * the current TLB context is L2's.
> 			 */
>-			kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
>+			if (!is_guest_mode(vcpu))
>+				kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
>+			else if (!enable_ept)
>+				vpid_sync_context(to_vmx(vcpu)->vpid);

Nit: there's already a local "vmx" variable available. you can use it directly.