Commit f8aa7e39 authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini

KVM: nVMX: Invalidate all EPTP contexts when emulating INVEPT for L1

Free all L2 (guest_mmu) roots when emulating INVEPT for L1.  Outstanding
changes to the EPT tables managed by L1 need to be recognized, and
relying on KVM to always flush L2's EPTP context on nested VM-Enter is
dangerous.

Similar to handle_invpcid(), rely on kvm_mmu_free_roots() to do a remote
TLB flush if necessary, e.g. if L1 has never entered L2 then there is
nothing to be done.

Nuking all L2 roots is overkill for the single-context variant, but it's
the safe and easy bet.  A more precise zap mechanism will be added in
the future.  Add a TODO to call out that KVM only needs to invalidate
affected contexts.

Fixes: 14c07ad8 ("x86/kvm/mmu: introduce guest_mmu")
Reported-by: default avatarJim Mattson <jmattson@google.com>
Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200320212833.3507-4-sean.j.christopherson@intel.com>
Reviewed-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent eed0030e
...@@ -5161,12 +5161,16 @@ static int handle_invept(struct kvm_vcpu *vcpu) ...@@ -5161,12 +5161,16 @@ static int handle_invept(struct kvm_vcpu *vcpu)
if (!nested_vmx_check_eptp(vcpu, operand.eptp)) if (!nested_vmx_check_eptp(vcpu, operand.eptp))
return nested_vmx_failValid(vcpu, return nested_vmx_failValid(vcpu,
VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
/* TODO: sync only the target EPTP context. */
fallthrough; fallthrough;
case VMX_EPT_EXTENT_GLOBAL: case VMX_EPT_EXTENT_GLOBAL:
/* /*
* TODO: Sync the necessary shadow EPT roots here, rather than * Nested EPT roots are always held through guest_mmu,
* at the next emulated VM-entry. * not root_mmu.
*/ */
kvm_mmu_free_roots(vcpu, &vcpu->arch.guest_mmu,
KVM_MMU_ROOTS_ALL);
break; break;
default: default:
BUG_ON(1); BUG_ON(1);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment