linux/arch/x86/kvm
Haozhong Zhang 8eb3f87d90 KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
When KVM emulates an exit from L2 to L1, it loads L1 CR4 into the
guest CR4. Before this CR4 loading, the guest CR4 refers to L2
CR4. Because these two CR4's are in different levels of guest, we
should vmx_set_cr4() rather than kvm_set_cr4() here. The latter, which
is used to handle guest writes to its CR4, checks the guest change to
CR4 and may fail if the change is invalid.

The failure may cause trouble. Consider we start
  a L1 guest with non-zero L1 PCID in use,
     (i.e. L1 CR4.PCIDE == 1 && L1 CR3.PCID != 0)
and
  a L2 guest with L2 PCID disabled,
     (i.e. L2 CR4.PCIDE == 0)
and following events may happen:

1. If kvm_set_cr4() is used in load_vmcs12_host_state() to load L1 CR4
   into guest CR4 (in VMCS01) for L2 to L1 exit, it will fail because
   of PCID check. As a result, the guest CR4 recorded in L0 KVM (i.e.
   vcpu->arch.cr4) is left to the value of L2 CR4.

2. Later, if L1 attempts to change its CR4, e.g., clearing VMXE bit,
   kvm_set_cr4() in L0 KVM will think L1 also wants to enable PCID,
   because the wrong L2 CR4 is used by L0 KVM as L1 CR4. As L1
   CR3.PCID != 0, L0 KVM will inject GP to L1 guest.

Fixes: 4704d0befb ("KVM: nVMX: Exiting from L2 to L1")
Cc: qemu-stable@nongnu.org
Signed-off-by: Haozhong Zhang <haozhong.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-12 13:54:56 +02:00
..
cpuid.c Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc 2017-09-08 14:40:43 +02:00
cpuid.h KVM: x86: fix clang build 2017-09-13 16:40:24 +02:00
debugfs.c kvm: x86: export TSC information to user-space 2016-09-16 16:57:48 +02:00
emulate.c x86/kvm: Move kvm_fastop_exception to .fixup section 2017-10-05 15:06:30 +02:00
hyperv.c KVM: X86: implement the logic for spinlock optimization 2017-08-08 10:57:43 +02:00
hyperv.h kvm: x86: hyperv: make VP_INDEX managed by userspace 2017-07-14 16:28:18 +02:00
i8254.c KVM: x86: take slots_lock in kvm_free_pit 2017-07-12 22:38:26 +02:00
i8254.h KVM: x86: Handle the kthread worker using the new API 2016-12-08 15:31:11 +01:00
i8259.c KVM: x86: simplify pic_ioport_read() 2017-04-12 20:17:15 +02:00
ioapic.c KVM: x86: rename kvm_vcpu_request_scan_ioapic() 2017-04-12 20:17:14 +02:00
ioapic.h KVM: x86: convert kvm_(set|get)_ioapic() into void 2017-04-12 20:17:14 +02:00
irq_comm.c KVM: x86: don't hold kvm->lock in KVM_SET_GSI_ROUTING 2017-05-02 14:45:45 +02:00
irq.c KVM: x86: get rid of pic_irqchip() 2017-04-12 20:17:13 +02:00
irq.h KVM: x86: don't hold kvm->lock in KVM_SET_GSI_ROUTING 2017-05-02 14:45:45 +02:00
Kconfig KVM: add X86_LOCAL_APIC dependency 2017-10-05 19:55:48 +02:00
kvm_cache_regs.h Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc 2017-09-08 14:40:43 +02:00
lapic.c kvm,lapic: Justify use of swait_active() 2017-09-15 16:57:11 +02:00
lapic.h KVM: hyperv: support HV_X64_MSR_TSC_FREQUENCY and HV_X64_MSR_APIC_FREQUENCY 2017-08-07 15:26:06 +02:00
Makefile KVM: x86: drop legacy device assignment 2017-04-07 16:49:00 +02:00
mmu_audit.c KVM: MMU: Add 5 level EPT & Shadow page table support. 2017-08-24 18:09:17 +02:00
mmu.c KVM: MMU: always terminate page walks at level 1 2017-10-10 15:31:28 +02:00
mmu.h Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc 2017-09-08 14:40:43 +02:00
mmutrace.h kvm: x86: mmu: allow A/D bits to be disabled in an mmu 2017-07-03 11:19:54 +02:00
mtrr.c KVM: x86: generalize guest_cpuid_has_ helpers 2017-08-07 16:11:50 +02:00
page_track.c mm: introduce kv[mz]alloc helpers 2017-05-08 17:15:12 -07:00
paging_tmpl.h KVM: MMU: always terminate page walks at level 1 2017-10-10 15:31:28 +02:00
pmu_amd.c perf/x86/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2 2016-09-16 16:19:49 +02:00
pmu_intel.c KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh() 2017-05-19 19:59:27 +02:00
pmu.c KVM: x86: never specify a sample period for virtualized in_tx_cp counters 2017-03-01 14:19:46 +01:00
pmu.h
svm.c KVM: SVM: Add irqchip_split() checks before enabling AVIC 2017-09-14 17:05:13 +02:00
trace.h KVM: x86: Add return value to kvm_cpuid(). 2017-08-24 18:09:15 +02:00
tss.h
vmx.c KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit 2017-10-12 13:54:56 +02:00
x86.c x86/fpu: Rename fpu__activate_curr() to fpu__initialize() 2017-09-26 09:43:44 +02:00
x86.h KVM: X86: Fix loss of exception which has not yet been injected 2017-08-24 18:09:19 +02:00