Commit b8d295f9 authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: nVMX: Remove non-functional "support" for CR3 target values 



Remove all references to cr3_target_value[0-3] and replace the fields
in vmcs12 with "dead_space" to preserve the vmcs12 layout.  KVM doesn't
support emulating CR3-target values, despite a variety of code that
implies otherwise, as KVM unconditionally reports '0' for the number of
supported CR3-target values.

This technically fixes a bug where KVM would incorrectly allow VMREAD
and VMWRITE to nonexistent fields, i.e. cr3_target_value[0-3].  Per
Intel's SDM, the number of supported CR3-target values reported in
VMX_MISC also enumerates the existence of the associated VMCS fields:

  If a future implementation supports more than 4 CR3-target values, they
  will be encoded consecutively following the 4 encodings given here.

Alternatively, the "bug" could be fixed by actually advertisting support
for 4 CR3-target values, but that'd likely just enable kvm-unit-tests
given that no one has complained about lack of support for going on ten
years, e.g. KVM, Xen and HyperV don't use CR3-target values.

Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200416000739.9012-1-sean.j.christopherson@intel.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent c36b7150

Documentation/virt/kvm/nested-vmx.rst

+1 −4
Original line number Diff line number Diff line
@@ -116,10 +116,7 @@ struct shadow_vmcs is ever changed. 
		natural_width cr4_guest_host_mask;

		natural_width cr0_read_shadow;

		natural_width cr4_read_shadow;

		natural_width cr3_target_value0;

		natural_width cr3_target_value1;

		natural_width cr3_target_value2;

		natural_width cr3_target_value3;

		natural_width dead_space[4]; /* Last remnants of cr3_target_value[0-3]. */

		natural_width exit_qualification;

		natural_width guest_linear_address;

		natural_width guest_cr0;

arch/x86/kvm/vmx/evmcs.c

+0 −8
Original line number Diff line number Diff line
@@ -160,14 +160,6 @@ const struct evmcs_field vmcs_field_to_evmcs_1[] = { 
		     HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),

	EVMCS1_FIELD(VM_ENTRY_MSR_LOAD_ADDR, vm_entry_msr_load_addr,

		     HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),

	EVMCS1_FIELD(CR3_TARGET_VALUE0, cr3_target_value0,

		     HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),

	EVMCS1_FIELD(CR3_TARGET_VALUE1, cr3_target_value1,

		     HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),

	EVMCS1_FIELD(CR3_TARGET_VALUE2, cr3_target_value2,

		     HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),

	EVMCS1_FIELD(CR3_TARGET_VALUE3, cr3_target_value3,

		     HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),



	/* 32 bit rw */

	EVMCS1_FIELD(TPR_THRESHOLD, tpr_threshold,

arch/x86/kvm/vmx/nested.c

+0 −17
Original line number Diff line number Diff line
@@ -1785,10 +1785,6 @@ static int copy_enlightened_to_vmcs12(struct vcpu_vmx *vmx) 
	 * vmcs12->vm_exit_msr_store_addr = evmcs->vm_exit_msr_store_addr;

	 * vmcs12->vm_exit_msr_load_addr = evmcs->vm_exit_msr_load_addr;

	 * vmcs12->vm_entry_msr_load_addr = evmcs->vm_entry_msr_load_addr;

	 * vmcs12->cr3_target_value0 = evmcs->cr3_target_value0;

	 * vmcs12->cr3_target_value1 = evmcs->cr3_target_value1;

	 * vmcs12->cr3_target_value2 = evmcs->cr3_target_value2;

	 * vmcs12->cr3_target_value3 = evmcs->cr3_target_value3;

	 * vmcs12->page_fault_error_code_mask =

	 *		evmcs->page_fault_error_code_mask;

	 * vmcs12->page_fault_error_code_match =
@@ -1862,10 +1858,6 @@ static int copy_vmcs12_to_enlightened(struct vcpu_vmx *vmx) 
	 * evmcs->vm_exit_msr_store_addr = vmcs12->vm_exit_msr_store_addr;

	 * evmcs->vm_exit_msr_load_addr = vmcs12->vm_exit_msr_load_addr;

	 * evmcs->vm_entry_msr_load_addr = vmcs12->vm_entry_msr_load_addr;

	 * evmcs->cr3_target_value0 = vmcs12->cr3_target_value0;

	 * evmcs->cr3_target_value1 = vmcs12->cr3_target_value1;

	 * evmcs->cr3_target_value2 = vmcs12->cr3_target_value2;

	 * evmcs->cr3_target_value3 = vmcs12->cr3_target_value3;

	 * evmcs->tpr_threshold = vmcs12->tpr_threshold;

	 * evmcs->virtual_processor_id = vmcs12->virtual_processor_id;

	 * evmcs->exception_bitmap = vmcs12->exception_bitmap;
@@ -5541,15 +5533,6 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu, 
				return true;

			break;

		case 3:

			if ((vmcs12->cr3_target_count >= 1 &&

					vmcs12->cr3_target_value0 == val) ||

				(vmcs12->cr3_target_count >= 2 &&

					vmcs12->cr3_target_value1 == val) ||

				(vmcs12->cr3_target_count >= 3 &&

					vmcs12->cr3_target_value2 == val) ||

				(vmcs12->cr3_target_count >= 4 &&

					vmcs12->cr3_target_value3 == val))

				return false;

			if (nested_cpu_has(vmcs12, CPU_BASED_CR3_LOAD_EXITING))

				return true;

			break;

arch/x86/kvm/vmx/vmcs12.c

+0 −4
Original line number Diff line number Diff line
@@ -115,10 +115,6 @@ const unsigned short vmcs_field_to_offset_table[] = { 
	FIELD(CR4_GUEST_HOST_MASK, cr4_guest_host_mask),

	FIELD(CR0_READ_SHADOW, cr0_read_shadow),

	FIELD(CR4_READ_SHADOW, cr4_read_shadow),

	FIELD(CR3_TARGET_VALUE0, cr3_target_value0),

	FIELD(CR3_TARGET_VALUE1, cr3_target_value1),

	FIELD(CR3_TARGET_VALUE2, cr3_target_value2),

	FIELD(CR3_TARGET_VALUE3, cr3_target_value3),

	FIELD(EXIT_QUALIFICATION, exit_qualification),

	FIELD(GUEST_LINEAR_ADDRESS, guest_linear_address),

	FIELD(GUEST_CR0, guest_cr0),

arch/x86/kvm/vmx/vmcs12.h

+2 −8
Original line number Diff line number Diff line
@@ -80,10 +80,7 @@ struct __packed vmcs12 { 
	natural_width cr4_guest_host_mask;

	natural_width cr0_read_shadow;

	natural_width cr4_read_shadow;

	natural_width cr3_target_value0;

	natural_width cr3_target_value1;

	natural_width cr3_target_value2;

	natural_width cr3_target_value3;

	natural_width dead_space[4]; /* Last remnants of cr3_target_value[0-3]. */

	natural_width exit_qualification;

	natural_width guest_linear_address;

	natural_width guest_cr0;
@@ -263,10 +260,7 @@ static inline void vmx_check_vmcs12_offsets(void) 
	CHECK_OFFSET(cr4_guest_host_mask, 352);

	CHECK_OFFSET(cr0_read_shadow, 360);

	CHECK_OFFSET(cr4_read_shadow, 368);

	CHECK_OFFSET(cr3_target_value0, 376);

	CHECK_OFFSET(cr3_target_value1, 384);

	CHECK_OFFSET(cr3_target_value2, 392);

	CHECK_OFFSET(cr3_target_value3, 400);

	CHECK_OFFSET(dead_space, 376);

	CHECK_OFFSET(exit_qualification, 408);

	CHECK_OFFSET(guest_linear_address, 416);

	CHECK_OFFSET(guest_cr0, 424);