Commit 2f723a86 authored by Sean Christopherson's avatar Sean Christopherson
Browse files

KVM: VMX: Use kvm_mmu_page role to construct EPTP, not current vCPU state 

Use the role for the to-be-loaded/invalidated EPT root to compute the
root's level and A/D enablement instead of pulling the information from
the vCPU (e.g. by passing in the root level and querying vmcs12).  Not
making unnecessary assumptions about the root will allow invalidating
arbitrary EPT roots (which sadly requires a full EPTP) at any given time.

No functional change intended (the end result should be the same).

Link: https://lore.kernel.org/r/20250919005955.1366256-5-seanjc@google.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent a10f5cc3

arch/x86/kvm/vmx/vmx.c

+30 −11
Original line number Diff line number Diff line
@@ -3219,20 +3219,40 @@ static inline int vmx_get_current_vpid(struct kvm_vcpu *vcpu) 
	return to_vmx(vcpu)->vpid;

}



static u64 construct_eptp(struct kvm_vcpu *vcpu, hpa_t root_hpa, int root_level)

static u64 construct_eptp(hpa_t root_hpa)

{

	u64 eptp = VMX_EPTP_MT_WB;

	u64 eptp = root_hpa | VMX_EPTP_MT_WB;

	struct kvm_mmu_page *root;



	eptp |= (root_level == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4;

	if (kvm_mmu_is_dummy_root(root_hpa))

		return eptp | VMX_EPTP_PWL_4;



	if (enable_ept_ad_bits &&

	    (!is_guest_mode(vcpu) || nested_ept_ad_enabled(vcpu)))

	/*

	 * EPT roots should always have an associated MMU page.  Return a "bad"

	 * EPTP to induce VM-Fail instead of continuing on in a unknown state.

	 */

	root = root_to_sp(root_hpa);

	if (WARN_ON_ONCE(!root))

		return INVALID_PAGE;



	eptp |= (root->role.level == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4;



	if (enable_ept_ad_bits && !root->role.ad_disabled)

		eptp |= VMX_EPTP_AD_ENABLE_BIT;

	eptp |= root_hpa;



	return eptp;

}



static void vmx_flush_tlb_ept_root(hpa_t root_hpa)

{

	u64 eptp = construct_eptp(root_hpa);



	if (VALID_PAGE(eptp))

		ept_sync_context(eptp);

	else

		ept_sync_global();

}



void vmx_flush_tlb_current(struct kvm_vcpu *vcpu)

{

	struct kvm_mmu *mmu = vcpu->arch.mmu;
@@ -3243,8 +3263,7 @@ void vmx_flush_tlb_current(struct kvm_vcpu *vcpu) 
		return;



	if (enable_ept)

		ept_sync_context(construct_eptp(vcpu, root_hpa,

						mmu->root_role.level));

		vmx_flush_tlb_ept_root(root_hpa);

	else

		vpid_sync_context(vmx_get_current_vpid(vcpu));

}
@@ -3415,11 +3434,11 @@ void vmx_load_mmu_pgd(struct kvm_vcpu *vcpu, hpa_t root_hpa, int root_level) 
	struct kvm *kvm = vcpu->kvm;

	bool update_guest_cr3 = true;

	unsigned long guest_cr3;

	u64 eptp;



	if (enable_ept) {

		eptp = construct_eptp(vcpu, root_hpa, root_level);

		vmcs_write64(EPT_POINTER, eptp);

		KVM_MMU_WARN_ON(root_to_sp(root_hpa) &&

				root_level != root_to_sp(root_hpa)->role.level);

		vmcs_write64(EPT_POINTER, construct_eptp(root_hpa));



		hv_track_root_tdp(vcpu, root_hpa);