linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <sean.j.christopherson@intel.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Wanpeng Li <wanpengli@tencent.com>,
	Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
	kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	Ben Gardon <bgardon@google.com>,
	Junaid Shahid <junaids@google.com>,
	Liran Alon <liran.alon@oracle.com>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>,
	John Haxby <john.haxby@oracle.com>,
	Miaohe Lin <linmiaohe@huawei.com>,
	Tom Lendacky <thomas.lendacky@amd.com>
Subject: [PATCH v2 03/32] KVM: nVMX: Invalidate all EPTP contexts when emulating INVEPT for L1
Date: Mon, 16 Mar 2020 21:52:09 -0700	[thread overview]
Message-ID: <20200317045238.30434-4-sean.j.christopherson@intel.com> (raw)
In-Reply-To: <20200317045238.30434-1-sean.j.christopherson@intel.com>

Free all L2 (guest_mmu) roots when emulating INVEPT for L1.  Outstanding
changes to the EPT tables managed by L1 need to be recognized, and
relying on KVM to always flush L2's EPTP context on nested VM-Enter is
dangerous.

Similar to handle_invpcid(), rely on kvm_mmu_free_roots() to do a remote
TLB flush if necessary, e.g. if L1 has never entered L2 then there is
nothing to be done.

Nuking all L2 roots is overkill for the single-context variant, but it's
the safe and easy bet.  A more precise zap mechanism will be added in
the future.  Add a TODO to call out that KVM only needs to invalidate
affected contexts.

Fixes: b119019847fbc ("kvm: nVMX: Remove unnecessary sync_roots from handle_invept")
Reported-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
 arch/x86/kvm/vmx/nested.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index f3774cef4fd4..9624cea4ed9f 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5160,12 +5160,12 @@ static int handle_invept(struct kvm_vcpu *vcpu)
 		if (!nested_vmx_check_eptp(vcpu, operand.eptp))
 			return nested_vmx_failValid(vcpu,
 				VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+
+		/* TODO: sync only the target EPTP context. */
 		fallthrough;
 	case VMX_EPT_EXTENT_GLOBAL:
-	/*
-	 * TODO: Sync the necessary shadow EPT roots here, rather than
-	 * at the next emulated VM-entry.
-	 */
+		kvm_mmu_free_roots(vcpu, &vcpu->arch.guest_mmu,
+				   KVM_MMU_ROOTS_ALL);
 		break;
 	default:
 		BUG_ON(1);
-- 
2.24.1


  parent reply	other threads:[~2020-03-17  4:55 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-17  4:52 [PATCH v2 00/32] KVM: x86: TLB flushing fixes and enhancements Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 01/32] KVM: VMX: Flush all EPTP/VPID contexts on remote TLB flush Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 02/32] KVM: nVMX: Validate the EPTP when emulating INVEPT(EXTENT_CONTEXT) Sean Christopherson
2020-03-17  4:52 ` Sean Christopherson [this message]
2020-03-17  4:52 ` [PATCH v2 04/32] KVM: nVMX: Invalidate all L2 roots when emulating INVVPID without EPT Sean Christopherson
2020-03-20  4:11   ` Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 05/32] KVM: x86: Export kvm_propagate_fault() (as kvm_inject_emulated_page_fault) Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 06/32] KVM: x86: Consolidate logic for injecting page faults to L1 Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 07/32] KVM: x86: Sync SPTEs when injecting page/EPT fault into L1 Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 08/32] KVM: VMX: Skip global INVVPID fallback if vpid==0 in vpid_sync_context() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 09/32] KVM: VMX: Use vpid_sync_context() directly when possible Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 10/32] KVM: VMX: Move vpid_sync_vcpu_addr() down a few lines Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 11/32] KVM: VMX: Handle INVVPID fallback logic in vpid_sync_vcpu_addr() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 12/32] KVM: VMX: Drop redundant capability checks in low level INVVPID helpers Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 13/32] KVM: nVMX: Use vpid_sync_vcpu_addr() to emulate INVVPID with address Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 14/32] KVM: x86: Move "flush guest's TLB" logic to separate kvm_x86_ops hook Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 15/32] KVM: VMX: Clean up vmx_flush_tlb_gva() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 16/32] KVM: x86: Drop @invalidate_gpa param from kvm_x86_ops' tlb_flush() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 17/32] KVM: SVM: Wire up ->tlb_flush_guest() directly to svm_flush_tlb() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 18/32] KVM: VMX: Move vmx_flush_tlb() to vmx.c Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 19/32] KVM: nVMX: Move nested_get_vpid02() to vmx/nested.h Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 20/32] KVM: VMX: Introduce vmx_flush_tlb_current() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 21/32] KVM: SVM: Document the ASID logic in svm_flush_tlb() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 22/32] KVM: x86: Rename ->tlb_flush() to ->tlb_flush_all() Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 23/32] KVM: nVMX: Add helper to handle TLB flushes on nested VM-Enter/VM-Exit Sean Christopherson
2020-03-17 17:17   ` Paolo Bonzini
2020-03-17 18:18     ` Sean Christopherson
2020-03-18 10:45       ` Paolo Bonzini
2020-03-18 16:09         ` Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 24/32] KVM: x86: Introduce KVM_REQ_TLB_FLUSH_CURRENT to flush current ASID Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 25/32] KVM: x86/mmu: Use KVM_REQ_TLB_FLUSH_CURRENT for MMU specific flushes Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 26/32] KVM: nVMX: Selectively use TLB_FLUSH_CURRENT for nested VM-Enter/VM-Exit Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 27/32] KVM: nVMX: Reload APIC access page on nested VM-Exit only if necessary Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 28/32] KVM: VMX: Retrieve APIC access page HPA only when necessary Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 29/32] KVM: VMX: Don't reload APIC access page if its control is disabled Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 30/32] KVM: x86/mmu: Add module param to force TLB flush on root reuse Sean Christopherson
2020-03-17  4:52 ` [PATCH v2 31/32] KVM: nVMX: Don't flush TLB on nested VM transition with EPT enabled Sean Christopherson
2020-03-17 17:18   ` Paolo Bonzini
2020-03-17 18:22     ` Sean Christopherson
2020-03-18 10:36       ` Paolo Bonzini
2020-03-18 17:02         ` Sean Christopherson
2020-03-18 17:11           ` Paolo Bonzini
2020-03-18 17:26             ` Sean Christopherson
2020-03-18 17:38               ` Paolo Bonzini
2020-03-17  4:52 ` [PATCH v2 32/32] KVM: nVMX: Free only the affected contexts when emulating INVEPT Sean Christopherson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200317045238.30434-4-sean.j.christopherson@intel.com \
    --to=sean.j.christopherson@intel.com \
    --cc=bgardon@google.com \
    --cc=boris.ostrovsky@oracle.com \
    --cc=jmattson@google.com \
    --cc=john.haxby@oracle.com \
    --cc=joro@8bytes.org \
    --cc=junaids@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=linmiaohe@huawei.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=liran.alon@oracle.com \
    --cc=pbonzini@redhat.com \
    --cc=thomas.lendacky@amd.com \
    --cc=vkuznets@redhat.com \
    --cc=wanpengli@tencent.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).