KVM: nVMX: Treat eVMCS as enabled for guest iff Hyper-V is also enabled
authorSean Christopherson <seanjc@google.com>
Tue, 30 Aug 2022 13:37:10 +0000 (15:37 +0200)
committerPaolo Bonzini <pbonzini@redhat.com>
Mon, 26 Sep 2022 16:02:40 +0000 (12:02 -0400)
When querying whether or not eVMCS is enabled on behalf of the guest,
treat eVMCS as enable if and only if Hyper-V is enabled/exposed to the
guest.

Note, flows that come from the host, e.g. KVM_SET_NESTED_STATE, must NOT
check for Hyper-V being enabled as KVM doesn't require guest CPUID to be
set before most ioctls().

Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20220830133737.1539624-7-vkuznets@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/kvm/vmx/evmcs.c
arch/x86/kvm/vmx/nested.c
arch/x86/kvm/vmx/vmx.c
arch/x86/kvm/vmx/vmx.h

index 6a61b1ae794209d01c8e18a0b71e8830d8292b23..9139c70b6008a4a707f797259451d40e3180aa7d 100644 (file)
@@ -334,6 +334,9 @@ uint16_t nested_get_evmcs_version(struct kvm_vcpu *vcpu)
         * versions: lower 8 bits is the minimal version, higher 8 bits is the
         * maximum supported version. KVM supports versions from 1 to
         * KVM_EVMCS_VERSION.
+        *
+        * Note, do not check the Hyper-V is fully enabled in guest CPUID, this
+        * helper is used to _get_ the vCPU's supported CPUID.
         */
        if (kvm_cpu_cap_get(X86_FEATURE_VMX) &&
            (!vcpu || to_vmx(vcpu)->nested.enlightened_vmcs_enabled))
index f963e5ce0a28868346738366c1ea571a7e34e966..dd5fad2567de8bb7eec5aa66780a919f9c6ff269 100644 (file)
@@ -1982,7 +1982,7 @@ static enum nested_evmptrld_status nested_vmx_handle_enlightened_vmptrld(
        bool evmcs_gpa_changed = false;
        u64 evmcs_gpa;
 
-       if (likely(!vmx->nested.enlightened_vmcs_enabled))
+       if (likely(!guest_cpuid_has_evmcs(vcpu)))
                return EVMPTRLD_DISABLED;
 
        if (!nested_enlightened_vmentry(vcpu, &evmcs_gpa)) {
@@ -2863,7 +2863,7 @@ static int nested_vmx_check_controls(struct kvm_vcpu *vcpu,
            nested_check_vm_entry_controls(vcpu, vmcs12))
                return -EINVAL;
 
-       if (to_vmx(vcpu)->nested.enlightened_vmcs_enabled)
+       if (guest_cpuid_has_evmcs(vcpu))
                return nested_evmcs_check_controls(vmcs12);
 
        return 0;
@@ -3145,7 +3145,7 @@ static bool nested_get_evmcs_page(struct kvm_vcpu *vcpu)
         * L2 was running), map it here to make sure vmcs12 changes are
         * properly reflected.
         */
-       if (vmx->nested.enlightened_vmcs_enabled &&
+       if (guest_cpuid_has_evmcs(vcpu) &&
            vmx->nested.hv_evmcs_vmptr == EVMPTR_MAP_PENDING) {
                enum nested_evmptrld_status evmptrld_status =
                        nested_vmx_handle_enlightened_vmptrld(vcpu, false);
@@ -5077,7 +5077,7 @@ static int handle_vmclear(struct kvm_vcpu *vcpu)
         * state. It is possible that the area will stay mapped as
         * vmx->nested.hv_evmcs but this shouldn't be a problem.
         */
-       if (likely(!vmx->nested.enlightened_vmcs_enabled ||
+       if (likely(!guest_cpuid_has_evmcs(vcpu) ||
                   !nested_enlightened_vmentry(vcpu, &evmcs_gpa))) {
                if (vmptr == vmx->nested.current_vmptr)
                        nested_release_vmcs12(vcpu);
index e243a96d59b4e1f4af4c7dc914eda5f39a8055bf..8ab46d4b6d781451826e6e161be692fc19cf6998 100644 (file)
@@ -1930,8 +1930,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 * sanity checking and refuse to boot. Filter all unsupported
                 * features out.
                 */
-               if (!msr_info->host_initiated &&
-                   vmx->nested.enlightened_vmcs_enabled)
+               if (!msr_info->host_initiated && guest_cpuid_has_evmcs(vcpu))
                        nested_evmcs_filter_control_msr(msr_info->index,
                                                        &msr_info->data);
                break;
index 24d58c2ffaa3d9dd4f4a6abcb12791abbe1b2a36..35c7e6aef30162627c9f24caebab5b47b4d9729b 100644 (file)
@@ -626,4 +626,14 @@ static inline bool vmx_can_use_ipiv(struct kvm_vcpu *vcpu)
        return  lapic_in_kernel(vcpu) && enable_ipiv;
 }
 
+static inline bool guest_cpuid_has_evmcs(struct kvm_vcpu *vcpu)
+{
+       /*
+        * eVMCS is exposed to the guest if Hyper-V is enabled in CPUID and
+        * eVMCS has been explicitly enabled by userspace.
+        */
+       return vcpu->arch.hyperv_enabled &&
+              to_vmx(vcpu)->nested.enlightened_vmcs_enabled;
+}
+
 #endif /* __KVM_X86_VMX_H */