Commit 52ad7eb3 authored Nov 13, 2018 by Liran Alon Committed by Paolo Bonzini Nov 27, 2018

KVM: nVMX: vmcs12 revision_id is always VMCS12_REVISION even when copied from eVMCS



vmcs12 represents the per-CPU cache of L1 active vmcs12.

This cache can be loaded by one of the following:
1) Guest making a vmcs12 active by exeucting VMPTRLD
2) Guest specifying eVMCS in VP assist page and executing
VMLAUNCH/VMRESUME.

Either way, vmcs12 should have revision_id of VMCS12_REVISION.
Which is not equal to eVMCS revision_id which specifies used
VersionNumber of eVMCS struct (e.g. KVM_EVMCS_VERSION).

Specifically, this causes an issue in restoring a nested VM state
because vmx_set_nested_state() verifies that vmcs12->revision_id
is equal to VMCS12_REVISION which was not true in case vmcs12
was populated from an eVMCS by vmx_get_nested_state() which calls
copy_enlightened_to_vmcs12().

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Liran Alon <liran.alon@oracle.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

parent 72aeb60c

arch/x86/kvm/vmx.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -8673,8 +8673,6 @@ static int copy_enlightened_to_vmcs12(struct vcpu_vmx *vmx)
		struct vmcs12 *vmcs12 = vmx->nested.cached_vmcs12;
		struct hv_enlightened_vmcs *evmcs = vmx->nested.hv_evmcs;

		vmcs12->hdr.revision_id = evmcs->revision_id;

		/* HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE */
		vmcs12->tpr_threshold = evmcs->tpr_threshold;
		vmcs12->guest_rip = evmcs->guest_rip;
		@@ -9422,9 +9420,11 @@ static int nested_vmx_handle_enlightened_vmptrld(struct kvm_vcpu *vcpu,
		* present in struct hv_enlightened_vmcs, ...). Make sure there
		* are no leftovers.
		*/
		if (from_launch)
		memset(vmx->nested.cached_vmcs12, 0,
		sizeof(*vmx->nested.cached_vmcs12));
		if (from_launch) {
		struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
		memset(vmcs12, 0, sizeof(*vmcs12));
		vmcs12->hdr.revision_id = VMCS12_REVISION;
		}

		}
		return 1;