Received-SPF: pass (google.com: domain of linux-kernel+bounces-150634-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Thu, 18 Apr 2024 11:36:57 -0700
In-Reply-To: <70f9f3f847e614cbb95be4c011ecb0a5cbd2ef34.camel@cyberus-technology.de>
Precedence: bulk
Mime-Version: 1.0
References: <20240416123558.212040-1-julian.stecklina@cyberus-technology.de>
 <Zh6MmgOqvFPuWzD9@google.com> <ecb314c53c76bc6d2233a8b4d783a15297198ef8.camel@cyberus-technology.de>
 <Zh6WlOB8CS-By3DQ@google.com> <c2ca06e2d8d7ef66800f012953b8ea4be0147c92.camel@cyberus-technology.de>
 <Zh6-e9hy7U6DD2QM@google.com> <adb07a02b3923eeb49f425d38509b340f4837e17.camel@cyberus-technology.de>
 <Zh_0sJPPoHKce5Ky@google.com> <70f9f3f847e614cbb95be4c011ecb0a5cbd2ef34.camel@cyberus-technology.de>
Message-ID: <ZiFoSdKY7nrh7cfL@google.com>
Subject: Re: [PATCH 1/2] KVM: nVMX: fix CR4_READ_SHADOW when L0 updates CR4
 during a signal
From: Sean Christopherson <seanjc@google.com>
To: Thomas Prescher <thomas.prescher@cyberus-technology.de>
Cc: "mingo@redhat.com" <mingo@redhat.com>, "x86@kernel.org" <x86@kernel.org>, 
	"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>, "hpa@zytor.com" <hpa@zytor.com>, 
	Julian Stecklina <julian.stecklina@cyberus-technology.de>, 
	"tglx@linutronix.de" <tglx@linutronix.de>, "bp@alien8.de" <bp@alien8.de>, 
	"pbonzini@redhat.com" <pbonzini@redhat.com>, "kvm@vger.kernel.org" <kvm@vger.kernel.org>, 
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Apr 18, 2024, Thomas Prescher wrote:
> You are right. After your pointers and looking at the nesting code
> again, I think I know what to do. Just to make sure I understand this
> correctly:=C2=A0
>=20
> If L0 exits with L2 state, KVM_GET_NESTED_STATE will have
> KVM_STATE_NESTED_RUN_PENDING set in the flags field.

Not necessarily.  KVM_STATE_NESTED_GUEST_MODE is the flag that says "L2 sta=
te is
loaded", the NESTED_RUN_PENDING flag is effectively a modifier on top of th=
at.

KVM_STATE_NESTED_RUN_PENDING is set when userspace interrupts KVM in the mi=
ddle
of nested VM-Enter emulation.  In that case, KVM needs to complete emulatio=
n of
the VM-Enter instruction (VMLAUNCH, VMRESUME, or VMRUN) before doing anythi=
ng.
I.e. KVM has loaded L2 state and is committed to completing VM-Enter, but h=
asn't
actually done so yet.

In retrospect, KVM probably should have forced userspace to call back into =
KVM to
complete emulation before allowing KVM_GET_NESTED_STATE to succeed, but it'=
s a
minor blip.

> So when we restore the vCPU state after a vmsave/vmload cycle, we don't n=
eed
> to update anything in kvm_run.s.regs because KVM will enter the L2
> immediately.  Is that correct?

No?  Presumably your touching vCPU state, otherwise you wouldn't be doing
vmsave/vmload.  And if you touch vCPU state, then you need to restore the o=
ld
state for things to work.

Again, what are you trying to do, at a higher level?  I.e. _why_ are you do=
ing
a save/restore cycle?  If it's for something akin to live migration, where =
you
need to save and restore *everything*, then stating the obvious, you need t=
o
save and restore everything in KVM too, which includes nested state.