Re: nVMX: Shadowing of CPU_BASED_VM_EXEC_CONTROL broken

[Jan Kiszka <jan.kiszka@siemens.com>]

On 2014-10-08 11:25, Wanpeng Li wrote:
> Hi Jan,
> On Wed, Oct 08, 2014 at 10:29:45AM +0200, Jan Kiszka wrote:
>> Hi all,
>>
>> after migrating a Jailhouse VM to a newer host platform with shadow VMCS
>> support I found a bug. As you may know, Jailhouse doesn't intercept
>> interrupts, thus also never requests an interrupt window. Nevertheless:
>>
>> qemu-system-x86-5777  [001] 74970.625324: kvm_mmio:             mmio write len 4 gpa 0xfebf5008 val 0x20 qemu-system-x86-5777  [001] 74970.625325: kvm_userspace_exit:   reason KVM_EXIT_MMIO (6)
>> qemu-system-x86-5777  [001] 74970.625330: kvm_entry:            vcpu 1
>> qemu-system-x86-5777  [001] 74970.625333: kvm_exit:             reason PENDING_INTERRUPT rip 0xffffffff81043e54 info 0 0
>> qemu-system-x86-5777  [001] 74970.625333: kvm_nested_vmexit:    rip: 0xffffffff81043e54 reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000
>> qemu-system-x86-5777  [001] 74970.625334: kvm_nested_vmexit_inject: reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000
>> qemu-system-x86-5777  [001] 74970.625339: kvm_entry:            vcpu 1
>> qemu-system-x86-5777  [001] 74970.625341: kvm_exit:             reason EPT_MISCONFIG rip 0xfffffffff0002307 info 0 0
>> qemu-system-x86-5777  [001] 74970.625343: kvm_emulate_insn:     0:fffffffff0002307:8b 40 20 (prot64)
>>
>> And then Jailhouse crashes (which is also interesting to understand why
>> - L1 host state is corrupt). Anyway, the point is that we leak
>> CPU_BASED_VIRTUAL_INTR_PENDING from L0 into vmcs12. L0 sets it before
> 																					
> In prepare_vmcs02:
> 
> exec_control = vmx_exec_control(vmx); /* L0's desires */
> exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING;
> exec_control &= ~CPU_BASED_VIRTUAL_NMI_PENDING;
> exec_control &= ~CPU_BASED_TPR_SHADOW;
> exec_control |= vmcs12->cpu_based_vm_exec_control;
> 
> Could you point out where the other places L0 sets
> CPU_BASED_VIRTUAL_INTR_PENDING before entering L2?

enable_irq_window(). I instrumented it, and it showed up right before
vmcs12 state became corrupted.

Jan

-- 
Siemens AG, Corporate Technology, CT RTC ITP SES-DE
Corporate Competence Center Embedded Linux