From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gleb Natapov Subject: Re: [PATCH 05/10] KVM: nVMX: Allocate shadow vmcs Date: Thu, 18 Apr 2013 09:38:43 +0300 Message-ID: <20130418063843.GG8997@redhat.com> References: <1366218306-abelg@il.ibm.com> <20130417170740.3C8D87B802A@moren.haifa.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: kvm@vger.kernel.org, owasserm@redhat.com, nadav@harel.org.il, jun.nakajima@intel.com, dongxiao.xu@intel.com To: Abel Gordon Return-path: Received: from mx1.redhat.com ([209.132.183.28]:48167 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752567Ab3DRGix (ORCPT ); Thu, 18 Apr 2013 02:38:53 -0400 Content-Disposition: inline In-Reply-To: <20130417170740.3C8D87B802A@moren.haifa.ibm.com> Sender: kvm-owner@vger.kernel.org List-ID: On Wed, Apr 17, 2013 at 08:07:40PM +0300, Abel Gordon wrote: > Allocate a shadow vmcs used by the processor to shadow part of the fields > stored in the software defined VMCS12 (let L1 access fields without causing > exits). Note we keep a shadow vmcs only for the current vmcs12. Once a vmcs12 > becomes non-current, its shadow vmcs is released. > > > Signed-off-by: Abel Gordon > --- > arch/x86/kvm/vmx.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > --- .before/arch/x86/kvm/vmx.c 2013-04-17 19:58:32.000000000 +0300 > +++ .after/arch/x86/kvm/vmx.c 2013-04-17 19:58:32.000000000 +0300 > @@ -355,6 +355,7 @@ struct nested_vmx { > /* The host-usable pointer to the above */ > struct page *current_vmcs12_page; > struct vmcs12 *current_vmcs12; > + struct vmcs *current_shadow_vmcs; > > /* vmcs02_list cache of VMCSs recently used to run L2 guests */ > struct list_head vmcs02_pool; > @@ -5517,6 +5518,7 @@ static int handle_vmon(struct kvm_vcpu * > { > struct kvm_segment cs; > struct vcpu_vmx *vmx = to_vmx(vcpu); > + struct vmcs *shadow_vmcs; > > /* The Intel VMX Instruction Reference lists a bunch of bits that > * are prerequisite to running VMXON, most notably cr4.VMXE must be > @@ -5540,6 +5542,16 @@ static int handle_vmon(struct kvm_vcpu * > kvm_inject_gp(vcpu, 0); > return 1; > } > + if (enable_shadow_vmcs) { > + shadow_vmcs = alloc_vmcs(); > + if (!shadow_vmcs) > + return -ENOMEM; > + /* mark vmcs as shadow */ > + shadow_vmcs->revision_id |= (1u << 31); > + /* init shadow vmcs */ > + vmcs_clear(shadow_vmcs); > + vmx->nested.current_shadow_vmcs = shadow_vmcs; > + } > Guest can ddos host by calling vmxon repeatedly causing host to leak memory. This point to a bug in vmxon implementation. vmxon should call nested_vmx_failInvalid() if (vmx->nested.vmxon). > INIT_LIST_HEAD(&(vmx->nested.vmcs02_pool)); > vmx->nested.vmcs02_num = 0; > > -- > To unsubscribe from this list: send the line "unsubscribe kvm" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Gleb.