From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gleb Natapov Subject: Re: __schedule #DF splat Date: Sun, 29 Jun 2014 17:27:22 +0300 Message-ID: <20140629142722.GH18167@minantech.com> References: <53AFE2B3.5080300@web.de> <20140629102403.GE18167@minantech.com> <53AFEB16.5040608@web.de> <20140629105339.GF18167@minantech.com> <53AFF192.7020801@web.de> <20140629115143.GA4362@pd.tnic> <53B0050B.90104@web.de> <20140629131443.GA5199@pd.tnic> <20140629134247.GG18167@minantech.com> <20140629140104.GB12528@pd.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Jan Kiszka , Paolo Bonzini , lkml , Peter Zijlstra , Steven Rostedt , x86-ml , kvm@vger.kernel.org, =?utf-8?B?SsO2cmcgUsO2ZGVs?= To: Borislav Petkov Return-path: Received: from mail-wi0-f170.google.com ([209.85.212.170]:56107 "EHLO mail-wi0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750771AbaF2O11 (ORCPT ); Sun, 29 Jun 2014 10:27:27 -0400 Received: by mail-wi0-f170.google.com with SMTP id cc10so4634104wib.3 for ; Sun, 29 Jun 2014 07:27:26 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20140629140104.GB12528@pd.tnic> Sender: kvm-owner@vger.kernel.org List-ID: On Sun, Jun 29, 2014 at 04:01:04PM +0200, Borislav Petkov wrote: > On Sun, Jun 29, 2014 at 04:42:47PM +0300, Gleb Natapov wrote: > > Please do so and let us know. > > Yep, just did. Reverting ae9fedc793 fixes the issue. > > > reinj:1 means that previous injection failed due to another #PF that > > happened during the event injection itself This may happen if GDT or fist > > instruction of a fault handler is not mapped by shadow pages, but here > > it says that the new page fault is at the same address as the previous > > one as if GDT is or #PF handler is mapped there. Strange. Especially > > since #DF is injected successfully, so GDT should be fine. May be wrong > > cpl makes svm crazy? > > Well, I'm not going to even pretend to know kvm to know *when* we're > saving VMCB state but if we're saving the wrong CPL and then doing the > pagetable walk, I can very well imagine if the walker gets confused. One > possible issue could be U/S bit (bit 2) in the PTE bits which allows > access to supervisor pages only when CPL < 3. I.e., CPL has effect on > pagetable walk and a wrong CPL level could break it. > > All a conjecture though... > Looks plausible, still strange that second #PF is at the same address as the first one though. Anyway, not we have the commit to blame. -- Gleb.