From mboxrd@z Thu Jan 1 00:00:00 1970 From: Wanpeng Li Subject: Re: nVMX: Shadowing of CPU_BASED_VM_EXEC_CONTROL broken Date: Wed, 8 Oct 2014 17:25:39 +0800 Message-ID: <20141008092539.GA16561@kernel> References: <5434F5F9.3030803@siemens.com> Reply-To: Wanpeng Li Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: kvm , Paolo Bonzini , Bandan Das To: Jan Kiszka Return-path: Received: from mga11.intel.com ([192.55.52.93]:45073 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755090AbaJHJqU (ORCPT ); Wed, 8 Oct 2014 05:46:20 -0400 Content-Disposition: inline In-Reply-To: <5434F5F9.3030803@siemens.com> Sender: kvm-owner@vger.kernel.org List-ID: Hi Jan, On Wed, Oct 08, 2014 at 10:29:45AM +0200, Jan Kiszka wrote: >Hi all, > >after migrating a Jailhouse VM to a newer host platform with shadow VMCS >support I found a bug. As you may know, Jailhouse doesn't intercept >interrupts, thus also never requests an interrupt window. Nevertheless: > > qemu-system-x86-5777 [001] 74970.625324: kvm_mmio: mmio write len 4 gpa 0xfebf5008 val 0x20 qemu-system-x86-5777 [001] 74970.625325: kvm_userspace_exit: reason KVM_EXIT_MMIO (6) > qemu-system-x86-5777 [001] 74970.625330: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625333: kvm_exit: reason PENDING_INTERRUPT rip 0xffffffff81043e54 info 0 0 > qemu-system-x86-5777 [001] 74970.625333: kvm_nested_vmexit: rip: 0xffffffff81043e54 reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625334: kvm_nested_vmexit_inject: reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625339: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625341: kvm_exit: reason EPT_MISCONFIG rip 0xfffffffff0002307 info 0 0 > qemu-system-x86-5777 [001] 74970.625343: kvm_emulate_insn: 0:fffffffff0002307:8b 40 20 (prot64) > >And then Jailhouse crashes (which is also interesting to understand why >- L1 host state is corrupt). Anyway, the point is that we leak >CPU_BASED_VIRTUAL_INTR_PENDING from L0 into vmcs12. L0 sets it before In prepare_vmcs02: exec_control = vmx_exec_control(vmx); /* L0's desires */ exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING; exec_control &= ~CPU_BASED_VIRTUAL_NMI_PENDING; exec_control &= ~CPU_BASED_TPR_SHADOW; exec_control |= vmcs12->cpu_based_vm_exec_control; Could you point out where the other places L0 sets CPU_BASED_VIRTUAL_INTR_PENDING before entering L2? Regards, Wanpeng Li >entering L2, and then we transfer it from the hardware state to vmc12 on >exit because that VMCS field is shadowed. The crash disappears when >disabling VMCS shadowing. > >Can we simply stop shadowing CPU_BASED_VM_EXEC_CONTROL when >CPU_BASED_VIRTUAL_INTR_PENDING is injected to L2? > >Jan > >-- >Siemens AG, Corporate Technology, CT RTC ITP SES-DE >Corporate Competence Center Embedded Linux >-- >To unsubscribe from this list: send the line "unsubscribe kvm" in >the body of a message to majordomo@vger.kernel.org >More majordomo info at http://vger.kernel.org/majordomo-info.html