Re: [PATCH] KVM: nVMX: Fix IRQs inject to L2 which belong to L1 since race

Jan Kiszka
2014-07-04T09:33:20Z

On 2014-07-04 07:43, Jan Kiszka wrote:
> All tests up to
> 307621765a are running fine here, but since a0e30e712d not much is
> completing successfully anymore:
>
> enabling apic
> paging enabled
> cr0 = 80010011
> cr3 = 7fff000
> cr4 = 20
> PASS: test vmxon with FEATURE_CONTROL cleared
> PASS: test vmxon without FEATURE_CONTROL lock
> PASS: test enable VMX in FEATURE_CONTROL
> PASS: test FEATURE_CONTROL lock bit
> PASS: test vmxon
> FAIL: test vmptrld
> PASS: test vmclear
> init_vmcs : make_vmcs_current error
> FAIL: test vmptrst
> init_vmcs : make_vmcs_current error
> vmx_run : vmlaunch failed.
> FAIL: test vmlaunch
> FAIL: test vmlaunch
>
> SUMMARY: 10 tests, 4 unexpected failures

Here is the reason for my failures:

000000000000010f <make_vmcs_current>:
10f: 48 89 7c 24 f8 mov %rdi,-0x8(%rsp)
114: 9c pushfq
115: 58 pop %rax
116: 48 83 c8 41 or $0x41,%rax
11a: 50 push %rax
11b: 9d popfq
11c: 0f c7 74 24 f8 vmptrld -0x8(%rsp)
121: 0f 96 c0 setbe %al
124: 0f b6 c0 movzbl %al,%eax
127: c3 retq

The compiler is not aware of the fact that push/pop exists in this
function and, thus, places the vmcs parameter on the stack without
reserving the space. So the pushfq will overwrite the vmcs pointer and
let the function fail.

Jan

--
Siemens AG, Corporate Technology, CT RTC ITP SES-DE
Corporate Competence Center Embedded Linux