From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Subject: Re: nVMX: Shadowing of CPU_BASED_VM_EXEC_CONTROL broken Date: Wed, 08 Oct 2014 10:47:52 +0200 Message-ID: <5434FA38.5040601@redhat.com> References: <5434F5F9.3030803@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: Jan Kiszka , kvm , Bandan Das Return-path: Received: from mx1.redhat.com ([209.132.183.28]:49774 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755180AbaJHIr6 (ORCPT ); Wed, 8 Oct 2014 04:47:58 -0400 In-Reply-To: <5434F5F9.3030803@siemens.com> Sender: kvm-owner@vger.kernel.org List-ID: Il 08/10/2014 10:29, Jan Kiszka ha scritto: > Hi all, > > after migrating a Jailhouse VM to a newer host platform with shadow VMCS > support I found a bug. As you may know, Jailhouse doesn't intercept > interrupts, thus also never requests an interrupt window. Nevertheless: > > qemu-system-x86-5777 [001] 74970.625324: kvm_mmio: mmio write len 4 gpa 0xfebf5008 val 0x20 qemu-system-x86-5777 [001] 74970.625325: kvm_userspace_exit: reason KVM_EXIT_MMIO (6) > qemu-system-x86-5777 [001] 74970.625330: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625333: kvm_exit: reason PENDING_INTERRUPT rip 0xffffffff81043e54 info 0 0 > qemu-system-x86-5777 [001] 74970.625333: kvm_nested_vmexit: rip: 0xffffffff81043e54 reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625334: kvm_nested_vmexit_inject: reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625339: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625341: kvm_exit: reason EPT_MISCONFIG rip 0xfffffffff0002307 info 0 0 > qemu-system-x86-5777 [001] 74970.625343: kvm_emulate_insn: 0:fffffffff0002307:8b 40 20 (prot64) > > And then Jailhouse crashes (which is also interesting to understand why > - L1 host state is corrupt). Anyway, the point is that we leak > CPU_BASED_VIRTUAL_INTR_PENDING from L0 into vmcs12. L0 sets it before > entering L2, and then we transfer it from the hardware state to vmc12 on > exit because that VMCS field is shadowed. The crash disappears when > disabling VMCS shadowing. > > Can we simply stop shadowing CPU_BASED_VM_EXEC_CONTROL when > CPU_BASED_VIRTUAL_INTR_PENDING is injected to L2? The main problem is that we have a single shadowing bitmap for all virtual machines. I cannot think of a simple solution except not shadowing that field at all. Paolo