From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: nVMX: Shadowing of CPU_BASED_VM_EXEC_CONTROL broken
Date: Wed, 08 Oct 2014 17:44:25 +0200
Message-ID: <54355BD9.3010201@redhat.com>
References: <5434F5F9.3030803@siemens.com> <20141008092539.GA16561@kernel> <5435092A.3090704@siemens.com> <54350FD4.10403@redhat.com> <543511FE.3060108@siemens.com> <54351336.4030005@redhat.com> <54355344.5050301@siemens.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit
Cc: kvm <kvm@vger.kernel.org>, Bandan Das <bsd@redhat.com>
To: Jan Kiszka <jan.kiszka@siemens.com>,
	Wanpeng Li <wanpeng.li@linux.intel.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx1.redhat.com ([209.132.183.28]:31056 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751029AbaJHPoc (ORCPT <rfc822;kvm@vger.kernel.org>);
	Wed, 8 Oct 2014 11:44:32 -0400
In-Reply-To: <54355344.5050301@siemens.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

Il 08/10/2014 17:07, Jan Kiszka ha scritto:
> As usual, this was a nasty race that involved some concurrent VCPUs and
> proper host load, so hard to write unit tests...
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 04fa1b8..d6bcaca 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -6417,6 +6417,8 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
>  	const unsigned long *fields = shadow_read_write_fields;
>  	const int num_fields = max_shadow_read_write_fields;
>  
> +	preempt_disable();
> +
>  	vmcs_load(shadow_vmcs);
>  
>  	for (i = 0; i < num_fields; i++) {
> @@ -6440,6 +6442,8 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
>  
>  	vmcs_clear(shadow_vmcs);
>  	vmcs_load(vmx->loaded_vmcs->vmcs);
> +
> +	preempt_enable();
>  }
>  
>  static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
> @@ -6457,6 +6461,8 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
>  	u64 field_value = 0;
>  	struct vmcs *shadow_vmcs = vmx->nested.current_shadow_vmcs;
>  
> +	preempt_disable();
> +
>  	vmcs_load(shadow_vmcs);
>  
>  	for (q = 0; q < ARRAY_SIZE(fields); q++) {
> @@ -6483,6 +6489,8 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
>  
>  	vmcs_clear(shadow_vmcs);
>  	vmcs_load(vmx->loaded_vmcs->vmcs);
> +
> +	preempt_enable();
>  }
>  
> No proper patch yet because there might be a smarter approach without
> using the preempt_disable() hammer.

copy_vmcs12_to_shadow already runs with preemption disabled; for stable@
it's not that bad to do the same in copy_shadow_to_vmcs12.

For 3.18 it could be nice of course to use loaded_vmcs properly, but it
would also incur some overhead.

Paolo

> But the point is that we temporarily
> load a vmcs without updating loaded_vmcs->vmcs. Now, if some other VCPU
> is scheduling in right in the middle of this, the wrong vmcs will be
> flushed and then reloaded - e.g. a non-shadow vmcs with that interrupt
> window flag set...
> 
> Patch is currently under heavy load testing here, but it looks very good
> as the bug was quickly reproducible before I applied it.