From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Subject: Re: [PATCH] KVM: nVMX: Disable preemption while reading from shadow VMCS Date: Wed, 08 Oct 2014 22:03:35 +0200 Message-ID: <54359897.3030503@redhat.com> References: <543560D3.2030205@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: kvm , Bandan Das , Wanpeng Li , Jailhouse To: Jan Kiszka Return-path: Sender: jailhouse-dev@googlegroups.com In-Reply-To: <543560D3.2030205@siemens.com> List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , List-Id: kvm.vger.kernel.org Il 08/10/2014 18:05, Jan Kiszka ha scritto: > In order to access the shadow VMCS, we need to load it. At this point, > vmx->loaded_vmcs->vmcs and the actually loaded one start to differ. If > we now get preempted by Linux, vmx_vcpu_put and, on return, the > vmx_vcpu_load will work against the wrong vmcs. That can cause > copy_shadow_to_vmcs12 to corrupt the vmcs12 state. > > Fix the issue by disabling preemption during the copy operation. > > copy_vmcs12_to_shadow is safe from this issue as it is executed by > vmx_vcpu_run when preemption is already disabled before vmentry. > > Signed-off-by: Jan Kiszka > --- > > This fixes specifically Jailhouse in KVM on CPUs with shadow VMCS > support. Thanks. I'll add this above your SoB line: This bug is exposed by running Jailhouse within KVM on CPUs with shadow VMCS support. Jailhouse never expects an interrupt pending vmexit, but the bug can cause it if, after copy_shadow_to_vmcs12 is preempted, the active VMCS happens to have the virtual interrupt pending flag set in the CPU-based execution controls. Paolo -- You received this message because you are subscribed to the Google Groups "Jailhouse" group. To unsubscribe from this group and stop receiving emails from it, send an email to jailhouse-dev+unsubscribe@googlegroups.com. For more options, visit https://groups.google.com/d/optout.