From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754813AbbLKKlh (ORCPT ); Fri, 11 Dec 2015 05:41:37 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46071 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751298AbbLKKlf (ORCPT ); Fri, 11 Dec 2015 05:41:35 -0500 Subject: Re: [PATCH] kvm: x86: move tracepoints outside extended quiescent state To: Borislav Petkov References: <1449769137-8668-1-git-send-email-pbonzini@redhat.com> <20151210180945.GB3831@pd.tnic> <5669C137.7080601@redhat.com> <20151211102244.GA3660@pd.tnic> Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, =?UTF-8?B?SsO2cmcgUsO2ZGVs?= From: Paolo Bonzini X-Enigmail-Draft-Status: N1110 Message-ID: <566AA85A.9000507@redhat.com> Date: Fri, 11 Dec 2015 11:41:30 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <20151211102244.GA3660@pd.tnic> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/12/2015 11:22, Borislav Petkov wrote: > On Thu, Dec 10, 2015 at 07:15:19PM +0100, Paolo Bonzini wrote: >> Yeah, wait_lapic_expire also have to be moved before __kvm_guest_enter. > > Yeah, v2 doesn't splat on the Intel box anymore but the AMD box still > has, and it is a different problem. With the v2 applied, it still > explodes, see below. Yes, I didn't expect it to fix anything. I just wanted to pinpoint it to kvm-amd. > And I'm willing to bet good money on that shadow pages fun. You can disable it (well, make it take a few days to appear) with this: diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 484079efea5b..a9070e260c72 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -496,7 +496,7 @@ static struct kvm_memslots *kvm_alloc_memslots(void) * Init kvm generation close to the maximum to easily test the * code of handling generation number wrap-around. */ - slots->generation = -150; + slots->generation = 0; for (i = 0; i < KVM_MEM_SLOTS_NUM; i++) slots->id_to_index[i] = slots->memslots[i].id = i; but it would not be AMD-specific. Anyway if this theory is true: > [ 959.466549] kernel tried to execute NX-protected page - exploit attempt? (uid: 1000) > > line basically says that we're pagefaulting when trying to fetch > instructions, i.e., we're trying to execute something from a page, rIP > points to 0xffff8800b9f9bdf0 and that is most likely a page belonging to > kvm, which, however, is for some reason not executable (anymore?). It would be a kvm hypervisor page, not a kvm guest page, hence unrelated to the zapping thing. Can you grab the kallsyms before making it crash? I will get to it next week. Paolo