On 2014-10-08 11:25, Wanpeng Li wrote: > Hi Jan, > On Wed, Oct 08, 2014 at 10:29:45AM +0200, Jan Kiszka wrote: >> Hi all, >> >> after migrating a Jailhouse VM to a newer host platform with shadow VMCS >> support I found a bug. As you may know, Jailhouse doesn't intercept >> interrupts, thus also never requests an interrupt window. Nevertheless: >> >> qemu-system-x86-5777 [001] 74970.625324: kvm_mmio: mmio write >> len 4 gpa 0xfebf5008 val 0x20 qemu-system-x86-5777 [001] 74970.625325: >> kvm_userspace_exit: reason KVM_EXIT_MMIO (6) >> qemu-system-x86-5777 [001] 74970.625330: kvm_entry: vcpu 1 >> qemu-system-x86-5777 [001] 74970.625333: kvm_exit: reason >> PENDING_INTERRUPT rip 0xffffffff81043e54 info 0 0 >> qemu-system-x86-5777 [001] 74970.625333: kvm_nested_vmexit: rip: >> 0xffffffff81043e54 reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 >> ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 >> qemu-system-x86-5777 [001] 74970.625334: kvm_nested_vmexit_inject: reason: >> PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 >> ext_int: 0x00000000 ext_int_err: 0x00000000 >> qemu-system-x86-5777 [001] 74970.625339: kvm_entry: vcpu 1 >> qemu-system-x86-5777 [001] 74970.625341: kvm_exit: reason >> EPT_MISCONFIG rip 0xfffffffff0002307 info 0 0 >> qemu-system-x86-5777 [001] 74970.625343: kvm_emulate_insn: >> 0:fffffffff0002307:8b 40 20 (prot64) >> >> And then Jailhouse crashes (which is also interesting to understand why >> - L1 host state is corrupt). Anyway, the point is that we leak >> CPU_BASED_VIRTUAL_INTR_PENDING from L0 into vmcs12. L0 sets it before > > > > In prepare_vmcs02: > > exec_control = vmx_exec_control(vmx); /* L0's desires */ > exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING; > exec_control &= ~CPU_BASED_VIRTUAL_NMI_PENDING; > exec_control &= ~CPU_BASED_TPR_SHADOW; > exec_control |= vmcs12->cpu_based_vm_exec_control; > > Could you point out where the other places L0 sets > CPU_BASED_VIRTUAL_INTR_PENDING before entering L2?
enable_irq_window(). I instrumented it, and it showed up right before vmcs12 state became corrupted. Jan -- Siemens AG, Corporate Technology, CT RTC ITP SES-DE Corporate Competence Center Embedded Linux -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
