Il 08/10/2014 10:29, Jan Kiszka ha scritto: > Hi all, > > after migrating a Jailhouse VM to a newer host platform with shadow VMCS > support I found a bug. As you may know, Jailhouse doesn't intercept > interrupts, thus also never requests an interrupt window. Nevertheless: > > qemu-system-x86-5777 [001] 74970.625324: kvm_mmio: mmio write len 4 gpa 0xfebf5008 val 0x20 qemu-system-x86-5777 [001] 74970.625325: kvm_userspace_exit: reason KVM_EXIT_MMIO (6) > qemu-system-x86-5777 [001] 74970.625330: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625333: kvm_exit: reason PENDING_INTERRUPT rip 0xffffffff81043e54 info 0 0 > qemu-system-x86-5777 [001] 74970.625333: kvm_nested_vmexit: rip: 0xffffffff81043e54 reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625334: kvm_nested_vmexit_inject: reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625339: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625341: kvm_exit: reason EPT_MISCONFIG rip 0xfffffffff0002307 info 0 0 > qemu-system-x86-5777 [001] 74970.625343: kvm_emulate_insn: 0:fffffffff0002307:8b 40 20 (prot64) > > And then Jailhouse crashes (which is also interesting to understand why > - L1 host state is corrupt). Anyway, the point is that we leak > CPU_BASED_VIRTUAL_INTR_PENDING from L0 into vmcs12. L0 sets it before > entering L2, and then we transfer it from the hardware state to vmc12 on > exit because that VMCS field is shadowed. The crash disappears when > disabling VMCS shadowing. > > Can we simply stop shadowing CPU_BASED_VM_EXEC_CONTROL when > CPU_BASED_VIRTUAL_INTR_PENDING is injected to L2? The main problem is that we have a single shadowing bitmap for all virtual machines. I cannot think of a simple solution except not shadowing that field at all. Paolo -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
