Hi Jan, On Wed, Oct 08, 2014 at 10:29:45AM +0200, Jan Kiszka wrote: >Hi all, > >after migrating a Jailhouse VM to a newer host platform with shadow VMCS >support I found a bug. As you may know, Jailhouse doesn't intercept >interrupts, thus also never requests an interrupt window. Nevertheless: > > qemu-system-x86-5777 [001] 74970.625324: kvm_mmio: mmio write len 4 gpa 0xfebf5008 val 0x20 qemu-system-x86-5777 [001] 74970.625325: kvm_userspace_exit: reason KVM_EXIT_MMIO (6) > qemu-system-x86-5777 [001] 74970.625330: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625333: kvm_exit: reason PENDING_INTERRUPT rip 0xffffffff81043e54 info 0 0 > qemu-system-x86-5777 [001] 74970.625333: kvm_nested_vmexit: rip: 0xffffffff81043e54 reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625334: kvm_nested_vmexit_inject: reason: PENDING_INTERRUPT ext_inf1: 0x0000000000000000 ext_inf2: 0x0000000000000000 ext_int: 0x00000000 ext_int_err: 0x00000000 > qemu-system-x86-5777 [001] 74970.625339: kvm_entry: vcpu 1 > qemu-system-x86-5777 [001] 74970.625341: kvm_exit: reason EPT_MISCONFIG rip 0xfffffffff0002307 info 0 0 > qemu-system-x86-5777 [001] 74970.625343: kvm_emulate_insn: 0:fffffffff0002307:8b 40 20 (prot64) > >And then Jailhouse crashes (which is also interesting to understand why >- L1 host state is corrupt). Anyway, the point is that we leak >CPU_BASED_VIRTUAL_INTR_PENDING from L0 into vmcs12. L0 sets it before In prepare_vmcs02: exec_control = vmx_exec_control(vmx); /* L0's desires */ exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING; exec_control &= ~CPU_BASED_VIRTUAL_NMI_PENDING; exec_control &= ~CPU_BASED_TPR_SHADOW; exec_control |= vmcs12->cpu_based_vm_exec_control; Could you point out where the other places L0 sets CPU_BASED_VIRTUAL_INTR_PENDING before entering L2? Regards, Wanpeng Li >entering L2, and then we transfer it from the hardware state to vmc12 on >exit because that VMCS field is shadowed. The crash disappears when >disabling VMCS shadowing. > >Can we simply stop shadowing CPU_BASED_VM_EXEC_CONTROL when >CPU_BASED_VIRTUAL_INTR_PENDING is injected to L2? > >Jan > >-- >Siemens AG, Corporate Technology, CT RTC ITP SES-DE >Corporate Competence Center Embedded Linux >-- >To unsubscribe from this list: send the line "unsubscribe kvm" in >the body of a message to majordomo@xxxxxxxxxxxxxxx >More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
