From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754758AbcGFNdE (ORCPT ); Wed, 6 Jul 2016 09:33:04 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35260 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754078AbcGFNdA (ORCPT ); Wed, 6 Jul 2016 09:33:00 -0400 Subject: Re: [PATCH v3] KVM: nVMX: Fix incorrect preemption timer vmexit in nested guest To: Wanpeng Li , linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Wanpeng Li , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Yunhong Jiang , Jan Kiszka References: <1467805375-4676-1-git-send-email-wanpeng.li@hotmail.com> <20160706132601.qxcn7sm365xf6pos@hz-desktop> From: Paolo Bonzini Message-ID: <65eb56ae-c55d-cca4-d685-83413621bb9a@redhat.com> Date: Wed, 6 Jul 2016 15:32:54 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <20160706132601.qxcn7sm365xf6pos@hz-desktop> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 06 Jul 2016 13:32:59 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/07/2016 15:26, Haozhong Zhang wrote: > On 07/06/16 19:42, Wanpeng Li wrote: >> From: Wanpeng Li >> >> BUG: unable to handle kernel NULL pointer dereference at (null) >> IP: [< (null)>] (null) >> PGD 0 >> Oops: 0010 [#1] SMP >> Call Trace: >> ? kvm_lapic_expired_hv_timer+0x47/0x90 [kvm] >> handle_preemption_timer+0xe/0x20 [kvm_intel] >> vmx_handle_exit+0x169/0x15a0 [kvm_intel] >> ? kvm_arch_vcpu_ioctl_run+0xd5d/0x19d0 [kvm] >> kvm_arch_vcpu_ioctl_run+0xdee/0x19d0 [kvm] >> ? kvm_arch_vcpu_ioctl_run+0xd5d/0x19d0 [kvm] >> ? vcpu_load+0x1c/0x60 [kvm] >> ? kvm_arch_vcpu_load+0x57/0x260 [kvm] >> kvm_vcpu_ioctl+0x2d3/0x7c0 [kvm] >> do_vfs_ioctl+0x96/0x6a0 >> ? __fget_light+0x2a/0x90 >> SyS_ioctl+0x79/0x90 >> do_syscall_64+0x68/0x180 >> entry_SYSCALL64_slow_path+0x25/0x25 >> Code: Bad RIP value. >> RIP [< (null)>] (null) >> RSP >> CR2: 0000000000000000 >> ---[ end trace 9c70c48b1a2bc66e ]--- >> >> This can be reproduced readily by preemption timer enabled on L0 and disabled >> on L1. >> >> Preemption timer for nested VMX is emulated by hrtimer which is started on L2 >> entry, stopped on L2 exit and evaluated via the check_nested_events hook. However, >> nested_vmx_exit_handled is always return true for preemption timer vmexit, then >> the L1 preemption timer vmexit is captured and be treated as a L2 preemption >> timer vmexit, incurr a nested vmexit dereference NULL pointer. >> >> This patch fix it by depending on check_nested_events to capture L2 preemption >> timer(emulated hrtimer) expire and nested vmexit. >> >> Cc: Paolo Bonzini >> Cc: Radim Krčmář >> Cc: Yunhong Jiang >> Cc: Jan Kiszka >> Cc: Haozhong Zhang >> Signed-off-by: Wanpeng Li >> --- >> v2 -> v3: >> * update patch subject >> v1 -> v2: >> * fix typo in patch description >> >> arch/x86/kvm/vmx.c | 2 ++ >> 1 file changed, 2 insertions(+) >> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >> index 85e2f0a..29c16a8 100644 >> --- a/arch/x86/kvm/vmx.c >> +++ b/arch/x86/kvm/vmx.c >> @@ -8041,6 +8041,8 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) >> return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES); >> case EXIT_REASON_PCOMMIT: >> return nested_cpu_has2(vmcs12, SECONDARY_EXEC_PCOMMIT); >> + case EXIT_REASON_PREEMPTION_TIMER: >> + return false; >> default: >> return true; >> } >> -- >> 1.9.1 >> > > This patch also fixed the crash of L1 Xen with L2 HVM guest. Xen does > not enable preemption timer for HVM guests, and will get panic if it > receives a preemption timer vmexit. Thanks! I'm still not sure why the bit is set in the vmcs02 though... Paolo