linux-kernel - Re: [PATCH v3] KVM: nVMX: Fix incorrect preemption timer vmexit in nested guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 6 Jul 2016 19:11:39 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Wanpeng Li <kernellwp@...il.com>, linux-kernel@...r.kernel.org,
	kvm@...r.kernel.org, Wanpeng Li <wanpeng.li@...mail.com>,
	Radim Krčmář <rkrcmar@...hat.com>,
	Yunhong Jiang <yunhong.jiang@...el.com>,
	Jan Kiszka <jan.kiszka@...mens.com>,
	Jim Mattson <jmattson@...gle.com>
Subject: Re: [PATCH v3] KVM: nVMX: Fix incorrect preemption timer vmexit in
 nested guest



On 06/07/2016 18:03, Haozhong Zhang wrote:
>>> This patch also fixed the crash of L1 Xen with L2 HVM guest. Xen does
>>> not enable preemption timer for HVM guests, and will get panic if it
>>> receives a preemption timer vmexit.
>>
>> Thanks!  I'm still not sure why the bit is set in the vmcs02 though...
> 
> Yes, it looks really weird.
> 
> I replaced "return false" in Wanpeng's patch by
> 
>     pr_info("VMCS: preemption timer enabled = %d\n",
>             !!(vmcs_read32(PIN_BASED_VM_EXEC_CONTROL) & PIN_BASED_VMX_PREEMPTION_TIMER));
> 
> and redid my test. As expected, L1 Xen crashed due to the unexpected
> preemption timer vmexit. I got a log from above statement just before crash:
> 
>     VMCS: preemption timer enabled = 1
> 
> which is expected to be 0, because preemption timer is disabled in
> vmcs02. I also modified L1 Xen to dump VMCS at crash, and it says
> preemption timer is disabled.
> 
> I noticed Jim Mattson recently sent a patch "KVM: nVMX: Fix memory
> corruption when using VMCS shadowing" to fix the inconsistency between
> vmcs12 and its shadow. Is it relevant here? I'll test his patch
> tomorrow.

No, it shouldn't have any effect.

I think it happens when the post_block hook switches back from sw_timer
to hv_timer, and L2 is running.  So the right fix should be along the
lines of what I posted earlier.  If you don't beat me to it, I'll take
another look tomorrow.

Paolo