Commit bfcf83b1 authored by Wanpeng Li's avatar Wanpeng Li Committed by Paolo Bonzini

KVM: nVMX: Fix trying to cancel vmlauch/vmresume

------------[ cut here ]------------
WARNING: CPU: 7 PID: 3861 at /home/kernel/ssd/kvm/arch/x86/kvm//vmx.c:11299 nested_vmx_vmexit+0x176e/0x1980 [kvm_intel]
CPU: 7 PID: 3861 Comm: qemu-system-x86 Tainted: G        W  OE   4.13.0-rc4+ #11
RIP: 0010:nested_vmx_vmexit+0x176e/0x1980 [kvm_intel]
Call Trace:
 ? kvm_multiple_exception+0x149/0x170 [kvm]
 ? handle_emulation_failure+0x79/0x230 [kvm]
 ? load_vmcs12_host_state+0xa80/0xa80 [kvm_intel]
 ? check_chain_key+0x137/0x1e0
 ? reexecute_instruction.part.168+0x130/0x130 [kvm]
 nested_vmx_inject_exception_vmexit+0xb7/0x100 [kvm_intel]
 ? nested_vmx_inject_exception_vmexit+0xb7/0x100 [kvm_intel]
 vmx_queue_exception+0x197/0x300 [kvm_intel]
 kvm_arch_vcpu_ioctl_run+0x1b0c/0x2c90 [kvm]
 ? kvm_arch_vcpu_runnable+0x220/0x220 [kvm]
 ? preempt_count_sub+0x18/0xc0
 ? restart_apic_timer+0x17d/0x300 [kvm]
 ? kvm_lapic_restart_hv_timer+0x37/0x50 [kvm]
 ? kvm_arch_vcpu_load+0x1d8/0x350 [kvm]
 kvm_vcpu_ioctl+0x4e4/0x910 [kvm]
 ? kvm_vcpu_ioctl+0x4e4/0x910 [kvm]
 ? kvm_dev_ioctl+0xbe0/0xbe0 [kvm]

The flag "nested_run_pending", which can override the decision of which should run
next, L1 or L2. nested_run_pending=1 means that we *must* run L2 next, not L1. This
is necessary in particular when L1 did a VMLAUNCH of L2 and therefore expects L2 to
be run (and perhaps be injected with an event it specified, etc.). Nested_run_pending
is especially intended to avoid switching  to L1 in the injection decision-point.

This can be handled just like the other cases in vmx_check_nested_events, instead of
having a special case in vmx_queue_exception.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: default avatarWanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 664f8e26
...@@ -2472,15 +2472,14 @@ static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu, ...@@ -2472,15 +2472,14 @@ static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu,
* KVM wants to inject page-faults which it got to the guest. This function * KVM wants to inject page-faults which it got to the guest. This function
* checks whether in a nested guest, we need to inject them to L1 or L2. * checks whether in a nested guest, we need to inject them to L1 or L2.
*/ */
static int nested_vmx_check_exception(struct kvm_vcpu *vcpu) static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned long *exit_qual)
{ {
struct vmcs12 *vmcs12 = get_vmcs12(vcpu); struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
unsigned int nr = vcpu->arch.exception.nr; unsigned int nr = vcpu->arch.exception.nr;
if (nr == PF_VECTOR) { if (nr == PF_VECTOR) {
if (vcpu->arch.exception.nested_apf) { if (vcpu->arch.exception.nested_apf) {
nested_vmx_inject_exception_vmexit(vcpu, *exit_qual = vcpu->arch.apf.nested_apf_token;
vcpu->arch.apf.nested_apf_token);
return 1; return 1;
} }
/* /*
...@@ -2494,16 +2493,15 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu) ...@@ -2494,16 +2493,15 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu)
*/ */
if (nested_vmx_is_page_fault_vmexit(vmcs12, if (nested_vmx_is_page_fault_vmexit(vmcs12,
vcpu->arch.exception.error_code)) { vcpu->arch.exception.error_code)) {
nested_vmx_inject_exception_vmexit(vcpu, vcpu->arch.cr2); *exit_qual = vcpu->arch.cr2;
return 1; return 1;
} }
} else { } else {
unsigned long exit_qual = 0;
if (nr == DB_VECTOR)
exit_qual = vcpu->arch.dr6;
if (vmcs12->exception_bitmap & (1u << nr)) { if (vmcs12->exception_bitmap & (1u << nr)) {
nested_vmx_inject_exception_vmexit(vcpu, exit_qual); if (nr == DB_VECTOR)
*exit_qual = vcpu->arch.dr6;
else
*exit_qual = 0;
return 1; return 1;
} }
} }
...@@ -2516,14 +2514,9 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu) ...@@ -2516,14 +2514,9 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu)
struct vcpu_vmx *vmx = to_vmx(vcpu); struct vcpu_vmx *vmx = to_vmx(vcpu);
unsigned nr = vcpu->arch.exception.nr; unsigned nr = vcpu->arch.exception.nr;
bool has_error_code = vcpu->arch.exception.has_error_code; bool has_error_code = vcpu->arch.exception.has_error_code;
bool reinject = vcpu->arch.exception.injected;
u32 error_code = vcpu->arch.exception.error_code; u32 error_code = vcpu->arch.exception.error_code;
u32 intr_info = nr | INTR_INFO_VALID_MASK; u32 intr_info = nr | INTR_INFO_VALID_MASK;
if (!reinject && is_guest_mode(vcpu) &&
nested_vmx_check_exception(vcpu))
return;
if (has_error_code) { if (has_error_code) {
vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code); vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
intr_info |= INTR_INFO_DELIVER_CODE_MASK; intr_info |= INTR_INFO_DELIVER_CODE_MASK;
...@@ -11011,10 +11004,20 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu, ...@@ -11011,10 +11004,20 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu,
static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr) static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr)
{ {
struct vcpu_vmx *vmx = to_vmx(vcpu); struct vcpu_vmx *vmx = to_vmx(vcpu);
unsigned long exit_qual;
if (kvm_event_needs_reinjection(vcpu)) if (kvm_event_needs_reinjection(vcpu))
return -EBUSY; return -EBUSY;
if (vcpu->arch.exception.pending &&
nested_vmx_check_exception(vcpu, &exit_qual)) {
if (vmx->nested.nested_run_pending)
return -EBUSY;
nested_vmx_inject_exception_vmexit(vcpu, exit_qual);
vcpu->arch.exception.pending = false;
return 0;
}
if (nested_cpu_has_preemption_timer(get_vmcs12(vcpu)) && if (nested_cpu_has_preemption_timer(get_vmcs12(vcpu)) &&
vmx->nested.preemption_timer_expired) { vmx->nested.preemption_timer_expired) {
if (vmx->nested.nested_run_pending) if (vmx->nested.nested_run_pending)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment