On 06/07/2016 18:03, Haozhong Zhang wrote:
>>> This patch also fixed the crash of L1 Xen with L2 HVM guest. Xen does
>>> not enable preemption timer for HVM guests, and will get panic if it
>>> receives a preemption timer vmexit.
>>
>> Thanks! I'm still not sure why the bit is set in the vmcs02 though...
>
> Yes, it looks really weird.
>
> I replaced "return false" in Wanpeng's patch by
>
> pr_info("VMCS: preemption timer enabled = %d\n",
> !!(vmcs_read32(PIN_BASED_VM_EXEC_CONTROL) &
> PIN_BASED_VMX_PREEMPTION_TIMER));
>
> and redid my test. As expected, L1 Xen crashed due to the unexpected
> preemption timer vmexit. I got a log from above statement just before crash:
>
> VMCS: preemption timer enabled = 1
>
> which is expected to be 0, because preemption timer is disabled in
> vmcs02. I also modified L1 Xen to dump VMCS at crash, and it says
> preemption timer is disabled.
>
> I noticed Jim Mattson recently sent a patch "KVM: nVMX: Fix memory
> corruption when using VMCS shadowing" to fix the inconsistency between
> vmcs12 and its shadow. Is it relevant here? I'll test his patch
> tomorrow.
No, it shouldn't have any effect.
I think it happens when the post_block hook switches back from sw_timer
to hv_timer, and L2 is running. So the right fix should be along the
lines of what I posted earlier. If you don't beat me to it, I'll take
another look tomorrow.
Paolo
