Messages in this thread | | | Subject | Re: [PATCH] KVM: X86: Dynamically allocating MSR number lists(msrs_to_save[], emulated_msrs[], msr_based_features[]) | From | Xiaoyao Li <> | Date | Tue, 5 Nov 2019 19:11:24 +0800 |
| |
On 11/5/2019 6:41 PM, Paolo Bonzini wrote: > On 05/11/19 10:20, Chenyi Qiang wrote: >> The three msr number lists(msrs_to_save[], emulated_msrs[] and >> msr_based_features[]) are global arrays of kvm.ko, which are >> initialized/adjusted (copy supported MSRs forward to override the >> unsupported MSRs) when installing kvm-{intel,amd}.ko, but it doesn't >> reset these three arrays to their initial value when uninstalling >> kvm-{intel,amd}.ko. Thus, at the next installation, kvm-{intel,amd}.ko >> will initialize the modified arrays with some MSRs lost and some MSRs >> duplicated. >> >> So allocate and initialize these three MSR number lists dynamically when >> installing kvm-{intel,amd}.ko and free them when uninstalling. > > I don't understand. Do you mean insmod/rmmod when you say > installing/uninstalling? Global data must be reloaded from the ELF file > when insmod is executed.
Yes, we mean insmod/rmmod. The problem is that these three MSR arrays belong to kvm.ko but not kvm-{intel,amd}.ko. When we rmmod kvm_intel.ko, it does nothing to them.
> How is the bug reproducible?
Suppose there is an intel machine.
1. You can first run #rmmod kvm-intel.ko #insmod kvm-intel.ko nested=0 2. and then #rmmod kvm-intel.ko #insmod kvm-intel.ko nested=1
In step 1, all the vmx-related MSRs in msr_based_features[] are not supported due to nested=0. And it will move MSR_IA32_UCODE_REV and MSR_IA32_ARCH_CAPABILITIES (on my Cascadelake server) forward to override array member 0 and 1 (MSR_IA32_VMX_BASIC and MSR_IA32_VMX_TRUE_PINBASED_CTLS).
In step 2, we just lose MSR_IA32_VMX_BASIC and MSR_IA32_VMX_TRUE_PINBASED_CTLS of VMX and get duplicated MSR_IA32_UCODE_REV and MSR_IA32_ARCH_CAPABILITIES.
> Paolo >
| |