LKML Archive on
help / color / mirror / Atom feed
From: Avi Kivity <>
Subject: [PATCH 2/5] KVM: Fix race between mmio reads and injected interrupts
Date: Thu, 11 Jan 2007 10:04:30 -0000	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

The kvm mmio read path looks like:

 1. guest read faults
 2. kvm emulates read, calls emulator_read_emulated()
 3. fails as a read requires userspace help
 4. exit to userspace
 5. userspace emulates read, kvm sets vcpu->mmio_read_completed
 6. re-enter guest, fault again
 7. kvm emulates read, calls emulator_read_emulated()
 8. succeeds as vcpu->mmio_read_emulated is set
 9. instruction completes and guest is resumed

A problem surfaces if the userspace exit (step 5) also requests an interrupt
injection.  In that case, the guest does not re-execute the original
instruction, but the interrupt handler.  The next time an mmio read is
exectued (likely for a different address), step 3 will find
vcpu->mmio_read_completed set and return the value read for the original

The problem manifested itself in a few annoying ways:
- little squares appear randomly on console when switching virtual terminals
- ne2000 fails under nfs read load
- rtl8139 complains about "pci errors" even though the device model is
  incapable of issuing them.

Fix by skipping interrupt injection if an mmio read is pending.

A better fix is to avoid re-entry into the guest, and re-emulating immediately
instead.  However that's a bit more complex.

Signed-off-by: Avi Kivity <>

Index: linux-2.6/drivers/kvm/svm.c
--- linux-2.6.orig/drivers/kvm/svm.c
+++ linux-2.6/drivers/kvm/svm.c
@@ -1407,7 +1407,8 @@ static int svm_vcpu_run(struct kvm_vcpu 
 	int r;
-	do_interrupt_requests(vcpu, kvm_run);
+	if (!vcpu->mmio_read_completed)
+		do_interrupt_requests(vcpu, kvm_run);
Index: linux-2.6/drivers/kvm/vmx.c
--- linux-2.6.orig/drivers/kvm/vmx.c
+++ linux-2.6/drivers/kvm/vmx.c
@@ -1717,7 +1717,8 @@ again:
 	vmcs_writel(HOST_GS_BASE, segment_base(gs_sel));
-	do_interrupt_requests(vcpu, kvm_run);
+	if (!vcpu->mmio_read_completed)
+		do_interrupt_requests(vcpu, kvm_run);
 	if (vcpu->guest_debug.enabled)

  parent reply	other threads:[~2007-01-11 10:04 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-01-11 10:02 [PATCH 0/5] KVM updates for 2.6.20 Avi Kivity
2007-01-11 10:03 ` [PATCH 1/5] KVM: Make sure there is a vcpu context loaded when destroying the mmu Avi Kivity
2007-01-11 10:04 ` Avi Kivity [this message]
2007-01-11 10:05 ` [PATCH 3/5] KVM: x86 emulator: fix bit string instructions Avi Kivity
2007-01-11 10:06 ` [PATCH 4/5] KVM: Fix asm constraints with CONFIG_FRAME_POINTER=n Avi Kivity
2007-01-23  3:10   ` Herbert Xu
2007-01-11 10:07 ` [PATCH 5/5] KVM: Fix bogus pagefault on writable pages Avi Kivity

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \
    --subject='Re: [PATCH 2/5] KVM: Fix race between mmio reads and injected interrupts' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).