From: "Jan Beulich" <JBeulich@suse.com>
To: xen-devel <xen-devel@lists.xenproject.org>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>,
Tim Deegan <tim@xen.org>, Keir Fraser <keir@xen.org>
Subject: [PATCH] x86/HVM: prevent infinite VM entry retries
Date: Thu, 27 Nov 2014 12:39:59 +0000 [thread overview]
Message-ID: <547729AF020000780004B2A7@mail.emea.novell.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 4502 bytes --]
This reverts the VMX side of commit 28b4baac ("x86/HVM: don't crash
guest upon problems occurring in user mode") and gets SVM in line with
the resulting VMX behavior. This is because Andrew validly says
"A failed vmentry is overwhelmingly likely to be caused by corrupt
VMC[SB] state. As a result, injecting a fault and retrying the the
vmentry is likely to fail in the same way."
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Tim Deegan <tim@xen.org>
---
v2: Replace SVM change by what Tim suggested.
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -2371,8 +2371,8 @@ void svm_vmexit_handler(struct cpu_user_
goto out;
case NESTEDHVM_VMEXIT_FATALERROR:
gdprintk(XENLOG_ERR, "unexpected nestedsvm_vmexit() error\n");
- goto exit_and_crash;
-
+ domain_crash(v->domain);
+ goto out;
default:
BUG();
case NESTEDHVM_VMEXIT_ERROR:
@@ -2385,18 +2385,21 @@ void svm_vmexit_handler(struct cpu_user_
case NESTEDHVM_VMEXIT_FATALERROR:
gdprintk(XENLOG_ERR,
"unexpected nestedsvm_check_intercepts() error\n");
- goto exit_and_crash;
+ domain_crash(v->domain);
+ goto out;
default:
gdprintk(XENLOG_INFO, "nestedsvm_check_intercepts() returned %i\n",
nsret);
- goto exit_and_crash;
+ domain_crash(v->domain);
+ goto out;
}
}
if ( unlikely(exit_reason == VMEXIT_INVALID) )
{
svm_vmcb_dump(__func__, vmcb);
- goto exit_and_crash;
+ domain_crash(v->domain);
+ goto out;
}
perfc_incra(svmexits, exit_reason);
@@ -2431,13 +2434,13 @@ void svm_vmexit_handler(struct cpu_user_
case VMEXIT_EXCEPTION_DB:
if ( !v->domain->debugger_attached )
- goto exit_and_crash;
+ goto unexpected_exit_type;
domain_pause_for_debugger();
break;
case VMEXIT_EXCEPTION_BP:
if ( !v->domain->debugger_attached )
- goto exit_and_crash;
+ goto unexpected_exit_type;
/* AMD Vol2, 15.11: INT3, INTO, BOUND intercepts do not update RIP. */
if ( (inst_len = __get_instruction_length(v, INSTR_INT3)) == 0 )
break;
@@ -2684,7 +2687,7 @@ void svm_vmexit_handler(struct cpu_user_
break;
default:
- exit_and_crash:
+ unexpected_exit_type:
gdprintk(XENLOG_ERR, "unexpected VMEXIT: exit reason = %#"PRIx64", "
"exitinfo1 = %#"PRIx64", exitinfo2 = %#"PRIx64"\n",
exit_reason,
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -134,18 +134,6 @@ static void vmx_vcpu_destroy(struct vcpu
passive_domain_destroy(v);
}
-/* Only crash the guest if the problem originates in kernel mode. */
-static void vmx_crash_or_fault(struct vcpu *v)
-{
- struct segment_register ss;
-
- vmx_get_segment_register(v, x86_seg_ss, &ss);
- if ( ss.attr.fields.dpl )
- hvm_inject_hw_exception(TRAP_invalid_op, HVM_DELIVER_NO_ERROR_CODE);
- else
- domain_crash(v->domain);
-}
-
static DEFINE_PER_CPU(struct vmx_msr_state, host_msr_state);
static const u32 msr_index[] =
@@ -2520,7 +2508,7 @@ static void vmx_failed_vmentry(unsigned
vmcs_dump_vcpu(curr);
printk("**************************************\n");
- vmx_crash_or_fault(curr);
+ domain_crash(curr->domain);
}
void vmx_enter_realmode(struct cpu_user_regs *regs)
@@ -3173,8 +3161,19 @@ void vmx_vmexit_handler(struct cpu_user_
/* fall through */
default:
exit_and_crash:
- gdprintk(XENLOG_WARNING, "Bad vmexit (reason %#lx)\n", exit_reason);
- vmx_crash_or_fault(v);
+ {
+ struct segment_register ss;
+
+ gdprintk(XENLOG_WARNING, "Bad vmexit (reason %#lx)\n",
+ exit_reason);
+
+ vmx_get_segment_register(v, x86_seg_ss, &ss);
+ if ( ss.attr.fields.dpl )
+ hvm_inject_hw_exception(TRAP_invalid_op,
+ HVM_DELIVER_NO_ERROR_CODE);
+ else
+ domain_crash(v->domain);
+ }
break;
}
[-- Attachment #2: x86-HVM-prevent-infinite-VMentry-loop.patch --]
[-- Type: text/plain, Size: 4544 bytes --]
x86/HVM: prevent infinite VM entry retries
This reverts the VMX side of commit 28b4baac ("x86/HVM: don't crash
guest upon problems occurring in user mode") and gets SVM in line with
the resulting VMX behavior. This is because Andrew validly says
"A failed vmentry is overwhelmingly likely to be caused by corrupt
VMC[SB] state. As a result, injecting a fault and retrying the the
vmentry is likely to fail in the same way."
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Tim Deegan <tim@xen.org>
---
v2: Replace SVM change by what Tim suggested.
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -2371,8 +2371,8 @@ void svm_vmexit_handler(struct cpu_user_
goto out;
case NESTEDHVM_VMEXIT_FATALERROR:
gdprintk(XENLOG_ERR, "unexpected nestedsvm_vmexit() error\n");
- goto exit_and_crash;
-
+ domain_crash(v->domain);
+ goto out;
default:
BUG();
case NESTEDHVM_VMEXIT_ERROR:
@@ -2385,18 +2385,21 @@ void svm_vmexit_handler(struct cpu_user_
case NESTEDHVM_VMEXIT_FATALERROR:
gdprintk(XENLOG_ERR,
"unexpected nestedsvm_check_intercepts() error\n");
- goto exit_and_crash;
+ domain_crash(v->domain);
+ goto out;
default:
gdprintk(XENLOG_INFO, "nestedsvm_check_intercepts() returned %i\n",
nsret);
- goto exit_and_crash;
+ domain_crash(v->domain);
+ goto out;
}
}
if ( unlikely(exit_reason == VMEXIT_INVALID) )
{
svm_vmcb_dump(__func__, vmcb);
- goto exit_and_crash;
+ domain_crash(v->domain);
+ goto out;
}
perfc_incra(svmexits, exit_reason);
@@ -2431,13 +2434,13 @@ void svm_vmexit_handler(struct cpu_user_
case VMEXIT_EXCEPTION_DB:
if ( !v->domain->debugger_attached )
- goto exit_and_crash;
+ goto unexpected_exit_type;
domain_pause_for_debugger();
break;
case VMEXIT_EXCEPTION_BP:
if ( !v->domain->debugger_attached )
- goto exit_and_crash;
+ goto unexpected_exit_type;
/* AMD Vol2, 15.11: INT3, INTO, BOUND intercepts do not update RIP. */
if ( (inst_len = __get_instruction_length(v, INSTR_INT3)) == 0 )
break;
@@ -2684,7 +2687,7 @@ void svm_vmexit_handler(struct cpu_user_
break;
default:
- exit_and_crash:
+ unexpected_exit_type:
gdprintk(XENLOG_ERR, "unexpected VMEXIT: exit reason = %#"PRIx64", "
"exitinfo1 = %#"PRIx64", exitinfo2 = %#"PRIx64"\n",
exit_reason,
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -134,18 +134,6 @@ static void vmx_vcpu_destroy(struct vcpu
passive_domain_destroy(v);
}
-/* Only crash the guest if the problem originates in kernel mode. */
-static void vmx_crash_or_fault(struct vcpu *v)
-{
- struct segment_register ss;
-
- vmx_get_segment_register(v, x86_seg_ss, &ss);
- if ( ss.attr.fields.dpl )
- hvm_inject_hw_exception(TRAP_invalid_op, HVM_DELIVER_NO_ERROR_CODE);
- else
- domain_crash(v->domain);
-}
-
static DEFINE_PER_CPU(struct vmx_msr_state, host_msr_state);
static const u32 msr_index[] =
@@ -2520,7 +2508,7 @@ static void vmx_failed_vmentry(unsigned
vmcs_dump_vcpu(curr);
printk("**************************************\n");
- vmx_crash_or_fault(curr);
+ domain_crash(curr->domain);
}
void vmx_enter_realmode(struct cpu_user_regs *regs)
@@ -3173,8 +3161,19 @@ void vmx_vmexit_handler(struct cpu_user_
/* fall through */
default:
exit_and_crash:
- gdprintk(XENLOG_WARNING, "Bad vmexit (reason %#lx)\n", exit_reason);
- vmx_crash_or_fault(v);
+ {
+ struct segment_register ss;
+
+ gdprintk(XENLOG_WARNING, "Bad vmexit (reason %#lx)\n",
+ exit_reason);
+
+ vmx_get_segment_register(v, x86_seg_ss, &ss);
+ if ( ss.attr.fields.dpl )
+ hvm_inject_hw_exception(TRAP_invalid_op,
+ HVM_DELIVER_NO_ERROR_CODE);
+ else
+ domain_crash(v->domain);
+ }
break;
}
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next reply other threads:[~2014-11-27 12:40 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-27 12:39 Jan Beulich [this message]
2014-11-27 12:46 ` [PATCH] x86/HVM: prevent infinite VM entry retries Andrew Cooper
2014-11-27 12:58 ` Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=547729AF020000780004B2A7@mail.emea.novell.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=keir@xen.org \
--cc=tim@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.