[Xen-changelog] [xen-unstable] nestedsvm: fix lazy fpu switching causing a triple fault

[Xen patchbot-unstable <patchbot@xxxxxxx>]

# HG changeset patch
# User Christoph Egger <Christoph.Egger@xxxxxxx>
# Date 1319819031 -3600
# Node ID 0fea1ad50ce32173a5c9e7ebf5a6adbc4c351ee4
# Parent  c4ed56a102dc3a66dc4dda6ed1584cb6531074a2
nestedsvm: fix lazy fpu switching causing a triple fault

Fix FPU switching uncovered with Hyper-V: Do FPU switching always on
the n1 vmcb rather doing it on the current active vmcb.  The FPU state
between n1 and n2 vmcb is already synced in the vmrun and vmexit
emulation.

This fixes the situation where the n2 vmcb had the #NM intercept bit
set but the virtual vmcb did not.  That means it was believed the l1
guest can handle an #NM intercept but was actually wrong.

The result were three #GP's with error code 0x11 in the l1 guest.

Signed-off-by: Christoph Egger <Christoph.Egger@xxxxxxx>
Committed-by: Keir Fraser <keir@xxxxxxx>
---


diff -r c4ed56a102dc -r 0fea1ad50ce3 xen/arch/x86/hvm/svm/svm.c
--- a/xen/arch/x86/hvm/svm/svm.c        Fri Oct 28 17:20:21 2011 +0100
+++ b/xen/arch/x86/hvm/svm/svm.c        Fri Oct 28 17:23:51 2011 +0100
@@ -349,16 +349,17 @@
 
 static void svm_fpu_enter(struct vcpu *v)
 {
-    struct vmcb_struct *vmcb = v->arch.hvm_svm.vmcb;
+    struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx;
 
     vcpu_restore_fpu_lazy(v);
     vmcb_set_exception_intercepts(
-        vmcb, vmcb_get_exception_intercepts(vmcb) & ~(1U << TRAP_no_device));
+        n1vmcb,
+        vmcb_get_exception_intercepts(n1vmcb) & ~(1U << TRAP_no_device));
 }
 
 static void svm_fpu_leave(struct vcpu *v)
 {
-    struct vmcb_struct *vmcb = v->arch.hvm_svm.vmcb;
+    struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx;
 
     ASSERT(!v->fpu_dirtied);
     ASSERT(read_cr0() & X86_CR0_TS);
@@ -372,9 +373,9 @@
     if ( !(v->arch.hvm_vcpu.guest_cr[0] & X86_CR0_TS) )
     {
         vmcb_set_exception_intercepts(
-            vmcb,
-            vmcb_get_exception_intercepts(vmcb) | (1U << TRAP_no_device));
-        vmcb_set_cr0(vmcb, vmcb_get_cr0(vmcb) | X86_CR0_TS);
+            n1vmcb,
+            vmcb_get_exception_intercepts(n1vmcb) | (1U << TRAP_no_device));
+        vmcb_set_cr0(n1vmcb, vmcb_get_cr0(n1vmcb) | X86_CR0_TS);
     }
 }
 
@@ -1191,15 +1192,17 @@
 {
     struct vcpu *v = current;
     struct vmcb_struct *vmcb = v->arch.hvm_svm.vmcb;
+    struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx;
 
     svm_fpu_enter(v);
 
-    if ( nestedhvm_enabled(v->domain) && nestedhvm_vcpu_in_guestmode(v) ) {
-       /* Check if guest must make FPU ready for the nested guest */
+    if ( vmcb != n1vmcb )
+    {
+       /* Check if l1 guest must make FPU ready for the l2 guest */
        if ( v->arch.hvm_vcpu.guest_cr[0] & X86_CR0_TS )
            hvm_inject_exception(TRAP_no_device, HVM_DELIVER_NO_ERROR_CODE, 0);
        else
-           vmcb_set_cr0(vmcb, vmcb_get_cr0(vmcb) & ~X86_CR0_TS);
+           vmcb_set_cr0(n1vmcb, vmcb_get_cr0(n1vmcb) & ~X86_CR0_TS);
        return;
     }
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog