Hi
When the HVM guest atomically reads two bytes from the PIT via "rep insb"
and the two bytes crosses pages, then in xen/arch/x86/hvm/i8254.c,
handle_pit_io(), p->data_is_ptr is 1 which leads to an unhandled read.
Since reading the first byte does not change the guest rip, an endless loop
of VMEXIT_IOIO happens. This leads to an endless stream of "PIT: bad access"
xen messages => Guest hangs.
This has been accurately reproduced on NetBSD/amd64 as HVM guest
and this also been seen on 64bit Windows guests.
The attached patch handles the page-crossing access in the PIT emulation.
Signed-off-by: Christoph Egger <Christoph.Egger@xxxxxxx>
--
AMD Saxony, Dresden, Germany
Operating System Research Center
Legal Information:
AMD Saxony Limited Liability Company & Co. KG
Sitz (Geschäftsanschrift):
Wilschdorfer Landstr. 101, 01109 Dresden, Deutschland
Registergericht Dresden: HRA 4896
vertretungsberechtigter Komplementär:
AMD Saxony LLC (Sitz Wilmington, Delaware, USA)
Geschäftsführer der AMD Saxony LLC:
Dr. Hans-R. Deppe, Thomas McCoy
xen_pit.diff
Description: Text document
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|