[Xen-changelog] [xen stable-4.4] VMX: fix/adjust trap injection

[patchbot@xxxxxxx]

commit f70eaf9f0784297831bea168d416b9c834d667db
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Dec 15 15:53:12 2015 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Dec 15 15:53:12 2015 +0100

    VMX: fix/adjust trap injection
    
    In the course of investigating the 4.1.6 backport issue of the XSA-156
    patch I realized that #DB injection has always been broken, but with it
    now getting always intercepted the problem has got worse: Documentation
    clearly states that neither DR7.GD nor DebugCtl.LBR get cleared before
    the intercept, so this is something we need to do before reflecting the
    intercepted exception.
    
    While adjusting this (and also with 4.1.6's strange use of
    X86_EVENTTYPE_SW_EXCEPTION for #DB in mind) I further realized that
    the special casing of individual vectors shouldn't be done for
    software interrupts (resulting from INT $nn).
    
    And then some code movement: Setting of CR2 for #PF can be done in the
    same switch() statement (no need for a separate if()), and reading of
    intr_info is better done close the the consumption of the variable
    (allowing the compiler to generate better code / use fewer registers
    for variables).
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx>
    master commit: 81a28f14009f4d8577a81b28dd06f6828112054b
    master date: 2015-11-24 12:30:31 +0100
---
 xen/arch/x86/hvm/vmx/vmx.c |   32 ++++++++++++++++++++++----------
 1 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index ced3092..a8a9d58 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1409,16 +1409,7 @@ static void vmx_inject_trap(struct hvm_trap *trap)
     struct vcpu *curr = current;
     struct hvm_trap _trap = *trap;
 
-    if ( (_trap.vector == TRAP_page_fault) &&
-         (_trap.type == X86_EVENTTYPE_HW_EXCEPTION) )
-        current->arch.hvm_vcpu.guest_cr[2] = _trap.cr2;
-
-    if ( nestedhvm_vcpu_in_guestmode(curr) )
-        intr_info = vcpu_2_nvmx(curr).intr.intr_info;
-    else
-        __vmread(VM_ENTRY_INTR_INFO, &intr_info);
-
-    switch ( _trap.vector )
+    switch ( _trap.vector | -(_trap.type == X86_EVENTTYPE_SW_INTERRUPT) )
     {
     case TRAP_debug:
         if ( guest_cpu_user_regs()->eflags & X86_EFLAGS_TF )
@@ -1426,6 +1417,16 @@ static void vmx_inject_trap(struct hvm_trap *trap)
             __restore_debug_registers(curr);
             write_debugreg(6, read_debugreg(6) | 0x4000);
         }
+        if ( !nestedhvm_vcpu_in_guestmode(curr) ||
+             !nvmx_intercepts_exception(curr, TRAP_debug, _trap.error_code) )
+        {
+            unsigned long val;
+
+            __vmread(GUEST_DR7, &val);
+            __vmwrite(GUEST_DR7, val & ~DR_GENERAL_DETECT);
+            __vmread(GUEST_IA32_DEBUGCTL, &val);
+            __vmwrite(GUEST_IA32_DEBUGCTL, val & ~IA32_DEBUGCTLMSR_LBR);
+        }
         if ( cpu_has_monitor_trap_flag )
             break;
         /* fall through */
@@ -1436,8 +1437,19 @@ static void vmx_inject_trap(struct hvm_trap *trap)
             domain_pause_for_debugger();
             return;
         }
+        break;
+
+    case TRAP_page_fault:
+        ASSERT(_trap.type == X86_EVENTTYPE_HW_EXCEPTION);
+        curr->arch.hvm_vcpu.guest_cr[2] = _trap.cr2;
+        break;
     }
 
+    if ( nestedhvm_vcpu_in_guestmode(curr) )
+        intr_info = vcpu_2_nvmx(curr).intr.intr_info;
+    else
+        __vmread(VM_ENTRY_INTR_INFO, &intr_info);
+
     if ( unlikely(intr_info & INTR_INFO_VALID_MASK) &&
          (((intr_info >> 8) & 7) == X86_EVENTTYPE_HW_EXCEPTION) )
     {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog