Re: [Xen-devel] Emulation and active (valid) interrupts

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

On 8/13/18 4:38 PM, Jan Beulich wrote:
>>>> On 13.08.18 at 15:19, <rcojocaru@xxxxxxxxxxxxxxx> wrote:
>> On 8/13/18 3:58 PM, Jan Beulich wrote:
>>>>>> On 13.08.18 at 14:51, <rcojocaru@xxxxxxxxxxxxxxx> wrote:
>>>> So first we've got that vmx_idtv_reinject() call writing to the VMCS,
>>>> then we emulate a CLI, then the failed vmentry. I can't tell if the CLI
>>>> ran first and then an interrupt popped up, or if an interrupt had
>>>> already been __vmwrit()ten and then CLI caused the invalid guest state.
>>>
>>> I'd expect it to be the latter - an external interrupt presumably
>>> can't be injected when EFLAGS.IF is clear. Why are we emulating
>>> CLI in the first place? With a pending external interrupt, shouldn't
>>> we just exit back to guest context without emulating anything?
>>
>> In this particular case we're emulating CLI because the vm_event
>> response requests it.
>>
>> Tamas' test marks all of the guest's pages XENMEM_access_x, and at some
>> point a vm_event arrives somewhere in a page where CLI is read from,
>> AFAICT. Doing nothing would get us into an infinite loop, and since we
>> don't want to mark the page rwx, we try to emulate CLI.
> 
> Doing nothing would get you into an infinite loop only if at each
> attempt there's yet again an event to be re-injected. Of course
> the risk of this grows the longer it takes to processes things in
> your tool, but if there is an event to be re-injected then I don't
> see what else you can do. Trying to ditch the event would
> certainly be the wrong thing. I suggest you try to get advice
> from the VMX maintainers - perhaps I'm simply overlooking an
> obvious route out of the state you're apparently in.

You're of course right, what I meant to say was that if we don't
emulate, don't mark the page rwx, and don't move RIP we'll be in an
infinite loop of read-caused vm_event -> userspace tool gets event ->
does nothing, but responds to it -> guest resumes at the same RIP
(pointing, in this case at CLI, but it could be anything) -> goto begin.

We need to do something to keep the guest going, and the generic way to
accomplish this is to ask Xen to emulate whatever instruction is at RIP
(because the Xen emulator, at least for the time being, ignores EPT
restrictions).


Thanks,
Razvan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel