[Xen-changelog] [xen stable-4.9] x86/hvm: fix interaction between internal and external emulation

[patchbot@xxxxxxx]

commit 09d7c30f037497cea00f79cb9e7a731d4f1ef360
Author:     Paul Durrant <paul.durrant@xxxxxxxxxx>
AuthorDate: Wed Dec 20 15:54:39 2017 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Dec 20 15:54:39 2017 +0100

    x86/hvm: fix interaction between internal and external emulation
    
    A call to handle_hvm_io_completion() is needed for completing I/O
    that requires external emulation. Such completion should be requested when
    hvm_vcpu_io_need_completion() returns true after hvm_emulate_once() has
    completed. This is indicative of the underlying I/O emulation having
    returned X86EMUL_RETRY and hence a re-emulation of the instruction is
    needed to pick up the result of the I/O.
    
    A call to handle_hvm_io_completion() is NOT needed when the underlying
    I/O has not returned X86EMUL_RETRY since there will be no result to pick
    up. Hence it bogus to request such completion when mmio_retry is set,
    since this can only happen if the underlying I/O emulation has returned
    X86EMUL_OKAY (meaning the I/O has completed successfully).
    
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    
    # Commit 5fcb26e69e8089e20c9168774bee681b8f5a3187
    # Date 2017-12-06 12:50:23 +0100
    # Author Jan Beulich <jbeulich@xxxxxxxx>
    # Committer Jan Beulich <jbeulich@xxxxxxxx>
    x86/HVM: don't retain emulated insn cache when exiting back to guest
    
    vio->mmio_retry is being set when a repeated string insn is being split
    up. In that case we'll exit to the guest, expecting immediate re-entry.
    Interruptions, however, may be serviced by the guest before re-entry
    from the repeated string insn. Any emulation needed in the course of
    handling the interruption must not fetch from the internally maintained
    cache.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
    master commit: 9c9384d6d8184ca6d21975ccf4e4f72b560540cc
    master date: 2017-12-01 18:09:48 +0000
    master commit: 5fcb26e69e8089e20c9168774bee681b8f5a3187
    master date: 2017-12-06 12:50:23 +0100
---
 xen/arch/x86/hvm/emulate.c      | 18 ++++++++++--------
 xen/arch/x86/hvm/io.c           |  2 +-
 xen/arch/x86/hvm/vmx/realmode.c |  2 +-
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index 9e63614..9ce5ae0 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -1951,20 +1951,22 @@ static int _hvm_emulate_one(struct hvm_emulate_ctxt 
*hvmemul_ctxt,
 
     vio->mmio_retry = 0;
 
-    rc = x86_emulate(&hvmemul_ctxt->ctxt, ops);
-
-    if ( rc == X86EMUL_OKAY && vio->mmio_retry )
-        rc = X86EMUL_RETRY;
-    if ( rc != X86EMUL_RETRY )
+    switch ( rc = x86_emulate(&hvmemul_ctxt->ctxt, ops) )
     {
+    case X86EMUL_OKAY:
+        if ( vio->mmio_retry )
+            rc = X86EMUL_RETRY;
+        /* fall through */
+    default:
         vio->mmio_cache_count = 0;
         vio->mmio_insn_bytes = 0;
-    }
-    else
-    {
+        break;
+
+    case X86EMUL_RETRY:
         BUILD_BUG_ON(sizeof(vio->mmio_insn) < sizeof(hvmemul_ctxt->insn_buf));
         vio->mmio_insn_bytes = hvmemul_ctxt->insn_buf_bytes;
         memcpy(vio->mmio_insn, hvmemul_ctxt->insn_buf, vio->mmio_insn_bytes);
+        break;
     }
 
     if ( hvmemul_ctxt->ctxt.retire.singlestep )
diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c
index 214ab30..05c1479 100644
--- a/xen/arch/x86/hvm/io.c
+++ b/xen/arch/x86/hvm/io.c
@@ -88,7 +88,7 @@ bool hvm_emulate_one_insn(hvm_emulate_validate_t *validate, 
const char *descr)
 
     rc = hvm_emulate_one(&ctxt);
 
-    if ( hvm_vcpu_io_need_completion(vio) || vio->mmio_retry )
+    if ( hvm_vcpu_io_need_completion(vio) )
         vio->io_completion = HVMIO_mmio_completion;
     else
         vio->mmio_access = (struct npfec){};
diff --git a/xen/arch/x86/hvm/vmx/realmode.c b/xen/arch/x86/hvm/vmx/realmode.c
index 1996b1f..5177a9f 100644
--- a/xen/arch/x86/hvm/vmx/realmode.c
+++ b/xen/arch/x86/hvm/vmx/realmode.c
@@ -103,7 +103,7 @@ void vmx_realmode_emulate_one(struct hvm_emulate_ctxt 
*hvmemul_ctxt)
 
     rc = hvm_emulate_one(hvmemul_ctxt);
 
-    if ( hvm_vcpu_io_need_completion(vio) || vio->mmio_retry )
+    if ( hvm_vcpu_io_need_completion(vio) )
         vio->io_completion = HVMIO_realmode_completion;
 
     if ( rc == X86EMUL_UNHANDLEABLE )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog