From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Egger, Christoph" Subject: Re: hap_invlpg() vs INVLPGA Date: Fri, 29 Jan 2016 18:09:45 +0100 Message-ID: <56AB9CD9.8070103@amazon.de> References: <56AB761F02000078000CC667@prv-mh.provo.novell.com> <56AB6FB7.7030003@amazon.de> <56AB70FE.9030906@amazon.de> <56AB992202000078000CC72C@prv-mh.provo.novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1aPCZB-0005g3-3q for xen-devel@lists.xenproject.org; Fri, 29 Jan 2016 17:10:37 +0000 In-Reply-To: <56AB992202000078000CC72C@prv-mh.provo.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Jan Beulich Cc: xen-devel List-Id: xen-devel@lists.xenproject.org On 29/01/16 16:53, Jan Beulich wrote: >>>> On 29.01.16 at 15:02, wrote: >> On 29/01/16 14:57, Egger, Christoph wrote: >>> On 29/01/16 14:24, Jan Beulich wrote: >>>> Christoph, >>>> >>>> in commit dd6de3ab99 ("Implement Nested-on-Nested") you added >>>> code to hap_invlpg() supposedly emulating INVLPGA. I've been >>>> stumbling across this a number of times in the past, not being able >>>> to make the connection between (a) VMX/EPT and INVLPGA and >>>> (b) SVM's INVLPGA intercept and this function. >>> >>> When you boot Windows 7 as L1 guest and XP-Mode as L2 guest then >>> L2 guest uses INVLPG instruction to invalidate a page and L1 guest >>> handles this via using INVLPGA instruction. >>> >>> The INVLPG intercept flushes the nested hap p2m which is effectively >>> a TLB flush to the L1 guest. >> >> ... actually to the L2 guest. Sorry for the typo. > > So if the L1 guest does an INVLPGA, we should see an INVLPGA > intercept, not an INVLPG one. INVLPG intercept comes first from L2 then INVLPGA from L1. >>> Then this intercept is injected into L1 guest. > > This, otoh, reads as if you imply we intercept the L2's INVLPG. > Yet the INVLPG intercept gets cleared when the domain uses > NPT (and your original change also didn't alter any intercept > settings). Hence I'm still lost how hap_invlpg() can be reached > in that case other than via emulating INVLPG in the instruction > emulator. svm_invlpg_intercept() and vmx_invlpg_intercept() call paging_invlpg(). paging_invlpg() calls hap_invlpg() as initialized in xen/arch/x86/mm/hap/hap.c >>> The INVLPGA instruction enforces a new ASID. >>> >>> If the nested hap p2m is NULL then p2m_flush() should effectively >>> be a noop but it may not crash the guest. > > s/may not/should not/ ? Yes. Christoph Amazon Development Center Germany GmbH Berlin - Dresden - Aachen main office: Krausenstr. 38, 10117 Berlin Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger Ust-ID: DE289237879 Eingetragen am Amtsgericht Charlottenburg HRB 149173 B