[PATCH 0/2] x86/HVM: XSA-267 follow-ups

[PATCH 0/2] x86/HVM: XSA-267 follow-ups

[Jan Beulich]

As both XenRT and osstest have found, the XSA-267 patches overlooked a
special case in HVM insn emulation. While looking into this I've also noticed
an omission in the sibling function to the one needing to be changed. At
least patch 1 should be strongly considered for 4.11; patch 2 will need
backporting as well, but doesn't look as urgent.

1: account for fully eager FPU mode in emulation
2: attempts to emulate FPU insns need to set fpu_initialised

Jan



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[PATCH 1/2] x86/HVM: account for fully eager FPU mode in emulation

[Jan Beulich]

In fully eager mode we must not clear fpu_dirtied, set CR0.TS, or invoke
the fpu_leave() hook. Instead do what the mode's name says: Restore
state right away.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -2139,13 +2139,20 @@ static void hvmemul_put_fpu(
     if ( backout == X86EMUL_FPU_fpu )
     {
         /*
-         * To back out changes to the register file simply adjust state such
-         * that upon next FPU insn use by the guest we'll reload the state
-         * saved (or freshly loaded) by hvmemul_get_fpu().
+         * To back out changes to the register file
+         * - in fully eager mode, restore original state immediately,
+         * - in lazy mode, simply adjust state such that upon next FPU insn
+         *   use by the guest we'll reload the state saved (or freshly loaded)
+         *   by hvmemul_get_fpu().
          */
-        curr->fpu_dirtied = false;
-        stts();
-        hvm_funcs.fpu_leave(curr);
+        if ( curr->arch.fully_eager_fpu )
+            vcpu_restore_fpu_eager(curr);
+        else
+        {
+            curr->fpu_dirtied = false;
+            stts();
+            hvm_funcs.fpu_leave(curr);
+        }
     }
 }
 





_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[PATCH 2/2] x86/HVM: attempts to emulate FPU insns need to set fpu_initialised

[Jan Beulich]

My original way of thinking here was that this would be set anyway at
the point state gets reloaded after the adjustments hvmemul_put_fpu()
does, but the flag should already be set before that - after all the
guest may never again touch the FPU before e.g. getting migrated/saved.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -2053,6 +2053,7 @@ static int hvmemul_get_fpu(
          * masking of all exceptions by FNSTENV.)
          */
         save_fpu_enable();
+        curr->fpu_initialised = true;
         curr->fpu_dirtied = true;
         if ( (fpu_ctxt->fcw & 0x3f) != 0x3f )
         {



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH 0/2] x86/HVM: XSA-267 follow-ups

[Andrew Cooper]

On 15/06/18 09:47, Jan Beulich wrote:
> As both XenRT and osstest have found, the XSA-267 patches overlooked a
> special case in HVM insn emulation. While looking into this I've also noticed
> an omission in the sibling function to the one needing to be changed. At
> least patch 1 should be strongly considered for 4.11; patch 2 will need
> backporting as well, but doesn't look as urgent.
>
> 1: account for fully eager FPU mode in emulation
> 2: attempts to emulate FPU insns need to set fpu_initialised

Both Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

At this point, I'm tempted to suggest that we reissue the XSA-267
advisory to include patch 1.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH 0/2] x86/HVM: XSA-267 follow-ups

[Jan Beulich]

>>> On 15.06.18 at 11:27, <andrew.cooper3@citrix.com> wrote:
> On 15/06/18 09:47, Jan Beulich wrote:
>> As both XenRT and osstest have found, the XSA-267 patches overlooked a
>> special case in HVM insn emulation. While looking into this I've also 
> noticed
>> an omission in the sibling function to the one needing to be changed. At
>> least patch 1 should be strongly considered for 4.11; patch 2 will need
>> backporting as well, but doesn't look as urgent.
>>
>> 1: account for fully eager FPU mode in emulation
>> 2: attempts to emulate FPU insns need to set fpu_initialised
> 
> Both Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
> 
> At this point, I'm tempted to suggest that we reissue the XSA-267
> advisory to include patch 1.

Yes, I think we should do this. But let me first see how far this change
is needed, and whether on older versions nothing else is needed in its
stead.

Jan



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Ping: [PATCH 2/2] x86/HVM: attempts to emulate FPU insns need to set fpu_initialised

[Jan Beulich]

>>> On 15.06.18 at 10:58, <JBeulich@suse.com> wrote:
> My original way of thinking here was that this would be set anyway at
> the point state gets reloaded after the adjustments hvmemul_put_fpu()
> does, but the flag should already be set before that - after all the
> guest may never again touch the FPU before e.g. getting migrated/saved.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> --- a/xen/arch/x86/hvm/emulate.c
> +++ b/xen/arch/x86/hvm/emulate.c
> @@ -2053,6 +2053,7 @@ static int hvmemul_get_fpu(
>           * masking of all exceptions by FNSTENV.)
>           */
>          save_fpu_enable();
> +        curr->fpu_initialised = true;
>          curr->fpu_dirtied = true;
>          if ( (fpu_ctxt->fcw & 0x3f) != 0x3f )
>          {



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: Ping: [PATCH 2/2] x86/HVM: attempts to emulate FPU insns need to set fpu_initialised

[Paul Durrant]

> -----Original Message-----
> From: Jan Beulich [mailto:JBeulich@suse.com]
> Sent: 22 June 2018 11:53
> To: Paul Durrant <Paul.Durrant@citrix.com>
> Cc: Andrew Cooper <Andrew.Cooper3@citrix.com>; xen-devel <xen-
> devel@lists.xenproject.org>; Juergen Gross <jgross@suse.com>
> Subject: Ping: [PATCH 2/2] x86/HVM: attempts to emulate FPU insns need to
> set fpu_initialised
> 
> >>> On 15.06.18 at 10:58, <JBeulich@suse.com> wrote:
> > My original way of thinking here was that this would be set anyway at
> > the point state gets reloaded after the adjustments hvmemul_put_fpu()
> > does, but the flag should already be set before that - after all the
> > guest may never again touch the FPU before e.g. getting migrated/saved.
> >
> > Signed-off-by: Jan Beulich <jbeulich@suse.com>
> >
> > --- a/xen/arch/x86/hvm/emulate.c
> > +++ b/xen/arch/x86/hvm/emulate.c
> > @@ -2053,6 +2053,7 @@ static int hvmemul_get_fpu(
> >           * masking of all exceptions by FNSTENV.)
> >           */
> >          save_fpu_enable();
> > +        curr->fpu_initialised = true;
> >          curr->fpu_dirtied = true;
> >          if ( (fpu_ctxt->fcw & 0x3f) != 0x3f )
> >          {
> 

Apologies for the delay...

Acked-by: Paul Durrant <paul.durrant@citrix.com>


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel