* [PATCH v1] vvmx: fix ept_sync() for nested p2m
@ 2017-06-28 9:35 Sergey Dyasli
2017-06-28 16:51 ` Andrew Cooper
2017-06-30 9:29 ` Tian, Kevin
0 siblings, 2 replies; 3+ messages in thread
From: Sergey Dyasli @ 2017-06-28 9:35 UTC (permalink / raw)
To: xen-devel
Cc: Sergey Dyasli, Kevin Tian, Jun Nakajima, George Dunlap,
Andrew Cooper, Tim Deegan, Jan Beulich
If ept_sync_domain() is called for np2m, the following happens:
1. *np2m*::ept_data::invalidate cpumask is updated
2. IPIs are sent for CPUs in domain_dirty_cpumask forcing vmexits
3. vmx_vmenter_helper() checks *hostp2m*::ept_data::invalidate
and does nothing
Which is clearly a bug. Make ept_sync_domain() to update hostp2m's
invalidate mask in nested p2m case and make vmx_vmenter_helper() to
invalidate EPT translations for all EPTPs if nested virt is enabled.
Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
---
xen/arch/x86/hvm/vmx/vmx.c | 5 ++++-
xen/arch/x86/mm/p2m-ept.c | 9 +++++++--
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index c53b24955a..a8bb550720 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -4278,7 +4278,10 @@ void vmx_vmenter_helper(const struct cpu_user_regs *regs)
if ( cpumask_test_cpu(cpu, ept->invalidate) )
{
cpumask_clear_cpu(cpu, ept->invalidate);
- __invept(INVEPT_SINGLE_CONTEXT, ept->eptp, 0);
+ if ( nestedhvm_enabled(curr->domain) )
+ __invept(INVEPT_ALL_CONTEXT, 0, 0);
+ else
+ __invept(INVEPT_SINGLE_CONTEXT, ept->eptp, 0);
}
}
diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c
index ecab56fbec..8d9da9203c 100644
--- a/xen/arch/x86/mm/p2m-ept.c
+++ b/xen/arch/x86/mm/p2m-ept.c
@@ -1153,8 +1153,13 @@ static void ept_sync_domain_prepare(struct p2m_domain *p2m)
struct domain *d = p2m->domain;
struct ept_data *ept = &p2m->ept;
- if ( nestedhvm_enabled(d) && !p2m_is_nestedp2m(p2m) )
- p2m_flush_nestedp2m(d);
+ if ( nestedhvm_enabled(d) )
+ {
+ if ( p2m_is_nestedp2m(p2m) )
+ ept = &p2m_get_hostp2m(d)->ept;
+ else
+ p2m_flush_nestedp2m(d);
+ }
/*
* Need to invalidate on all PCPUs because either:
--
2.11.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v1] vvmx: fix ept_sync() for nested p2m
2017-06-28 9:35 [PATCH v1] vvmx: fix ept_sync() for nested p2m Sergey Dyasli
@ 2017-06-28 16:51 ` Andrew Cooper
2017-06-30 9:29 ` Tian, Kevin
1 sibling, 0 replies; 3+ messages in thread
From: Andrew Cooper @ 2017-06-28 16:51 UTC (permalink / raw)
To: Sergey Dyasli, xen-devel
Cc: George Dunlap, Kevin Tian, Tim Deegan, Jan Beulich, Jun Nakajima
On 28/06/17 10:35, Sergey Dyasli wrote:
> If ept_sync_domain() is called for np2m, the following happens:
>
> 1. *np2m*::ept_data::invalidate cpumask is updated
> 2. IPIs are sent for CPUs in domain_dirty_cpumask forcing vmexits
> 3. vmx_vmenter_helper() checks *hostp2m*::ept_data::invalidate
> and does nothing
>
> Which is clearly a bug. Make ept_sync_domain() to update hostp2m's
> invalidate mask in nested p2m case and make vmx_vmenter_helper() to
> invalidate EPT translations for all EPTPs if nested virt is enabled.
>
> Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v1] vvmx: fix ept_sync() for nested p2m
2017-06-28 9:35 [PATCH v1] vvmx: fix ept_sync() for nested p2m Sergey Dyasli
2017-06-28 16:51 ` Andrew Cooper
@ 2017-06-30 9:29 ` Tian, Kevin
1 sibling, 0 replies; 3+ messages in thread
From: Tian, Kevin @ 2017-06-30 9:29 UTC (permalink / raw)
To: Sergey Dyasli, xen-devel
Cc: George Dunlap, Andrew Cooper, Tim Deegan, Jan Beulich, Nakajima, Jun
> From: Sergey Dyasli [mailto:sergey.dyasli@citrix.com]
> Sent: Wednesday, June 28, 2017 5:36 PM
>
> If ept_sync_domain() is called for np2m, the following happens:
>
> 1. *np2m*::ept_data::invalidate cpumask is updated
> 2. IPIs are sent for CPUs in domain_dirty_cpumask forcing vmexits
> 3. vmx_vmenter_helper() checks *hostp2m*::ept_data::invalidate
> and does nothing
>
> Which is clearly a bug. Make ept_sync_domain() to update hostp2m's
> invalidate mask in nested p2m case and make vmx_vmenter_helper() to
> invalidate EPT translations for all EPTPs if nested virt is enabled.
>
> Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
Acked-by: Kevin Tian <kevin.tian@intel.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-06-30 9:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-28 9:35 [PATCH v1] vvmx: fix ept_sync() for nested p2m Sergey Dyasli
2017-06-28 16:51 ` Andrew Cooper
2017-06-30 9:29 ` Tian, Kevin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.