File 5b34891a-x86-HVM-dont-cause-NM-to-be-raised.patch of Package xen.7985
# Commit 488efc29e4e996bb3805c982200f65061390cdce
# Date 2018-06-28 09:07:06 +0200
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/HVM: don't cause #NM to be raised in Xen
The changes for XSA-267 did not touch management of CR0.TS for HVM
guests. In fully eager mode this bit should never be set when
respective vCPU-s are active, or else hvmemul_get_fpu() might leave it
wrongly set, leading to #NM in hypervisor context.
{svm,vmx}_enter() and {svm,vmx}_fpu_dirty_intercept() become unreachable
this way. Explicit {svm,vmx}_fpu_leave() invocations need to be guarded
now.
With no CR0.TS management necessary in fully eager mode, there's also no
need anymore to intercept #NM.
Reported-by: Charles Arnold <carnold@suse.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -546,7 +546,10 @@ void svm_update_guest_cr(struct vcpu *v,
if ( !(v->arch.hvm_vcpu.guest_cr[0] & X86_CR0_TS) )
{
if ( v != current )
- hw_cr0_mask |= X86_CR0_TS;
+ {
+ if ( !v->arch.fully_eager_fpu )
+ hw_cr0_mask |= X86_CR0_TS;
+ }
else if ( vmcb_get_cr0(vmcb) & X86_CR0_TS )
svm_fpu_enter(v);
}
@@ -1033,7 +1036,8 @@ static void svm_ctxt_switch_from(struct
if ( unlikely((read_efer() & EFER_SVME) == 0) )
return;
- svm_fpu_leave(v);
+ if ( !v->arch.fully_eager_fpu )
+ svm_fpu_leave(v);
svm_save_dr(v);
svm_lwp_save(v);
--- a/xen/arch/x86/hvm/svm/vmcb.c
+++ b/xen/arch/x86/hvm/svm/vmcb.c
@@ -178,8 +178,8 @@ static int construct_vmcb(struct vcpu *v
paging_update_paging_modes(v);
vmcb->_exception_intercepts =
- HVM_TRAP_MASK
- | (1U << TRAP_no_device);
+ HVM_TRAP_MASK |
+ (v->arch.fully_eager_fpu ? 0 : (1U << TRAP_no_device));
if ( paging_mode_hap(v->domain) )
{
--- a/xen/arch/x86/hvm/vmx/vmcs.c
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
@@ -1146,7 +1146,9 @@ static int construct_vmcs(struct vcpu *v
__vmwrite(HOST_GS_BASE, 0);
/* Host control registers. */
- v->arch.hvm_vmx.host_cr0 = read_cr0() | X86_CR0_TS;
+ v->arch.hvm_vmx.host_cr0 = read_cr0() & ~X86_CR0_TS;
+ if ( !v->arch.fully_eager_fpu )
+ v->arch.hvm_vmx.host_cr0 |= X86_CR0_TS;
__vmwrite(HOST_CR0, v->arch.hvm_vmx.host_cr0);
__vmwrite(HOST_CR4, mmu_cr4_features);
@@ -1226,7 +1228,7 @@ static int construct_vmcs(struct vcpu *v
v->arch.hvm_vmx.exception_bitmap = HVM_TRAP_MASK
| (paging_mode_hap(d) ? 0 : (1U << TRAP_page_fault))
- | (1U << TRAP_no_device);
+ | (v->arch.fully_eager_fpu ? 0 : (1U << TRAP_no_device));
vmx_update_exception_bitmap(v);
v->arch.hvm_vcpu.guest_cr[0] = X86_CR0_PE | X86_CR0_ET;
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1035,7 +1035,8 @@ static void vmx_ctxt_switch_from(struct
vmx_vmcs_reload(v);
}
- vmx_fpu_leave(v);
+ if ( !v->arch.fully_eager_fpu )
+ vmx_fpu_leave(v);
vmx_save_guest_msrs(v);
vmx_restore_host_msrs();
vmx_save_dr(v);
@@ -1597,7 +1598,10 @@ static void vmx_update_guest_cr(struct v
if ( !(v->arch.hvm_vcpu.guest_cr[0] & X86_CR0_TS) )
{
if ( v != current )
- hw_cr0_mask |= X86_CR0_TS;
+ {
+ if ( !v->arch.fully_eager_fpu )
+ hw_cr0_mask |= X86_CR0_TS;
+ }
else if ( v->arch.hvm_vcpu.hw_cr[0] & X86_CR0_TS )
vmx_fpu_enter(v);
}