Prev: wireless: Convert wiphy_debug macro to function
Next: virtually indexed array library.
From: Avi Kivity on 28 Jul 2010 08:00
On 07/28/2010 02:51 PM, Roedel, Joerg wrote:
> On Wed, Jul 28, 2010 at 07:34:11AM -0400, Avi Kivity wrote:
>> On 07/28/2010 02:25 PM, Roedel, Joerg wrote:
>>> On Wed, Jul 28, 2010 at 06:28:06AM -0400, Avi Kivity wrote:
>>>> We have a slightly different problem, if the nested guest manages to get
>>>> an instruction to be emulated by the host (if the guest assigned it the
>>>> cirrus framebuffer, for example, so from L1's point of view it is RAM,
>>>> but from L0's point of view it is emulated), then we miss the
>>>> intercept. L2 could take over L1 this way.
>>> I wonder how this could happen. Shouldn't the shadow paging code take
>>> care of this?
>>>
>> L1 thinks the memory is RAM, so it maps it directly and forgets about
>> it. L0 knows it isn't, so it leaves it unmapped and emulates any
>> instruction which accesses it. The emulator needs to check whether the
>> instruction is intercepted or not.
> Instruction intercepts take precedence over exception intercepts. So if
> the L2 executes an instruction which the L1 hypervisor wants to
> intercept we get this instruction intercept on the host side and
> re-inject it.
> To my understanding the fault-intercept which causes the emulator to run
> can only happen if the instruction causing the fault isn't intercepted
> itself.

If the instruction opcode is on mmio, the processor never sees the
opcode and thus can not intercept. Or the processor may see one
instruction, which is not intercepted, but by the time the emulator
kicks in a different instruction takes its place, since another vcpu is
evilly cross-modifying the code.

>> Note, I think if the instruction operand is in mmio, we're safe, since
>> the intercept has higher priority than memory access. But if the
>> instruction itself is on mmio, or if we entered the emulator through smp
>> trickery, then the emulator will execute the instruction in nested guest
>> context.
> Right. But if the guest executes code which is on mmio we are doomed
> anyway because our instruction emulator does not emulate the whole x86
> instruction set, right?

The guest (L2 in this case) is doomed since it execution cannot
continue. But L1 and L0 are fine. The problem with L2 avoiding
intercepts is that L2 can change control registers and take over L1.

--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Roedel, Joerg on 28 Jul 2010 08:00
On Wed, Jul 28, 2010 at 07:34:11AM -0400, Avi Kivity wrote:
> On 07/28/2010 02:25 PM, Roedel, Joerg wrote:
> > On Wed, Jul 28, 2010 at 06:28:06AM -0400, Avi Kivity wrote:
> >> We have a slightly different problem, if the nested guest manages to get
> >> an instruction to be emulated by the host (if the guest assigned it the
> >> cirrus framebuffer, for example, so from L1's point of view it is RAM,
> >> but from L0's point of view it is emulated), then we miss the
> >> intercept. L2 could take over L1 this way.
> > I wonder how this could happen. Shouldn't the shadow paging code take
> > care of this?
> >
>
> L1 thinks the memory is RAM, so it maps it directly and forgets about
> it. L0 knows it isn't, so it leaves it unmapped and emulates any
> instruction which accesses it. The emulator needs to check whether the
> instruction is intercepted or not.

Instruction intercepts take precedence over exception intercepts. So if
the L2 executes an instruction which the L1 hypervisor wants to
intercept we get this instruction intercept on the host side and
re-inject it.
To my understanding the fault-intercept which causes the emulator to run
can only happen if the instruction causing the fault isn't intercepted
itself.

> Note, I think if the instruction operand is in mmio, we're safe, since
> the intercept has higher priority than memory access. But if the
> instruction itself is on mmio, or if we entered the emulator through smp
> trickery, then the emulator will execute the instruction in nested guest
> context.

Right. But if the guest executes code which is on mmio we are doomed
anyway because our instruction emulator does not emulate the whole x86
instruction set, right?

--
Joerg Roedel - AMD Operating System Research Center

Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach
General Managers: Alberto Bozzo, Andrew Bowd
Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Roedel, Joerg on 28 Jul 2010 08:20
On Wed, Jul 28, 2010 at 07:57:36AM -0400, Avi Kivity wrote:

> If the instruction opcode is on mmio, the processor never sees the
> opcode and thus can not intercept. Or the processor may see one
> instruction, which is not intercepted, but by the time the emulator
> kicks in a different instruction takes its place, since another vcpu is
> evilly cross-modifying the code.

Right. X-modifying code is a problem too.

> The guest (L2 in this case) is doomed since it execution cannot
> continue. But L1 and L0 are fine. The problem with L2 avoiding
> intercepts is that L2 can change control registers and take over L1.

Right too. We can not ignore it. The right fix is probably a check for
the instruction intercepts right after the decoder has run and before
the emulator ran.

Joer

--
Joerg Roedel - AMD Operating System Research Center

Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach
General Managers: Alberto Bozzo, Andrew Bowd
Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Avi Kivity on 28 Jul 2010 08:30
On 07/28/2010 03:18 PM, Roedel, Joerg wrote:
>
>
>> The guest (L2 in this case) is doomed since it execution cannot
>> continue. But L1 and L0 are fine. The problem with L2 avoiding
>> intercepts is that L2 can change control registers and take over L1.
> Right too. We can not ignore it. The right fix is probably a check for
> the instruction intercepts right after the decoder has run and before
> the emulator ran.

Should be easy - just like we have the Priv flag, add a bitfield to
opcode_table that says which bit we need to check in the control area.

--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
First  |  Prev  | 
Pages: 1 2
Prev: wireless: Convert wiphy_debug macro to function
Next: virtually indexed array library.