@@ -2029,6 +2029,8 @@ int xc_monitor_debug_exceptions(xc_interface *xch, domid_t domain_id,
int xc_monitor_cpuid(xc_interface *xch, domid_t domain_id, bool enable);
int xc_monitor_privileged_call(xc_interface *xch, domid_t domain_id,
bool enable);
+int xc_monitor_emul_unhandleable(xc_interface *xch, domid_t domain_id,
+ bool enable);
/**
* This function enables / disables emulation for each REP for a
* REP-compatible instruction.
@@ -216,6 +216,20 @@ int xc_monitor_privileged_call(xc_interface *xch, domid_t domain_id,
return do_domctl(xch, &domctl);
}
+int xc_monitor_emul_unhandleable(xc_interface *xch, domid_t domain_id,
+ bool enable)
+{
+ DECLARE_DOMCTL;
+
+ domctl.cmd = XEN_DOMCTL_monitor_op;
+ domctl.domain = domain_id;
+ domctl.u.monitor_op.op = enable ? XEN_DOMCTL_MONITOR_OP_ENABLE
+ : XEN_DOMCTL_MONITOR_OP_DISABLE;
+ domctl.u.monitor_op.event = XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE;
+
+ return do_domctl(xch, &domctl);
+}
+
/*
* Local variables:
* mode: C
new file mode 100644
@@ -0,0 +1,212 @@
+From 97b3e9c22c7c6a0e49bde4e1bb6866a02ad43007 Mon Sep 17 00:00:00 2001
+From: Petre Pircalabu <ppircalabu@bitdefender.com>
+Date: Thu, 29 Jun 2017 20:40:46 +0300
+Subject: [PATCH] x86/monitor: Notify monitor if an emulation fails.
+
+If case of a vm_event with the emulate_flags set, if the instruction
+cannot be emulated, the monitor should be notified instead of directly
+injecting a hw exception.
+This behavior can be used to re-execute an instruction not supported by
+the emulator using the real processor (e.g. altp2m) instead of just
+crashing.
+
+Signed-off-by: Petre Pircalabu <ppircalabu@bitdefender.com>
+---
+ tools/libxc/include/xenctrl.h | 2 ++
+ tools/libxc/xc_monitor.c | 14 ++++++++++++++
+ xen/arch/x86/hvm/emulate.c | 5 ++++-
+ xen/arch/x86/hvm/monitor.c | 19 +++++++++++++++++++
+ xen/arch/x86/monitor.c | 12 ++++++++++++
+ xen/include/asm-x86/domain.h | 1 +
+ xen/include/asm-x86/hvm/monitor.h | 1 +
+ xen/include/asm-x86/monitor.h | 3 ++-
+ xen/include/public/domctl.h | 1 +
+ xen/include/public/vm_event.h | 2 ++
+ 10 files changed, 58 insertions(+), 2 deletions(-)
+
+diff --git a/tools/libxc/include/xenctrl.h b/tools/libxc/include/xenctrl.h
+index c51bb3b..8deb5ac 100644
+--- a/tools/libxc/include/xenctrl.h
++++ b/tools/libxc/include/xenctrl.h
+@@ -2029,6 +2029,8 @@ int xc_monitor_debug_exceptions(xc_interface *xch, domid_t domain_id,
+ int xc_monitor_cpuid(xc_interface *xch, domid_t domain_id, bool enable);
+ int xc_monitor_privileged_call(xc_interface *xch, domid_t domain_id,
+ bool enable);
++int xc_monitor_emul_unhandleable(xc_interface *xch, domid_t domain_id,
++ bool enable);
+ /**
+ * This function enables / disables emulation for each REP for a
+ * REP-compatible instruction.
+diff --git a/tools/libxc/xc_monitor.c b/tools/libxc/xc_monitor.c
+index b44ce93..8e72c6c 100644
+--- a/tools/libxc/xc_monitor.c
++++ b/tools/libxc/xc_monitor.c
+@@ -216,6 +216,20 @@ int xc_monitor_privileged_call(xc_interface *xch, domid_t domain_id,
+ return do_domctl(xch, &domctl);
+ }
+
++int xc_monitor_emul_unhandleable(xc_interface *xch, domid_t domain_id,
++ bool enable)
++{
++ DECLARE_DOMCTL;
++
++ domctl.cmd = XEN_DOMCTL_monitor_op;
++ domctl.domain = domain_id;
++ domctl.u.monitor_op.op = enable ? XEN_DOMCTL_MONITOR_OP_ENABLE
++ : XEN_DOMCTL_MONITOR_OP_DISABLE;
++ domctl.u.monitor_op.event = XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE;
++
++ return do_domctl(xch, &domctl);
++}
++
+ /*
+ * Local variables:
+ * mode: C
+diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
+index e97aa69..083a38a 100644
+--- a/xen/arch/x86/hvm/emulate.c
++++ b/xen/arch/x86/hvm/emulate.c
+@@ -14,12 +14,14 @@
+ #include <xen/sched.h>
+ #include <xen/paging.h>
+ #include <xen/trace.h>
++#include <xen/vm_event.h>
+ #include <asm/event.h>
+ #include <asm/i387.h>
+ #include <asm/xstate.h>
+ #include <asm/hvm/emulate.h>
+ #include <asm/hvm/hvm.h>
+ #include <asm/hvm/ioreq.h>
++#include <asm/hvm/monitor.h>
+ #include <asm/hvm/trace.h>
+ #include <asm/hvm/support.h>
+ #include <asm/hvm/svm/svm.h>
+@@ -2101,7 +2103,8 @@ void hvm_emulate_one_vm_event(enum emul_kind kind, unsigned int trapnr,
+ return;
+ case X86EMUL_UNHANDLEABLE:
+ hvm_dump_emulation_state(XENLOG_G_DEBUG, "Mem event", &ctx);
+- hvm_inject_hw_exception(trapnr, errcode);
++ if ( (kind != EMUL_KIND_NORMAL) || !hvm_monitor_emul_unhandleable() )
++ hvm_inject_hw_exception(trapnr, errcode);
+ break;
+ case X86EMUL_EXCEPTION:
+ hvm_inject_event(&ctx.ctxt.event);
+diff --git a/xen/arch/x86/hvm/monitor.c b/xen/arch/x86/hvm/monitor.c
+index a7ccfc4..02e0ba5 100644
+--- a/xen/arch/x86/hvm/monitor.c
++++ b/xen/arch/x86/hvm/monitor.c
+@@ -57,6 +57,25 @@ bool_t hvm_monitor_cr(unsigned int index, unsigned long value, unsigned long old
+ return 0;
+ }
+
++
++bool hvm_monitor_emul_unhandleable(void)
++{
++ struct vcpu *curr = current;
++ struct domain *d = curr->domain;
++
++ /*
++ * Send a vm_event to the monitor to signal that the current
++ * instruction couldn't be emulated.
++ */
++ vm_event_request_t req = {
++ .reason = VM_EVENT_REASON_EMUL_UNHANDLEABLE,
++ .vcpu_id = curr->vcpu_id,
++ };
++
++ return ( d->arch.monitor.emul_unhandleable &&
++ monitor_traps(curr, true, &req) );
++}
++
+ void hvm_monitor_msr(unsigned int msr, uint64_t value)
+ {
+ struct vcpu *curr = current;
+diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c
+index 706454f..51252fe 100644
+--- a/xen/arch/x86/monitor.c
++++ b/xen/arch/x86/monitor.c
+@@ -283,6 +283,18 @@ int arch_monitor_domctl_event(struct domain *d,
+ break;
+ }
+
++ case XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE:
++ {
++ bool old_status = ad->monitor.emul_unhandleable;
++ if ( unlikely(old_status == requested_status) )
++ return -EEXIST;
++
++ domain_pause(d);
++ ad->monitor.emul_unhandleable = requested_status;
++ domain_unpause(d);
++ break;
++ }
++
+ default:
+ /*
+ * Should not be reached unless arch_monitor_get_capabilities() is
+diff --git a/xen/include/asm-x86/domain.h b/xen/include/asm-x86/domain.h
+index c10522b..7f3b54c 100644
+--- a/xen/include/asm-x86/domain.h
++++ b/xen/include/asm-x86/domain.h
+@@ -405,6 +405,7 @@ struct arch_domain
+ unsigned int debug_exception_sync : 1;
+ unsigned int cpuid_enabled : 1;
+ unsigned int descriptor_access_enabled : 1;
++ unsigned int emul_unhandleable : 1;
+ struct monitor_msr_bitmap *msr_bitmap;
+ uint64_t write_ctrlreg_mask[4];
+ } monitor;
+diff --git a/xen/include/asm-x86/hvm/monitor.h b/xen/include/asm-x86/hvm/monitor.h
+index d9efb35..4030be7 100644
+--- a/xen/include/asm-x86/hvm/monitor.h
++++ b/xen/include/asm-x86/hvm/monitor.h
+@@ -47,6 +47,7 @@ int hvm_monitor_cpuid(unsigned long insn_length, unsigned int leaf,
+ unsigned int subleaf);
+ void hvm_monitor_interrupt(unsigned int vector, unsigned int type,
+ unsigned int err, uint64_t cr2);
++bool hvm_monitor_emul_unhandleable(void);
+
+ #endif /* __ASM_X86_HVM_MONITOR_H__ */
+
+diff --git a/xen/include/asm-x86/monitor.h b/xen/include/asm-x86/monitor.h
+index c5c323b..38ba0ff 100644
+--- a/xen/include/asm-x86/monitor.h
++++ b/xen/include/asm-x86/monitor.h
+@@ -77,7 +77,8 @@ static inline uint32_t arch_monitor_get_capabilities(struct domain *d)
+ (1U << XEN_DOMCTL_MONITOR_EVENT_GUEST_REQUEST) |
+ (1U << XEN_DOMCTL_MONITOR_EVENT_DEBUG_EXCEPTION) |
+ (1U << XEN_DOMCTL_MONITOR_EVENT_CPUID) |
+- (1U << XEN_DOMCTL_MONITOR_EVENT_INTERRUPT);
++ (1U << XEN_DOMCTL_MONITOR_EVENT_INTERRUPT) |
++ (1U << XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE);
+
+ /* Since we know this is on VMX, we can just call the hvm func */
+ if ( hvm_is_singlestep_supported() )
+diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
+index ff39762..6bd8666 100644
+--- a/xen/include/public/domctl.h
++++ b/xen/include/public/domctl.h
+@@ -1083,6 +1083,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_domctl_psr_cmt_op_t);
+ #define XEN_DOMCTL_MONITOR_EVENT_PRIVILEGED_CALL 7
+ #define XEN_DOMCTL_MONITOR_EVENT_INTERRUPT 8
+ #define XEN_DOMCTL_MONITOR_EVENT_DESC_ACCESS 9
++#define XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE 10
+
+ struct xen_domctl_monitor_op {
+ uint32_t op; /* XEN_DOMCTL_MONITOR_OP_* */
+diff --git a/xen/include/public/vm_event.h b/xen/include/public/vm_event.h
+index f01e471..5548afb 100644
+--- a/xen/include/public/vm_event.h
++++ b/xen/include/public/vm_event.h
+@@ -148,6 +148,8 @@
+ #define VM_EVENT_REASON_INTERRUPT 12
+ /* A descriptor table register was accessed. */
+ #define VM_EVENT_REASON_DESCRIPTOR_ACCESS 13
++/* Current instruction couldn't be emulated */
++#define VM_EVENT_REASON_EMUL_UNHANDLEABLE 14
+
+ /* Supported values for the vm_event_write_ctrlreg index. */
+ #define VM_EVENT_X86_CR0 0
+--
+2.7.4
+
@@ -14,12 +14,14 @@
#include <xen/sched.h>
#include <xen/paging.h>
#include <xen/trace.h>
+#include <xen/vm_event.h>
#include <asm/event.h>
#include <asm/i387.h>
#include <asm/xstate.h>
#include <asm/hvm/emulate.h>
#include <asm/hvm/hvm.h>
#include <asm/hvm/ioreq.h>
+#include <asm/hvm/monitor.h>
#include <asm/hvm/trace.h>
#include <asm/hvm/support.h>
#include <asm/hvm/svm/svm.h>
@@ -2101,7 +2103,8 @@ void hvm_emulate_one_vm_event(enum emul_kind kind, unsigned int trapnr,
return;
case X86EMUL_UNHANDLEABLE:
hvm_dump_emulation_state(XENLOG_G_DEBUG, "Mem event", &ctx);
- hvm_inject_hw_exception(trapnr, errcode);
+ if ( !hvm_monitor_emul_unhandleable() )
+ hvm_inject_hw_exception(trapnr, errcode);
break;
case X86EMUL_EXCEPTION:
hvm_inject_event(&ctx.ctxt.event);
@@ -57,6 +57,25 @@ bool_t hvm_monitor_cr(unsigned int index, unsigned long value, unsigned long old
return 0;
}
+
+bool hvm_monitor_emul_unhandleable(void)
+{
+ struct vcpu *curr = current;
+ struct domain *d = curr->domain;
+
+ /*
+ * Send a vm_event to the monitor to signal that the current
+ * instruction couldn't be emulated.
+ */
+ vm_event_request_t req = {
+ .reason = VM_EVENT_REASON_EMUL_UNHANDLEABLE,
+ .vcpu_id = curr->vcpu_id,
+ };
+
+ return ( d->arch.monitor.emul_unhandleable &&
+ monitor_traps(curr, true, &req) );
+}
+
void hvm_monitor_msr(unsigned int msr, uint64_t value)
{
struct vcpu *curr = current;
@@ -283,6 +283,18 @@ int arch_monitor_domctl_event(struct domain *d,
break;
}
+ case XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE:
+ {
+ bool old_status = ad->monitor.emul_unhandleable;
+ if ( unlikely(old_status == requested_status) )
+ return -EEXIST;
+
+ domain_pause(d);
+ ad->monitor.emul_unhandleable = requested_status;
+ domain_unpause(d);
+ break;
+ }
+
default:
/*
* Should not be reached unless arch_monitor_get_capabilities() is
@@ -405,6 +405,7 @@ struct arch_domain
unsigned int debug_exception_sync : 1;
unsigned int cpuid_enabled : 1;
unsigned int descriptor_access_enabled : 1;
+ unsigned int emul_unhandleable : 1;
struct monitor_msr_bitmap *msr_bitmap;
uint64_t write_ctrlreg_mask[4];
} monitor;
@@ -47,6 +47,7 @@ int hvm_monitor_cpuid(unsigned long insn_length, unsigned int leaf,
unsigned int subleaf);
void hvm_monitor_interrupt(unsigned int vector, unsigned int type,
unsigned int err, uint64_t cr2);
+bool hvm_monitor_emul_unhandleable(void);
#endif /* __ASM_X86_HVM_MONITOR_H__ */
@@ -77,7 +77,8 @@ static inline uint32_t arch_monitor_get_capabilities(struct domain *d)
(1U << XEN_DOMCTL_MONITOR_EVENT_GUEST_REQUEST) |
(1U << XEN_DOMCTL_MONITOR_EVENT_DEBUG_EXCEPTION) |
(1U << XEN_DOMCTL_MONITOR_EVENT_CPUID) |
- (1U << XEN_DOMCTL_MONITOR_EVENT_INTERRUPT);
+ (1U << XEN_DOMCTL_MONITOR_EVENT_INTERRUPT) |
+ (1U << XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE);
/* Since we know this is on VMX, we can just call the hvm func */
if ( hvm_is_singlestep_supported() )
@@ -1083,6 +1083,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_domctl_psr_cmt_op_t);
#define XEN_DOMCTL_MONITOR_EVENT_PRIVILEGED_CALL 7
#define XEN_DOMCTL_MONITOR_EVENT_INTERRUPT 8
#define XEN_DOMCTL_MONITOR_EVENT_DESC_ACCESS 9
+#define XEN_DOMCTL_MONITOR_EVENT_EMUL_UNHANDLEABLE 10
struct xen_domctl_monitor_op {
uint32_t op; /* XEN_DOMCTL_MONITOR_OP_* */
@@ -148,6 +148,8 @@
#define VM_EVENT_REASON_INTERRUPT 12
/* A descriptor table register was accessed. */
#define VM_EVENT_REASON_DESCRIPTOR_ACCESS 13
+/* Current instruction couldn't be emulated */
+#define VM_EVENT_REASON_EMUL_UNHANDLEABLE 14
/* Supported values for the vm_event_write_ctrlreg index. */
#define VM_EVENT_X86_CR0 0
If case of a vm_event with the emulate_flags set, if the instruction cannot be emulated, the monitor should be notified instead of directly injecting a hw exception. This behavior can be used to re-execute an instruction not supported by the emulator using the real processor (e.g. altp2m) instead of just crashing. Signed-off-by: Petre Pircalabu <ppircalabu@bitdefender.com> --- Changed since v1: * Removed the emulation kind check when calling hvm_inject_hw_exception --- tools/libxc/include/xenctrl.h | 2 + tools/libxc/xc_monitor.c | 14 ++ ...itor-Notify-monitor-if-an-emulation-fails.patch | 212 +++++++++++++++++++++ xen/arch/x86/hvm/emulate.c | 5 +- xen/arch/x86/hvm/monitor.c | 19 ++ xen/arch/x86/monitor.c | 12 ++ xen/include/asm-x86/domain.h | 1 + xen/include/asm-x86/hvm/monitor.h | 1 + xen/include/asm-x86/monitor.h | 3 +- xen/include/public/domctl.h | 1 + xen/include/public/vm_event.h | 2 + 11 files changed, 270 insertions(+), 2 deletions(-) create mode 100644 tools/tests/xen-access/0001-x86-monitor-Notify-monitor-if-an-emulation-fails.patch