On 25/02/2022 08:44, Jan Beulich wrote: > On 24.02.2022 20:48, Andrew Cooper wrote: >> In VMX operation, the handling of INIT IPIs is changed. EXIT_REASON_INIT has >> nothing to do with the guest in question, simply signals that an INIT was >> received. >> >> Ignoring the INIT is probably the wrong thing to do, but is helpful for >> debugging. Crashing the domain which happens to be in context is definitely >> wrong. Print an error message and continue. >> >> Discovered as collateral damage from when an AP triple faults on S3 resume on >> Intel TigerLake platforms. > I'm afraid I don't follow the scenario, which was (only) outlined in > patch 1: Why would the BSP receive INIT in this case?
SHUTDOWN is a signal emitted by a core when it can't continue. Triple fault is one cause, but other sources include a double #MC, etc. Some external component, in the PCH I expect, needs to turn this into a platform reset, because one malfunctioning core can't. It is why a triple fault on any logical processor brings the whole system down. > And it also cannot be that the INIT was received by the vCPU while running on > another CPU: It's nothing (really) to do with the vCPU. INIT is a external signal to the (real) APIC, just like NMI/etc. It is the next VMEntry on a CPU which received INIT that suffers a VMEntry failure, and the VMEntry failure has nothing to do with the contents of the VMCS. Importantly for Xen however, this isn't applicable for scheduling PV vCPUs, which is why dom0 wasn't the one that crashed. This actually meant that dom0 was alive an usable, albeit it sharing all vCPUs on a single CPU. The change in INIT behaviour exists for TXT, where is it critical that software can clear secrets from RAM before resetting. I'm not wanting to get into any of that because it's far more complicated than I have time to fix. Xen still ignores the INIT, but now doesn't crash an entirely innocent domain as a side effect of the platform sending an INIT IPI. ~Andrew P.S. This is also fun without interrupt remapping. XSA-3 didn't imagine the full scope of problems which could occur.
