From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9663FC2B9F4 for ; Mon, 28 Jun 2021 09:12:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7B96C6144D for ; Mon, 28 Jun 2021 09:12:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232444AbhF1JPL (ORCPT ); Mon, 28 Jun 2021 05:15:11 -0400 Received: from forward104o.mail.yandex.net ([37.140.190.179]:36948 "EHLO forward104o.mail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232284AbhF1JPL (ORCPT ); Mon, 28 Jun 2021 05:15:11 -0400 Received: from iva3-2436f5349071.qloud-c.yandex.net (iva3-2436f5349071.qloud-c.yandex.net [IPv6:2a02:6b8:c0c:498b:0:640:2436:f534]) by forward104o.mail.yandex.net (Yandex) with ESMTP id 2CFC8941BDA; Mon, 28 Jun 2021 12:12:44 +0300 (MSK) Received: from iva1-bc1861525829.qloud-c.yandex.net (iva1-bc1861525829.qloud-c.yandex.net [2a02:6b8:c0c:a0e:0:640:bc18:6152]) by iva3-2436f5349071.qloud-c.yandex.net (mxback/Yandex) with ESMTP id LYzadKIi5H-ChHW0dbr; Mon, 28 Jun 2021 12:12:44 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1624871564; bh=bQ27ahGlifoFXBKmVQcP6hbPUEWBRLGf/ycKLEjqtTI=; h=In-Reply-To:From:Date:References:To:Subject:Message-ID:Cc; b=oy6MSMk7oONIzEc7gqboWZ65yktvfzeOyun8oodDTp55KSloHFogPqhOp9zKMyH+n B7Hy3iK3BQfJ/B62n8FY/BB0zYMnKv88DItbQaOZi3MBdY70hX3DlW9XFJuXOsFKCv gBsoOadm85wKA6fK5JGhxJ1NR+IHlrdwtR78+G1M= Authentication-Results: iva3-2436f5349071.qloud-c.yandex.net; dkim=pass header.i=@yandex.ru Received: by iva1-bc1861525829.qloud-c.yandex.net (smtp/Yandex) with ESMTPSA id UdIBP1W98W-CgPurpiK; Mon, 28 Jun 2021 12:12:43 +0300 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client certificate not present) Subject: Re: [PATCH] KVM: X86: Fix exception untrigger on ret to user To: Vitaly Kuznetsov Cc: Paolo Bonzini , Sean Christopherson , Wanpeng Li , Jim Mattson , Joerg Roedel , Thomas Gleixner , Ingo Molnar , Borislav Petkov , x86@kernel.org, "H. Peter Anvin" , kvm@vger.kernel.org References: <20210627233819.857906-1-stsp2@yandex.ru> <87zgva3162.fsf@vitty.brq.redhat.com> From: stsp Message-ID: Date: Mon, 28 Jun 2021 12:12:41 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <87zgva3162.fsf@vitty.brq.redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org 28.06.2021 10:20, Vitaly Kuznetsov пишет: > Stas Sergeev writes: > >> When returning to user, the special care is taken about the >> exception that was already injected to VMCS but not yet to guest. >> cancel_injection removes such exception from VMCS. It is set as >> pending, and if the user does KVM_SET_REGS, it gets completely canceled. >> >> This didn't happen though, because the vcpu->arch.exception.injected >> and vcpu->arch.exception.pending were forgotten to update in >> cancel_injection. As the result, KVM_SET_REGS didn't cancel out >> anything, and the exception was re-injected on the next KVM_RUN, >> even though the guest registers (like EIP) were already modified. >> This was leading to an exception coming from the "wrong place". > It shouldn't be that hard to reproduce this in selftests, I > believe. Unfortunately the problem happens only on core2 CPU. I believe the reason is perhaps that more modern CPUs do not go to software for the exception injection? > 'exception.injected' can even be set through > KVM_SET_VCPU_EVENTS and then we call KVM_SET_REGS. Does this mean I shouldn't add WARN_ON_ONCE()? > Alternatively, we can > trigger a real exception from the guest. Could you maybe add something > like this to tools/testing/selftests/kvm/x86_64/set_sregs_test.c? Even if you have the right CPU to reproduce that (Core2), you also need the _TIF_SIGPENDING at the right moment to provoke the cancel_injection path. This is like triggering a race. If you don't get _TIF_SIGPENDING then it will just re-enter guest and inject the exception properly.