From: Sean Christopherson <seanjc@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
vkuznets@redhat.com, mlevitsk@redhat.com,
Jim Mattson <jmattson@google.com>
Subject: Re: [PATCH 03/28] KVM: nSVM: inject exceptions via svm_check_nested_events
Date: Fri, 5 Mar 2021 17:39:58 -0800 [thread overview]
Message-ID: <YELdblXaKBTQ4LGf@google.com> (raw)
In-Reply-To: <20200526172308.111575-4-pbonzini@redhat.com>
Hopefully I got the In-Reply-To header right...
On Thu, May 28, 2020, Paolo Bonzini wrote:
> This allows exceptions injected by the emulator to be properly delivered
> as vmexits. The code also becomes simpler, because we can just let all
> L0-intercepted exceptions go through the usual path. In particular, our
> emulation of the VMX #DB exit qualification is very much simplified,
> because the vmexit injection path can use kvm_deliver_exception_payload
> to update DR6.
Sadly, it's also completely and utterly broken for #UD and #GP, and a bit
sketchy for #AC.
Unless KVM (L0) knowingly wants to override L1, e.g. KVM_GUESTDBG_* cases, KVM
shouldn't do a damn thing except forward the exception to L1 if L1 wants the
exception.
ud_interception() and gp_interception() do quite a bit before forwarding the
exception, and in the case of #UD, it's entirely possible the #UD will never get
forwarded to L1. #GP is even more problematic because it's a contributory
exception, and kvm_multiple_exception() is not equipped to check and handle
nested intercepts before vectoring the exception, which means KVM will
incorrectly escalate a #GP->#DF and #GP->#DF->Triple Fault instead of exiting
to L1. That's a wee bit problematic since KVM also has a soon-to-be-fixed bug
where it kills L1 on a Triple Fault in L2...
I think this will fix the bugs, I'll properly test and post next week.
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 90a1704b5752..928e11646dca 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -926,11 +926,11 @@ static int nested_svm_intercept(struct vcpu_svm *svm)
}
case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: {
/*
- * Host-intercepted exceptions have been checked already in
- * nested_svm_exit_special. There is nothing to do here,
- * the vmexit is injected by svm_check_nested_events.
+ * Note, KVM may already have snagged exceptions it wants to
+ * handle even if L1 also wants the exception, e.g. #MC.
*/
- vmexit = NESTED_EXIT_DONE;
+ if (vmcb_is_intercept(&svm->nested.ctl, exit_code))
+ vmexit = NESTED_EXIT_DONE;
break;
}
case SVM_EXIT_ERR: {
@@ -1122,19 +1122,23 @@ int nested_svm_exit_special(struct vcpu_svm *svm)
case SVM_EXIT_INTR:
case SVM_EXIT_NMI:
case SVM_EXIT_NPF:
+ case SVM_EXIT_EXCP_BASE + MC_VECTOR:
return NESTED_EXIT_HOST;
- case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: {
+ case SVM_EXIT_EXCP_BASE + DB_VECTOR:
+ case SVM_EXIT_EXCP_BASE + BP_VECTOR: {
+ /* KVM gets first crack at #DBs and #BPs, if it wants them. */
u32 excp_bits = 1 << (exit_code - SVM_EXIT_EXCP_BASE);
if (svm->vmcb01.ptr->control.intercepts[INTERCEPT_EXCEPTION] &
excp_bits)
return NESTED_EXIT_HOST;
- else if (exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR &&
- svm->vcpu.arch.apf.host_apf_flags)
- /* Trap async PF even if not shadowing */
- return NESTED_EXIT_HOST;
break;
}
+ case SVM_EXIT_EXCP_BASE + PF_VECTOR:
+ /* Trap async PF even if not shadowing */
+ if (svm->vcpu.arch.apf.host_apf_flags)
+ return NESTED_EXIT_HOST;
+ break;
default:
break;
}
next prev parent reply other threads:[~2021-03-06 1:41 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-26 17:22 [PATCH v2 00/28] KVM: nSVM: event fixes and migration support Paolo Bonzini
2020-05-26 17:22 ` [PATCH 01/28] KVM: x86: track manually whether an event has been injected Paolo Bonzini
2020-05-26 17:22 ` [PATCH 02/28] KVM: x86: enable event window in inject_pending_event Paolo Bonzini
2020-05-29 2:16 ` Krish Sadhukhan
2020-05-29 8:47 ` Paolo Bonzini
2020-05-26 17:22 ` [PATCH 03/28] KVM: nSVM: inject exceptions via svm_check_nested_events Paolo Bonzini
2021-03-06 1:39 ` Sean Christopherson [this message]
2021-03-06 9:26 ` Paolo Bonzini
2021-03-08 16:44 ` Sean Christopherson
2021-03-08 17:28 ` Paolo Bonzini
2021-03-08 20:43 ` Sean Christopherson
2021-03-08 22:51 ` Paolo Bonzini
2020-05-26 17:22 ` [PATCH 04/28] KVM: nSVM: remove exit_required Paolo Bonzini
2020-05-26 17:22 ` [PATCH 05/28] KVM: nSVM: correctly inject INIT vmexits Paolo Bonzini
2020-05-29 6:46 ` Krish Sadhukhan
2020-05-29 8:47 ` Paolo Bonzini
2020-05-26 17:22 ` [PATCH 06/28] KVM: SVM: always update CR3 in VMCB Paolo Bonzini
2020-05-26 17:22 ` [PATCH 07/28] KVM: nVMX: always update CR3 in VMCS Paolo Bonzini
2020-05-26 17:22 ` [PATCH 08/28] KVM: nSVM: move map argument out of enter_svm_guest_mode Paolo Bonzini
2020-05-26 17:22 ` [PATCH 09/28] KVM: nSVM: extract load_nested_vmcb_control Paolo Bonzini
2020-05-26 17:22 ` [PATCH 10/28] KVM: nSVM: extract preparation of VMCB for nested run Paolo Bonzini
2020-05-26 17:22 ` [PATCH 11/28] KVM: nSVM: move MMU setup to nested_prepare_vmcb_control Paolo Bonzini
2020-05-26 17:22 ` [PATCH 12/28] KVM: nSVM: clean up tsc_offset update Paolo Bonzini
2020-05-26 17:22 ` [PATCH 13/28] KVM: nSVM: pass vmcb_control_area to copy_vmcb_control_area Paolo Bonzini
2020-05-26 17:22 ` [PATCH 14/28] KVM: nSVM: remove trailing padding for struct vmcb_control_area Paolo Bonzini
2020-05-26 17:22 ` [PATCH 15/28] KVM: nSVM: save all control fields in svm->nested Paolo Bonzini
2020-05-26 17:22 ` [PATCH 16/28] KVM: nSVM: restore clobbered INT_CTL fields after clearing VINTR Paolo Bonzini
2020-05-26 17:22 ` [PATCH 17/28] KVM: nSVM: synchronize VMCB controls updated by the processor on every vmexit Paolo Bonzini
2020-05-26 17:22 ` [PATCH 18/28] KVM: nSVM: remove unnecessary if Paolo Bonzini
2020-05-26 17:22 ` [PATCH 19/28] KVM: nSVM: extract svm_set_gif Paolo Bonzini
2020-05-26 17:23 ` [PATCH 20/28] KVM: SVM: preserve VGIF across VMCB switch Paolo Bonzini
2020-05-26 17:23 ` [PATCH 21/28] KVM: nSVM: synthesize correct EXITINTINFO on vmexit Paolo Bonzini
2020-05-26 17:23 ` [PATCH 22/28] KVM: nSVM: remove HF_VINTR_MASK Paolo Bonzini
2020-05-26 17:23 ` [PATCH 23/28] KVM: nSVM: remove HF_HIF_MASK Paolo Bonzini
2020-05-26 17:23 ` [PATCH 24/28] KVM: nSVM: split nested_vmcb_check_controls Paolo Bonzini
2020-05-26 17:23 ` [PATCH 25/28] KVM: nSVM: leave guest mode when clearing EFER.SVME Paolo Bonzini
2020-05-26 17:23 ` [PATCH 26/28] KVM: MMU: pass arbitrary CR0/CR4/EFER to kvm_init_shadow_mmu Paolo Bonzini
2020-05-26 17:23 ` [PATCH 27/28] selftests: kvm: add a SVM version of state-test Paolo Bonzini
2020-05-26 17:23 ` [PATCH 28/28] KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YELdblXaKBTQ4LGf@google.com \
--to=seanjc@google.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mlevitsk@redhat.com \
--cc=pbonzini@redhat.com \
--cc=vkuznets@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).