From: Maxim Levitsky <mlevitsk@redhat.com>
To: Sean Christopherson <seanjc@google.com>,
Paolo Bonzini <pbonzini@redhat.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
"Maciej S . Szmigiero" <maciej.szmigiero@oracle.com>
Subject: Re: [PATCH 3/8] KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails"
Date: Mon, 04 Apr 2022 13:03:21 +0300 [thread overview]
Message-ID: <2b26dd9569a0ae7a3d1fe1eab08010324d77e245.camel@redhat.com> (raw)
In-Reply-To: <20220402010903.727604-4-seanjc@google.com>
On Sat, 2022-04-02 at 01:08 +0000, Sean Christopherson wrote:
> Unwind the RIP advancement done by svm_queue_exception() when injecting
> an INT3 ultimately "fails" due to the CPU encountering a VM-Exit while
> vectoring the injected event, even if the exception reported by the CPU
> isn't the same event that was injected. If vectoring INT3 encounters an
> exception, e.g. #NP, and vectoring the #NP encounters an intercepted
> exception, e.g. #PF when KVM is using shadow paging, then the #NP will
> be reported as the event that was in-progress.
>
> Note, this is still imperfect, as it will get a false positive if the
> INT3 is cleanly injected, no VM-Exit occurs before the IRET from the INT3
> handler in the guest, the instruction following the INT3 generates an
> exception (directly or indirectly), _and_ vectoring that exception
> encounters an exception that is intercepted by KVM. The false positives
> could theoretically be solved by further analyzing the vectoring event,
> e.g. by comparing the error code against the expected error code were an
> exception to occur when vectoring the original injected exception, but
> SVM without NRIPS is a complete disaster, trying to make it 100% correct
> is a waste of time.
Makes sense.
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Best regards,
Maxim Levitsky
>
> Fixes: 66b7138f9136 ("KVM: SVM: Emulate nRIP feature when reinjecting INT3")
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
> arch/x86/kvm/svm/svm.c | 20 ++++++++++++++------
> 1 file changed, 14 insertions(+), 6 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 2c86bd9176c6..30cef3b10838 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -3699,6 +3699,18 @@ static void svm_complete_interrupts(struct kvm_vcpu *vcpu)
> vector = exitintinfo & SVM_EXITINTINFO_VEC_MASK;
> type = exitintinfo & SVM_EXITINTINFO_TYPE_MASK;
>
> + /*
> + * If NextRIP isn't enabled, KVM must manually advance RIP prior to
> + * injecting the soft exception/interrupt. That advancement needs to
> + * be unwound if vectoring didn't complete. Note, the _new_ event may
> + * not be the injected event, e.g. if KVM injected an INTn, the INTn
> + * hit a #NP in the guest, and the #NP encountered a #PF, the #NP will
> + * be the reported vectored event, but RIP still needs to be unwound.
> + */
> + if (int3_injected && type == SVM_EXITINTINFO_TYPE_EXEPT &&
> + kvm_is_linear_rip(vcpu, svm->int3_rip))
> + kvm_rip_write(vcpu, kvm_rip_read(vcpu) - int3_injected);
> +
> switch (type) {
> case SVM_EXITINTINFO_TYPE_NMI:
> vcpu->arch.nmi_injected = true;
> @@ -3715,13 +3727,9 @@ static void svm_complete_interrupts(struct kvm_vcpu *vcpu)
> * but re-execute the instruction instead. Rewind RIP first
> * if we emulated INT3 before.
> */
> - if (kvm_exception_is_soft(vector)) {
> - if (vector == BP_VECTOR && int3_injected &&
> - kvm_is_linear_rip(vcpu, svm->int3_rip))
> - kvm_rip_write(vcpu,
> - kvm_rip_read(vcpu) - int3_injected);
> + if (kvm_exception_is_soft(vector))
> break;
> - }
> +
> if (exitintinfo & SVM_EXITINTINFO_VALID_ERR) {
> u32 err = svm->vmcb->control.exit_int_info_err;
> kvm_requeue_exception_e(vcpu, vector, err);
next prev parent reply other threads:[~2022-04-04 10:03 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-02 1:08 [PATCH 0/8] KVM: SVM: Fix soft int/ex re-injection Sean Christopherson
2022-04-02 1:08 ` [PATCH 1/8] KVM: nSVM: Sync next_rip field from vmcb12 to vmcb02 Sean Christopherson
2022-04-04 9:54 ` Maxim Levitsky
2022-04-04 16:50 ` Maciej S. Szmigiero
2022-04-04 17:21 ` Sean Christopherson
2022-04-04 17:45 ` Maciej S. Szmigiero
2022-04-20 15:00 ` Paolo Bonzini
2022-04-20 15:05 ` Maciej S. Szmigiero
2022-04-20 16:15 ` Sean Christopherson
2022-04-20 16:33 ` Paolo Bonzini
2022-04-20 16:44 ` Sean Christopherson
2022-04-02 1:08 ` [PATCH 2/8] KVM: SVM: Downgrade BUG_ON() to WARN_ON() in svm_inject_irq() Sean Christopherson
2022-04-02 1:08 ` [PATCH 3/8] KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails" Sean Christopherson
2022-04-04 10:03 ` Maxim Levitsky [this message]
2022-04-20 15:01 ` Paolo Bonzini
2022-04-02 1:08 ` [PATCH 4/8] KVM: SVM: Stuff next_rip on emualted INT3 injection if NRIPS is supported Sean Christopherson
2022-04-04 12:00 ` Maxim Levitsky
2022-04-02 1:09 ` [PATCH 5/8] KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction Sean Christopherson
2022-04-04 12:12 ` Maxim Levitsky
2022-04-04 16:49 ` Sean Christopherson
2022-04-04 16:53 ` Maciej S. Szmigiero
2022-04-04 19:33 ` Sean Christopherson
2022-04-04 19:50 ` Maciej S. Szmigiero
2022-04-04 19:54 ` Sean Christopherson
2022-04-04 20:46 ` Maciej S. Szmigiero
2022-04-04 20:44 ` Maciej S. Szmigiero
2022-04-06 1:48 ` Sean Christopherson
2022-04-06 13:13 ` Maciej S. Szmigiero
2022-04-06 17:10 ` Sean Christopherson
2022-04-06 19:08 ` Maciej S. Szmigiero
2022-04-06 19:48 ` Sean Christopherson
2022-04-06 20:30 ` Maciej S. Szmigiero
2022-04-06 20:52 ` Sean Christopherson
2022-04-06 22:34 ` Maciej S. Szmigiero
2022-04-06 23:03 ` Sean Christopherson
2022-04-07 15:32 ` Maciej S. Szmigiero
2022-04-02 1:09 ` [PATCH 6/8] KVM: SVM: Re-inject INTn instead of retrying the insn on "failure" Sean Christopherson
2022-04-04 17:14 ` Sean Christopherson
2022-04-04 20:27 ` Maciej S. Szmigiero
2022-04-02 1:09 ` [PATCH 7/8] KVM: x86: Trace re-injected exceptions Sean Christopherson
2022-04-04 12:14 ` Maxim Levitsky
2022-04-04 16:14 ` Sean Christopherson
2022-04-02 1:09 ` [PATCH 8/8] KVM: selftests: nSVM: Add svm_nested_soft_inject_test Sean Christopherson
2022-04-04 12:27 ` Maxim Levitsky
2022-04-04 16:59 ` Maciej S. Szmigiero
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2b26dd9569a0ae7a3d1fe1eab08010324d77e245.camel@redhat.com \
--to=mlevitsk@redhat.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maciej.szmigiero@oracle.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).