On Tue, Apr 14, 2020 at 05:20:44PM -0700, Sean Christopherson wrote:
> On Tue, Apr 14, 2020 at 05:12:12PM -0700, Sean Christopherson wrote:
> > On Tue, Apr 14, 2020 at 09:47:53AM -0700, Jim Mattson wrote:
> > > Regarding -EBUSY, I'm in complete agreement. However, I'm not sure
> > > what the potential confusion is regarding the event. Are you
> > > suggesting that one might think that we have a #DB to deliver to L1
> > > while we're in guest mode? IIRC, that can happen under SVM, but I
> > > don't believe it can happen under VMX.
> >
> > The potential confusion is that vcpu->arch.exception.pending was already
> > checked, twice. It makes one wonder why it needs to be checked a third
> > time. And actually, I think that's probably a good indicator that singling
> > out single-step #DB isn't the correct fix, it just happens to be the only
> > case that's been encountered thus far, e.g. a #PF when fetching the instr
> > for emulation should also get priority over the preemption timer. On real
> > hardware, expiration of the preemption timer while vectoring a #PF wouldn't
> > wouldn't get recognized until the next instruction boundary, i.e. at the
> > start of the first instruction of the #PF handler. Dropping the #PF isn't
> > a problem in most cases, because unlike the single-step #DB, it will be
> > re-encountered when L1 resumes L2. But, dropping the #PF is still wrong.
> >
> > In general, interception of an event doesn't change the priority of events,
> > e.g. INTR shouldn't get priority over NMI just because if L1 wants to
> > intercept INTR but not NMI.
> >
> > TL;DR: I think the fix should instead be:
> >
> > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > index c868c64770e0..042d7a9037be 100644
> > --- a/arch/x86/kvm/vmx/nested.c
> > +++ b/arch/x86/kvm/vmx/nested.c
> > @@ -3724,9 +3724,10 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
> > /*
> > * Process any exceptions that are not debug traps before MTF.
> > */
> > - if (vcpu->arch.exception.pending &&
> > - !vmx_pending_dbg_trap(vcpu) &&
> > - nested_vmx_check_exception(vcpu, &exit_qual)) {
> > + if (vcpu->arch.exception.pending && !vmx_pending_dbg_trap(vcpu))
*sigh* And a missing '{' here.
> > + if (!nested_vmx_check_exception(vcpu, &exit_qual))
> > + return 0;
> > +
> > if (block_nested_events)
> > return -EBUSY;
> > nested_vmx_inject_exception_vmexit(vcpu, exit_qual);
> > @@ -3741,8 +3742,10 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
> > return 0;
> > }
> >
> > - if (vcpu->arch.exception.pending &&
> > - nested_vmx_check_exception(vcpu, &exit_qual)) {
> > + if (vcpu->arch.exception.pending) {
> > + if (!nested_vmx_check_exception(vcpu, &exit_qual))
> > + return 0;
> > +
> > if (block_nested_events)
> > return -EBUSY;
> > nested_vmx_inject_exception_vmexit(vcpu, exit_qual);
> > @@ -3757,7 +3760,10 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
> > return 0;
> > }
> >
> > - if (vcpu->arch.nmi_pending && nested_exit_on_nmi(vcpu)) {
> > + if (vcpu->arch.nmi_pending) {
> > + if (!nested_exit_on_nmi(vcpu))
> > + return 0;
> > +
> > if (block_nested_events)
> > return -EBUSY;
> > nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
> > @@ -3772,7 +3778,10 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
> > return 0;
> > }
> >
> > - if (kvm_cpu_has_interrupt(vcpu) && nested_exit_on_intr(vcpu)) {
> > + if (kvm_cpu_has_interrupt(vcpu) {
>
> Obviously untested, because this doesn't compile due to a missing ')'.
>
> > + if (!nested_exit_on_intr(vcpu))
> > + return 0;
> > +
> > if (block_nested_events)
> > return -EBUSY;
> > nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT, 0, 0);
> >
