[PATCH/RFC] KVM: s390: vsie: Avoid injecting machine check on signal

[PATCH/RFC] KVM: s390: vsie: Avoid injecting machine check on signal

[Christian Borntraeger]

The recent XFER_TO_GUEST_WORK change resulted in a situation, where the
vsie code would interpret a signal during work as a machine check during
SIE as both use the EINTR return code.

Fixes: 2bd1337a1295e ("KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions")
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
---
 arch/s390/kvm/vsie.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index c0d36afd4023..8e71393bb3d2 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1121,10 +1121,11 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page, struc
 	__acquires(vcpu->kvm->srcu)
 {
 	struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
 	struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
 	int guest_bp_isolation;
+	int skipped = 1;
 	int rc = 0;
 
 	handle_last_fault(vcpu, vsie_page, sg);
 
 	kvm_vcpu_srcu_read_unlock(vcpu);
@@ -1162,10 +1163,11 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page, struc
 				goto skip_sie;
 			goto xfer_to_guest_mode_check;
 		}
 		guest_timing_enter_irqoff();
 		rc = kvm_s390_enter_exit_sie(scb_s, vcpu->run->s.regs.gprs, sg->asce.val);
+		skipped = 0;
 		guest_timing_exit_irqoff();
 		local_irq_enable();
 	}
 
 skip_sie:
@@ -1176,11 +1178,11 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page, struc
 	if (!guest_bp_isolation)
 		clear_thread_flag(TIF_ISOLATE_BP_GUEST);
 
 	kvm_vcpu_srcu_read_lock(vcpu);
 
-	if (rc == -EINTR) {
+	if (!skipped && rc == -EINTR) {
 		kvm_s390_reinject_machine_check(vcpu, &vsie_page->mcck_info);
 		return 0;
 	}
 
 	if (rc > 0)
-- 
2.53.0

Re: [PATCH/RFC] KVM: s390: vsie: Avoid injecting machine check on signal

[Heiko Carstens]

On Mon, Mar 16, 2026 at 11:39:34AM +0100, Christian Borntraeger wrote:
> The recent XFER_TO_GUEST_WORK change resulted in a situation, where the
> vsie code would interpret a signal during work as a machine check during
> SIE as both use the EINTR return code.
> 
> Fixes: 2bd1337a1295e ("KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions")
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  arch/s390/kvm/vsie.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

...

> -	if (rc == -EINTR) {
> +	if (!skipped && rc == -EINTR) {
>  		kvm_s390_reinject_machine_check(vcpu, &vsie_page->mcck_info);
>  		return 0;

As far as I can tell __SF_SIE_REASON is only used for passing -EINTR in case
of a machine check, otherwise it is unused (== zero)?

So the KVM_EXIT* codes don't work instead of -EINTR, since those are uapi, and
there is nothing that would match a machine check anyway. However I would
still propose to pass some unique positive number back via the stackframe
instead of some random negative error number which means nothing.

That is: change the machine check handler to pass e.g.

#define KVM_S390_SIE_EXIT_MCCK 1

		*((long *)(regs->gprs[15] + __SF_SIE_REASON)) = KVM_S390_SIE_EXIT_MCCK;

Which would make it much more obvious what happens, and which would also avoid
such strange bugs.

Just my 0.02.

Re: [PATCH/RFC] KVM: s390: vsie: Avoid injecting machine check on signal

[Christian Borntraeger]

Am 16.03.26 um 12:56 schrieb Heiko Carstens:
> On Mon, Mar 16, 2026 at 11:39:34AM +0100, Christian Borntraeger wrote:
>> The recent XFER_TO_GUEST_WORK change resulted in a situation, where the
>> vsie code would interpret a signal during work as a machine check during
>> SIE as both use the EINTR return code.
>>
>> Fixes: 2bd1337a1295e ("KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions")
>> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
>> ---
>>   arch/s390/kvm/vsie.c | 4 +++-
>>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> ...
> 
>> -	if (rc == -EINTR) {
>> +	if (!skipped && rc == -EINTR) {
>>   		kvm_s390_reinject_machine_check(vcpu, &vsie_page->mcck_info);
>>   		return 0;
> 
> As far as I can tell __SF_SIE_REASON is only used for passing -EINTR in case
> of a machine check, otherwise it is unused (== zero)?
> 
> So the KVM_EXIT* codes don't work instead of -EINTR, since those are uapi, and
> there is nothing that would match a machine check anyway. However I would
> still propose to pass some unique positive number back via the stackframe
> instead of some random negative error number which means nothing.
> 
> That is: change the machine check handler to pass e.g.
> 
> #define KVM_S390_SIE_EXIT_MCCK 1
> 
> 		*((long *)(regs->gprs[15] + __SF_SIE_REASON)) = KVM_S390_SIE_EXIT_MCCK;
> 
> Which would make it much more obvious what happens, and which would also avoid
> such strange bugs.

Yes, this was just a minimal "try to fix and get feedback" and thus an RFC. Will have
a look on your proposal.

Re: [PATCH/RFC] KVM: s390: vsie: Avoid injecting machine check on signal

[Christian Borntraeger]

Am 16.03.26 um 12:56 schrieb Heiko Carstens:
> On Mon, Mar 16, 2026 at 11:39:34AM +0100, Christian Borntraeger wrote:
>> The recent XFER_TO_GUEST_WORK change resulted in a situation, where the
>> vsie code would interpret a signal during work as a machine check during
>> SIE as both use the EINTR return code.
>>
>> Fixes: 2bd1337a1295e ("KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions")
>> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
>> ---
>>   arch/s390/kvm/vsie.c | 4 +++-
>>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> ...
> 
>> -	if (rc == -EINTR) {
>> +	if (!skipped && rc == -EINTR) {
>>   		kvm_s390_reinject_machine_check(vcpu, &vsie_page->mcck_info);
>>   		return 0;
> 
> As far as I can tell __SF_SIE_REASON is only used for passing -EINTR in case
> of a machine check, otherwise it is unused (== zero)?
> 
> So the KVM_EXIT* codes don't work instead of -EINTR, since those are uapi, and
> there is nothing that would match a machine check anyway. However I would
> still propose to pass some unique positive number back via the stackframe
> instead of some random negative error number which means nothing.
> 
> That is: change the machine check handler to pass e.g.
> 
> #define KVM_S390_SIE_EXIT_MCCK 1
> 
> 		*((long *)(regs->gprs[15] + __SF_SIE_REASON)) = KVM_S390_SIE_EXIT_MCCK;
> 
> Which would make it much more obvious what happens, and which would also avoid
> such strange bugs.

Hnmm just send this, but I realized that the problem is in fact that the vsie code
has

                         local_irq_enable();
--->                    rc = kvm_xfer_to_guest_mode_handle_work(vcpu);
                         if (rc)
                                 goto skip_sie;
                         goto xfer_to_guest_mode_check;
                 }
                 guest_timing_enter_irqoff();
--->            rc = kvm_s390_enter_exit_sie(scb_s, vcpu->run->s.regs.gprs, sg->asce.val);
                 guest_timing_exit_irqoff();


So we also need to look at potential returns from kvm_xfer_to_guest_mode_handle_work or
actually do the split here in this function to not overload rc.