[Devel] [PATCH hci-8.1 v6 0/5] x86/ve: CPUID override follow-ups: arm at once, prefixes, selftests

[Konstantin Khorenko <khorenko@virtuozzo.com>]

VSTOR-148656, every Container start dying with SIGSEGV once
/proc/vz/cpuid_override is non-empty, is fixed in 22.8 by 07338fbae5a3
("x86/traps: emulate CPUID faults for user tasks in
exc_general_protection()"). Working on it turned up two more defects in
the same feature, and the fact that nothing had ever exercised it. This
series takes care of those. None of them is a 22.x regression, all have
been there since the vz9 port.

Patch 2: ve_setup_task() only sets TIF_CPUID_OVERRIDE, the MSR follows
at the next context switch. A task entering a VE through unshare() or
setns() executes CPUID natively until it is scheduled out and sees the
host values. set_cpuid_override() flips the MSR synchronously for the
current task, the way disable_cpuid() does.

Patch 4: check_cpuid_fault() compares two bytes at ip with 0f a2. A
CPUID with a legacy or REX prefix faults the same way, but the handler
sees the prefix and the task gets SIGSEGV. Use the instruction decoder,
as fixup_umip_exception() does, and advance ip by the decoded length.

Patches 1, 3, 5: selftests/ve/ve_cpuid_override_test. Each kernel patch
gets its own case. The test saves and restores the table around every
case and tears down in the parent, because the kselftest harness skips
a child-side teardown after a failed ASSERT.

Tested on sqvm2-4060, the node of the failing CI run (Broadwell VM with
cpuid_fault, cpupools-features 9.1.7, so the table is armed at every
Container start). With only the 22.8 fix, cases 3 and 4 fail the way
their patches describe: host values, and a child killed by signal 11.
With the whole series all four cases pass, repeatedly and on a
non-empty table, and the vzctl-pytest start cases from the original
ticket pass as well.

https://virtuozzo.atlassian.net/browse/VSTOR-148843

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
Changes in v6:
- Patch 1, 5: build the test for x86-64 only, decided by the compiler
  target in the Makefile since ARCH says "x86" for 32-bit as well; the
  prefixed CPUID goes back to a plain "=b" asm, the 32-bit xchg around
  ebx of v5 truncated the callee-saved rbx on x86-64 (Sashiko).
- Patch 1: say in the comment and the message that the context switch
  the parent waits for need not be the stop itself: any switch after
  the count was taken arms faulting on the way back in (Sashiko).
- Link to v5: http://lore.virtuozzo.com/20261007-b4-prep-khorenko-vstor-148656-cpuid-v5-0-652c5c9e56da@virtuozzo.com

Changes in v5:
- Patch 1: the stop is reported to the parent before the child leaves
  the CPU, so the child hands over its voluntary context switch count
  and the parent waits for it to grow before SIGCONT; a SIGCONT in that
  window would have let the child run on without a switch (Sashiko).
- Patch 1, 5: CPUID through __cpuid_count() and an xchg around ebx for
  the prefixed form, so the 32-bit PIC build is no concern and the
  Makefile gate can keep ARCH=x86 (Sashiko).
- Patch 1: a failed table restore in the teardown fails the test
  instead of only logging; skip without root; log when the teardown
  cannot mount cgroup2; wider buffer for /proc/<pid>/status; the
  header says one instance at a time (independent review).
- Patch 5: early-clobber on the ebx substitute register in the
  prefixed CPUID asm, as <cpuid.h> has it (independent review).
- Link to v4: http://lore.virtuozzo.com/20261007-b4-prep-khorenko-vstor-148656-cpuid-v4-0-bf16c29bea24@virtuozzo.com

Changes in v4:
- Patch 1: a child that exits before stopping is reaped by the ready
  wait, so its pid is cleared there and the teardown cannot kill a
  reused pid (Sashiko).
- Patch 1: spawn leaves the VE cgroup before any ASSERT can fire, so a
  failed fork() no longer leaves the cgroup behind; a child killed
  before it stops is logged; the teardown is described as running in
  whichever process survives the ASSERT, the harness does not run it
  in the parent on that path (independent review).
- Patch 1: use write_file_at() instead of a private copy, renumber the
  child exit codes, say "at least" in the too-large table message.
- Patch 1: record the child pid right after fork(), so a child left
  stopped by an ASSERT between fork() and the cgroup move is still
  killed; say that a harness timeout leaves the test table in place
  and that the second case proves nothing without the first
  (independent review).
- Patch 1: name the fix the tests detect, describe the host-side and
  fallback checks as the one masked bit they are, log errno when the
  table read or the cgroup2 mount fails, rename the two table buffers
  apart, -Wextra clean (independent review).
- Link to v3: http://lore.virtuozzo.com/20261006-b4-prep-khorenko-vstor-148656-cpuid-v3-0-16141b8ca07d@virtuozzo.com

Changes in v3:
- Patch 1: a saved table the kernel cannot take back in one write (a
  page or more as printed) fails the setup instead of being silently
  left behind by a failed restore; writes replace the table, so there
  is no way to restore it in pieces (Sashiko).
- Patch 1: the child pid lives in the fixture and the parent-side
  teardown kills a child that a failed ASSERT left stopped in the VE
  cgroup, otherwise destroy_ve() fails with EBUSY (Sashiko).
- Patch 1: the Makefile keeps ARCH untouched and decides on a private
  variable, lib.mk picks the clang target by ARCH being empty (Sashiko).
- Link to v2: http://lore.virtuozzo.com/20261006-b4-prep-khorenko-vstor-148656-cpuid-v2-0-f6d1192c7d60@virtuozzo.com

Changes in v2:
- Patch 1: the child stops itself with SIGSTOP after entering the VE
  and the parent resumes it, so faulting is armed by a real context
  switch; the pipe handshake, whose read could return without sleeping,
  is gone (Sashiko).
- Patch 1: setup creates the VE cgroup last, so a failed ASSERT in
  setup leaves nothing behind; a failed restore in teardown is logged
  (Sashiko).
- Patch 1: drop the EAX comparison after the fallback to hardware, the
  child is not pinned and hybrid CPUs may differ per core (Sashiko).
- Patch 1: build the test on x86 only, add the binary to .gitignore
  (Sashiko).
- Patch 3: the no-reschedule case repeats the sequence, a tick can
  still preempt the child in the window; with the handshake gone a
  child that dies before reporting is reaped where the result is read
  and its signal logged (Sashiko).
- Retested on sqvm2-2084 with the whole series: all cases pass and the
  table is restored; on sqvm2-4060 with the stock kernel all cases fail
  with the expected diagnostics.
- Link to v1: http://lore.virtuozzo.com/20261006-b4-prep-khorenko-vstor-148656-cpuid-v1-0-741609f4f03a@virtuozzo.com

---
Konstantin Khorenko (5):
      selftests/ve: check CPUID override emulation for VE tasks
      x86/ve: enable CPUID faulting at once when the current task enters a VE
      selftests/ve: check CPUID override right after entering a VE
      x86/traps: decode the faulting CPUID with the instruction decoder
      selftests/ve: check CPUID override emulation for a prefixed CPUID

 arch/x86/kernel/process.c                          |  12 +
 arch/x86/kernel/traps.c                            |  16 +-
 include/linux/cpuid_override.h                     |   3 +
 kernel/ve/ve.c                                     |   2 +-
 tools/testing/selftests/ve/.gitignore              |   1 +
 tools/testing/selftests/ve/Makefile                |   6 +
 .../testing/selftests/ve/ve_cpuid_override_test.c  | 357 +++++++++++++++++++++
 7 files changed, 390 insertions(+), 7 deletions(-)
---
base-commit: f5d1fdcfffe101fe2bafa7df09d95d2e811c5c5e
change-id: 20261006-b4-prep-khorenko-vstor-148656-cpuid-a5c5993e1f83

Best regards,
--  
Konstantin Khorenko <khorenko@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel