kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Singh, Brijesh" <brijesh.singh@amd.com>
To: Liran Alon <liran.alon@oracle.com>, Paolo Bonzini <pbonzini@redhat.com>
Cc: "Singh, Brijesh" <brijesh.singh@amd.com>,
	Sean Christopherson <sean.j.christopherson@intel.com>,
	"rkrcmar@redhat.com" <rkrcmar@redhat.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>
Subject: Re: [PATCH 1/2] KVM: SVM: Fix workaround for AMD Errata 1096
Date: Tue, 16 Jul 2019 19:28:53 +0000	[thread overview]
Message-ID: <015b03bc-8518-2066-c916-f5e12dd2d506@amd.com> (raw)
In-Reply-To: <DD44D29C-36C4-42E7-905E-7300F92F3BE6@oracle.com>



On 7/16/19 12:35 PM, Liran Alon wrote:
> 
> 
>> On 16 Jul 2019, at 20:27, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>
>> On 16/07/19 18:56, Liran Alon wrote:
>>> If the CPU performs the VMExit transition of state before doing the data read for DecodeAssist,
>>> then I agree that CPL will be 0 on data-access regardless of vCPU CPL. But this also means that SMAP
>>> violation should be raised based on host CR4.SMAP value and not vCPU CR4.SMAP value as KVM code checks.
>>>
>>> Furthermore, vCPU CPL of guest doesn’t need to be 3 in order to trigger this Errata.
>>
>> Under the conditions in the code, if CPL were <3 then the SMAP fault
>> would have been sent to the guest.
>> But I agree that if we need to
>> change it to check host CR4, then the CPL of the guest should not be
>> checked.
> 
> Yep.
> Well it all depends on how AMD CPU actually works.
> We need some clarification from AMD but for sure the current code in KVM is not only wrong, but probably have never been tested. :P
> 
> Looking for further clarifications from AMD before submitting v2…
> 

When this errata is hit, the CPU will be at CPL3. From hardware
point-of-view the below sequence happens:

1. CPL3 guest hits reserved bit NPT fault (MMIO access)

2. Microcode uses special opcode which attempts to read data using the
CPL0 privileges. The microcode read CS:RIP, when it hits SMAP fault,
it gives up and returns no instruction bytes.

(Note: vCPU is still at CPL3)

3. CPU causes #VMEXIT for original fault address.

The SMAP fault occurred while we are still in guest context. It will be
nice to have code test example to triggers this errata.

> -Liran
> 
>>
>> Paolo
>>
>>> It’s only important that guest page-tables maps the guest RIP as user-accessible. i.e. U/S bit in PTE set to 1.
>>
> 

  reply	other threads:[~2019-07-16 19:29 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-15 20:30 KVM: SVM: Fix workaround for AMD Errata 1096 Liran Alon
2019-07-15 20:30 ` [PATCH 1/2] " Liran Alon
2019-07-16 15:48   ` Singh, Brijesh
2019-07-16 15:56     ` Liran Alon
2019-07-16 16:07       ` Liran Alon
2019-07-16 16:10       ` Singh, Brijesh
2019-07-16 16:20         ` Liran Alon
2019-07-16 16:41           ` Sean Christopherson
2019-07-16 16:56             ` Liran Alon
2019-07-16 17:27               ` Sean Christopherson
2019-07-16 17:27               ` Paolo Bonzini
2019-07-16 17:35                 ` Liran Alon
2019-07-16 19:28                   ` Singh, Brijesh [this message]
2019-07-16 19:34                     ` Liran Alon
2019-07-16 19:39                       ` Paolo Bonzini
2019-07-16 19:45                         ` Sean Christopherson
2019-07-16 19:50                           ` Liran Alon
2019-07-16 19:47                         ` Liran Alon
2019-07-16 19:41                       ` Sean Christopherson
2019-07-16 19:52                         ` Liran Alon
2019-07-16 20:02                       ` Singh, Brijesh
2019-07-16 20:07                         ` Sean Christopherson
2019-07-16 20:13                           ` Paolo Bonzini
2019-07-16 20:09                         ` Liran Alon
2019-07-16 20:27                           ` Singh, Brijesh
2019-07-16 20:54                             ` Sean Christopherson
2019-07-16 21:53                               ` Liran Alon
2019-07-16 18:05           ` Singh, Brijesh
2019-07-16 18:06             ` Singh, Brijesh
2019-07-15 20:30 ` [PATCH 2/2] KVM: x86: Rename need_emulation_on_page_fault() to handle_no_insn_on_page_fault() Liran Alon
2019-07-16 15:48   ` Sean Christopherson
2019-07-16 16:01     ` Liran Alon
2019-07-16 16:10       ` Sean Christopherson
2019-07-16 19:33         ` Singh, Brijesh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=015b03bc-8518-2066-c916-f5e12dd2d506@amd.com \
    --to=brijesh.singh@amd.com \
    --cc=boris.ostrovsky@oracle.com \
    --cc=kvm@vger.kernel.org \
    --cc=liran.alon@oracle.com \
    --cc=pbonzini@redhat.com \
    --cc=rkrcmar@redhat.com \
    --cc=sean.j.christopherson@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).