[PATCH 0/2] KVM: x86: avoid using stale x86_emulate_ctxt->intercept value

[PATCH 0/2] KVM: x86: avoid using stale x86_emulate_ctxt->intercept value

[Vitaly Kuznetsov]

After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
mode") Hyper-V guests on KVM stopped booting and tracing shows that we're
trying to emulate an instruction which shouldn't be intercepted. Turns out,
x86_emulate_ctxt may hold a stale 'intercept' value.

This is a regression in 5.6-rc4 and I'm marking PATCH1 for stable@. The
commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
is, however, correct, it just seems to reveal a pre-existing condition.

Vitaly Kuznetsov (2):
  KVM: x86: clear stale x86_emulate_ctxt->intercept value
  KVM: x86: remove stale comment from struct x86_emulate_ctxt

 arch/x86/include/asm/kvm_emulate.h | 1 -
 arch/x86/kvm/emulate.c             | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

-- 
2.24.1

[PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value

[Vitaly Kuznetsov]

Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
init_decode_cache") reduced the number of fields cleared by
init_decode_cache() claiming that they are being cleared elsewhere,
'intercept', however, seems to be left uncleared in some cases.

The issue I'm observing manifests itself as following:
after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
mode") Hyper-V guests on KVM stopped booting with:

 kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
    info2 0 int_info 0 int_info_err 0
 kvm_page_fault:       address febd0000 error_code 181
 kvm_emulate_insn:     0:fffff802987d6169: f3 a5
 kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
 kvm_inj_exception:    #UD (0x0)

Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache")
Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
Cc: stable@vger.kernel.org
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 arch/x86/kvm/emulate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index dd19fb3539e0..bc00642e5d3b 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -5173,6 +5173,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
 	ctxt->fetch.ptr = ctxt->fetch.data;
 	ctxt->fetch.end = ctxt->fetch.data + insn_len;
 	ctxt->opcode_len = 1;
+	ctxt->intercept = x86_intercept_none;
 	if (insn_len > 0)
 		memcpy(ctxt->fetch.data, insn, insn_len);
 	else {
-- 
2.24.1

[PATCH 2/2] KVM: x86: remove stale comment from struct x86_emulate_ctxt

[Vitaly Kuznetsov]

Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
init_decode_cache") did some field shuffling and instead of
[opcode_len, _regs) started clearing [has_seg_override, modrm).
The comment about clearing fields altogether is not true anymore.

Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 arch/x86/include/asm/kvm_emulate.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index 2a8f2bd2e5cf..c06e8353efd3 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -360,7 +360,6 @@ struct x86_emulate_ctxt {
 	u64 d;
 	unsigned long _eip;
 	struct operand memop;
-	/* Fields above regs are cleared together. */
 	unsigned long _regs[NR_VCPU_REGS];
 	struct operand *memopp;
 	struct fetch_cache fetch;
-- 
2.24.1

Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value

[Sean Christopherson]

On Tue, Mar 03, 2020 at 03:33:15PM +0100, Vitaly Kuznetsov wrote:
> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, seems to be left uncleared in some cases.
> 
> The issue I'm observing manifests itself as following:
> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
> 
>  kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
>     info2 0 int_info 0 int_info_err 0
>  kvm_page_fault:       address febd0000 error_code 181
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
>  kvm_inj_exception:    #UD (0x0)
> 
> Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache")
> Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
> Cc: stable@vger.kernel.org
> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
> ---

Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>

Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value

[Paolo Bonzini]

On 03/03/20 15:33, Vitaly Kuznetsov wrote:
> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, seems to be left uncleared in some cases.
> 
> The issue I'm observing manifests itself as following:
> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
> 
>  kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
>     info2 0 int_info 0 int_info_err 0
>  kvm_page_fault:       address febd0000 error_code 181
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
>  kvm_inj_exception:    #UD (0x0)

Slightly rephrased:

After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
mode") Hyper-V guests on KVM stopped booting with:

 kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
    info2 0 int_info 0 int_info_err 0
 kvm_page_fault:       address febd0000 error_code 181
 kvm_emulate_insn:     0:fffff802987d6169: f3 a5
 kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
 kvm_inj_exception:    #UD (0x0)

"f3 a5" is a "rep movsw" instruction, which should not be intercepted
at all.  Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
init_decode_cache") reduced the number of fields cleared by
init_decode_cache() claiming that they are being cleared elsewhere,
'intercept', however, is left uncleared if the instruction does not have
any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
NearBranch, No16 and of course Intercept itself).

Paolo

Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value

[Vitaly Kuznetsov]

Paolo Bonzini <pbonzini@redhat.com> writes:

> On 03/03/20 15:33, Vitaly Kuznetsov wrote:
>> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
>> init_decode_cache") reduced the number of fields cleared by
>> init_decode_cache() claiming that they are being cleared elsewhere,
>> 'intercept', however, seems to be left uncleared in some cases.
>> 
>> The issue I'm observing manifests itself as following:
>> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
>> mode") Hyper-V guests on KVM stopped booting with:
>> 
>>  kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
>>     info2 0 int_info 0 int_info_err 0
>>  kvm_page_fault:       address febd0000 error_code 181
>>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5
>>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
>>  kvm_inj_exception:    #UD (0x0)
>
> Slightly rephrased:
>
> After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
>
>  kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
>     info2 0 int_info 0 int_info_err 0
>  kvm_page_fault:       address febd0000 error_code 181
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
>  kvm_inj_exception:    #UD (0x0)
>
> "f3 a5" is a "rep movsw" instruction, which should not be intercepted
> at all.  Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, is left uncleared if the instruction does not have
> any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
> NearBranch, No16 and of course Intercept itself).

Much better, thanks) Please let me know if you want me to resubmit.

-- 
Vitaly

Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value

[Paolo Bonzini]

On 03/03/20 17:35, Vitaly Kuznetsov wrote:
>>
>> "f3 a5" is a "rep movsw" instruction, which should not be intercepted
>> at all.  Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
>> init_decode_cache") reduced the number of fields cleared by
>> init_decode_cache() claiming that they are being cleared elsewhere,
>> 'intercept', however, is left uncleared if the instruction does not have
>> any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
>> NearBranch, No16 and of course Intercept itself).
> Much better, thanks) Please let me know if you want me to resubmit.

No need, thanks.

Paolo