* [PATCH 0/2] KVM: x86: avoid using stale x86_emulate_ctxt->intercept value
@ 2020-03-03 14:33 Vitaly Kuznetsov
2020-03-03 14:33 ` [PATCH 1/2] KVM: x86: clear " Vitaly Kuznetsov
2020-03-03 14:33 ` [PATCH 2/2] KVM: x86: remove stale comment from struct x86_emulate_ctxt Vitaly Kuznetsov
0 siblings, 2 replies; 7+ messages in thread
From: Vitaly Kuznetsov @ 2020-03-03 14:33 UTC (permalink / raw)
To: Paolo Bonzini, kvm
Cc: Jim Mattson, Sean Christopherson, Bandan Das, Oliver Upton, linux-kernel
After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
mode") Hyper-V guests on KVM stopped booting and tracing shows that we're
trying to emulate an instruction which shouldn't be intercepted. Turns out,
x86_emulate_ctxt may hold a stale 'intercept' value.
This is a regression in 5.6-rc4 and I'm marking PATCH1 for stable@. The
commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
is, however, correct, it just seems to reveal a pre-existing condition.
Vitaly Kuznetsov (2):
KVM: x86: clear stale x86_emulate_ctxt->intercept value
KVM: x86: remove stale comment from struct x86_emulate_ctxt
arch/x86/include/asm/kvm_emulate.h | 1 -
arch/x86/kvm/emulate.c | 1 +
2 files changed, 1 insertion(+), 1 deletion(-)
--
2.24.1
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value
2020-03-03 14:33 [PATCH 0/2] KVM: x86: avoid using stale x86_emulate_ctxt->intercept value Vitaly Kuznetsov
@ 2020-03-03 14:33 ` Vitaly Kuznetsov
2020-03-03 15:42 ` Sean Christopherson
2020-03-03 16:21 ` Paolo Bonzini
2020-03-03 14:33 ` [PATCH 2/2] KVM: x86: remove stale comment from struct x86_emulate_ctxt Vitaly Kuznetsov
1 sibling, 2 replies; 7+ messages in thread
From: Vitaly Kuznetsov @ 2020-03-03 14:33 UTC (permalink / raw)
To: Paolo Bonzini, kvm
Cc: Jim Mattson, Sean Christopherson, Bandan Das, Oliver Upton, linux-kernel
Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
init_decode_cache") reduced the number of fields cleared by
init_decode_cache() claiming that they are being cleared elsewhere,
'intercept', however, seems to be left uncleared in some cases.
The issue I'm observing manifests itself as following:
after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
mode") Hyper-V guests on KVM stopped booting with:
kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
info2 0 int_info 0 int_info_err 0
kvm_page_fault: address febd0000 error_code 181
kvm_emulate_insn: 0:fffff802987d6169: f3 a5
kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL
kvm_inj_exception: #UD (0x0)
Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache")
Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
Cc: stable@vger.kernel.org
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
arch/x86/kvm/emulate.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index dd19fb3539e0..bc00642e5d3b 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -5173,6 +5173,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
ctxt->fetch.ptr = ctxt->fetch.data;
ctxt->fetch.end = ctxt->fetch.data + insn_len;
ctxt->opcode_len = 1;
+ ctxt->intercept = x86_intercept_none;
if (insn_len > 0)
memcpy(ctxt->fetch.data, insn, insn_len);
else {
--
2.24.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value
2020-03-03 14:33 ` [PATCH 1/2] KVM: x86: clear " Vitaly Kuznetsov
@ 2020-03-03 15:42 ` Sean Christopherson
2020-03-03 16:21 ` Paolo Bonzini
1 sibling, 0 replies; 7+ messages in thread
From: Sean Christopherson @ 2020-03-03 15:42 UTC (permalink / raw)
To: Vitaly Kuznetsov
Cc: Paolo Bonzini, kvm, Jim Mattson, Bandan Das, Oliver Upton, linux-kernel
On Tue, Mar 03, 2020 at 03:33:15PM +0100, Vitaly Kuznetsov wrote:
> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, seems to be left uncleared in some cases.
>
> The issue I'm observing manifests itself as following:
> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
>
> kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
> info2 0 int_info 0 int_info_err 0
> kvm_page_fault: address febd0000 error_code 181
> kvm_emulate_insn: 0:fffff802987d6169: f3 a5
> kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL
> kvm_inj_exception: #UD (0x0)
>
> Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache")
> Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode")
> Cc: stable@vger.kernel.org
> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
> ---
Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value
2020-03-03 14:33 ` [PATCH 1/2] KVM: x86: clear " Vitaly Kuznetsov
2020-03-03 15:42 ` Sean Christopherson
@ 2020-03-03 16:21 ` Paolo Bonzini
2020-03-03 16:35 ` Vitaly Kuznetsov
1 sibling, 1 reply; 7+ messages in thread
From: Paolo Bonzini @ 2020-03-03 16:21 UTC (permalink / raw)
To: Vitaly Kuznetsov, kvm
Cc: Jim Mattson, Sean Christopherson, Bandan Das, Oliver Upton, linux-kernel
On 03/03/20 15:33, Vitaly Kuznetsov wrote:
> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, seems to be left uncleared in some cases.
>
> The issue I'm observing manifests itself as following:
> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
>
> kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
> info2 0 int_info 0 int_info_err 0
> kvm_page_fault: address febd0000 error_code 181
> kvm_emulate_insn: 0:fffff802987d6169: f3 a5
> kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL
> kvm_inj_exception: #UD (0x0)
Slightly rephrased:
After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
mode") Hyper-V guests on KVM stopped booting with:
kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
info2 0 int_info 0 int_info_err 0
kvm_page_fault: address febd0000 error_code 181
kvm_emulate_insn: 0:fffff802987d6169: f3 a5
kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL
kvm_inj_exception: #UD (0x0)
"f3 a5" is a "rep movsw" instruction, which should not be intercepted
at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
init_decode_cache") reduced the number of fields cleared by
init_decode_cache() claiming that they are being cleared elsewhere,
'intercept', however, is left uncleared if the instruction does not have
any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
NearBranch, No16 and of course Intercept itself).
Paolo
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value
2020-03-03 16:21 ` Paolo Bonzini
@ 2020-03-03 16:35 ` Vitaly Kuznetsov
2020-03-03 16:37 ` Paolo Bonzini
0 siblings, 1 reply; 7+ messages in thread
From: Vitaly Kuznetsov @ 2020-03-03 16:35 UTC (permalink / raw)
To: Paolo Bonzini, kvm
Cc: Jim Mattson, Sean Christopherson, Bandan Das, Oliver Upton, linux-kernel
Paolo Bonzini <pbonzini@redhat.com> writes:
> On 03/03/20 15:33, Vitaly Kuznetsov wrote:
>> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
>> init_decode_cache") reduced the number of fields cleared by
>> init_decode_cache() claiming that they are being cleared elsewhere,
>> 'intercept', however, seems to be left uncleared in some cases.
>>
>> The issue I'm observing manifests itself as following:
>> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
>> mode") Hyper-V guests on KVM stopped booting with:
>>
>> kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
>> info2 0 int_info 0 int_info_err 0
>> kvm_page_fault: address febd0000 error_code 181
>> kvm_emulate_insn: 0:fffff802987d6169: f3 a5
>> kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL
>> kvm_inj_exception: #UD (0x0)
>
> Slightly rephrased:
>
> After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
>
> kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181
> info2 0 int_info 0 int_info_err 0
> kvm_page_fault: address febd0000 error_code 181
> kvm_emulate_insn: 0:fffff802987d6169: f3 a5
> kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL
> kvm_inj_exception: #UD (0x0)
>
> "f3 a5" is a "rep movsw" instruction, which should not be intercepted
> at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, is left uncleared if the instruction does not have
> any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
> NearBranch, No16 and of course Intercept itself).
Much better, thanks) Please let me know if you want me to resubmit.
--
Vitaly
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value
2020-03-03 16:35 ` Vitaly Kuznetsov
@ 2020-03-03 16:37 ` Paolo Bonzini
0 siblings, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2020-03-03 16:37 UTC (permalink / raw)
To: Vitaly Kuznetsov, kvm
Cc: Jim Mattson, Sean Christopherson, Bandan Das, Oliver Upton, linux-kernel
On 03/03/20 17:35, Vitaly Kuznetsov wrote:
>>
>> "f3 a5" is a "rep movsw" instruction, which should not be intercepted
>> at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
>> init_decode_cache") reduced the number of fields cleared by
>> init_decode_cache() claiming that they are being cleared elsewhere,
>> 'intercept', however, is left uncleared if the instruction does not have
>> any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
>> NearBranch, No16 and of course Intercept itself).
> Much better, thanks) Please let me know if you want me to resubmit.
No need, thanks.
Paolo
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 2/2] KVM: x86: remove stale comment from struct x86_emulate_ctxt
2020-03-03 14:33 [PATCH 0/2] KVM: x86: avoid using stale x86_emulate_ctxt->intercept value Vitaly Kuznetsov
2020-03-03 14:33 ` [PATCH 1/2] KVM: x86: clear " Vitaly Kuznetsov
@ 2020-03-03 14:33 ` Vitaly Kuznetsov
1 sibling, 0 replies; 7+ messages in thread
From: Vitaly Kuznetsov @ 2020-03-03 14:33 UTC (permalink / raw)
To: Paolo Bonzini, kvm
Cc: Jim Mattson, Sean Christopherson, Bandan Das, Oliver Upton, linux-kernel
Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
init_decode_cache") did some field shuffling and instead of
[opcode_len, _regs) started clearing [has_seg_override, modrm).
The comment about clearing fields altogether is not true anymore.
Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
arch/x86/include/asm/kvm_emulate.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index 2a8f2bd2e5cf..c06e8353efd3 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -360,7 +360,6 @@ struct x86_emulate_ctxt {
u64 d;
unsigned long _eip;
struct operand memop;
- /* Fields above regs are cleared together. */
unsigned long _regs[NR_VCPU_REGS];
struct operand *memopp;
struct fetch_cache fetch;
--
2.24.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2020-03-03 16:37 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-03 14:33 [PATCH 0/2] KVM: x86: avoid using stale x86_emulate_ctxt->intercept value Vitaly Kuznetsov
2020-03-03 14:33 ` [PATCH 1/2] KVM: x86: clear " Vitaly Kuznetsov
2020-03-03 15:42 ` Sean Christopherson
2020-03-03 16:21 ` Paolo Bonzini
2020-03-03 16:35 ` Vitaly Kuznetsov
2020-03-03 16:37 ` Paolo Bonzini
2020-03-03 14:33 ` [PATCH 2/2] KVM: x86: remove stale comment from struct x86_emulate_ctxt Vitaly Kuznetsov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).