| Message ID | 20200303143316.834912-2-vkuznets@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: x86: avoid using stale x86_emulate_ctxt->intercept value | expand |
On Tue, Mar 03, 2020 at 03:33:15PM +0100, Vitaly Kuznetsov wrote: > Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in > init_decode_cache") reduced the number of fields cleared by > init_decode_cache() claiming that they are being cleared elsewhere, > 'intercept', however, seems to be left uncleared in some cases. > > The issue I'm observing manifests itself as following: > after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest > mode") Hyper-V guests on KVM stopped booting with: > > kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 > info2 0 int_info 0 int_info_err 0 > kvm_page_fault: address febd0000 error_code 181 > kvm_emulate_insn: 0:fffff802987d6169: f3 a5 > kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL > kvm_inj_exception: #UD (0x0) > > Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") > Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") > Cc: stable@vger.kernel.org > Suggested-by: Paolo Bonzini <pbonzini@redhat.com> > Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> > --- Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
On 03/03/20 15:33, Vitaly Kuznetsov wrote: > Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in > init_decode_cache") reduced the number of fields cleared by > init_decode_cache() claiming that they are being cleared elsewhere, > 'intercept', however, seems to be left uncleared in some cases. > > The issue I'm observing manifests itself as following: > after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest > mode") Hyper-V guests on KVM stopped booting with: > > kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 > info2 0 int_info 0 int_info_err 0 > kvm_page_fault: address febd0000 error_code 181 > kvm_emulate_insn: 0:fffff802987d6169: f3 a5 > kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL > kvm_inj_exception: #UD (0x0) Slightly rephrased: After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Hyper-V guests on KVM stopped booting with: kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 info2 0 int_info 0 int_info_err 0 kvm_page_fault: address febd0000 error_code 181 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL kvm_inj_exception: #UD (0x0) "f3 a5" is a "rep movsw" instruction, which should not be intercepted at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") reduced the number of fields cleared by init_decode_cache() claiming that they are being cleared elsewhere, 'intercept', however, is left uncleared if the instruction does not have any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm, NearBranch, No16 and of course Intercept itself). Paolo
Paolo Bonzini <pbonzini@redhat.com> writes: > On 03/03/20 15:33, Vitaly Kuznetsov wrote: >> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in >> init_decode_cache") reduced the number of fields cleared by >> init_decode_cache() claiming that they are being cleared elsewhere, >> 'intercept', however, seems to be left uncleared in some cases. >> >> The issue I'm observing manifests itself as following: >> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest >> mode") Hyper-V guests on KVM stopped booting with: >> >> kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 >> info2 0 int_info 0 int_info_err 0 >> kvm_page_fault: address febd0000 error_code 181 >> kvm_emulate_insn: 0:fffff802987d6169: f3 a5 >> kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL >> kvm_inj_exception: #UD (0x0) > > Slightly rephrased: > > After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest > mode") Hyper-V guests on KVM stopped booting with: > > kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 > info2 0 int_info 0 int_info_err 0 > kvm_page_fault: address febd0000 error_code 181 > kvm_emulate_insn: 0:fffff802987d6169: f3 a5 > kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL > kvm_inj_exception: #UD (0x0) > > "f3 a5" is a "rep movsw" instruction, which should not be intercepted > at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in > init_decode_cache") reduced the number of fields cleared by > init_decode_cache() claiming that they are being cleared elsewhere, > 'intercept', however, is left uncleared if the instruction does not have > any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm, > NearBranch, No16 and of course Intercept itself). Much better, thanks) Please let me know if you want me to resubmit.
On 03/03/20 17:35, Vitaly Kuznetsov wrote: >> >> "f3 a5" is a "rep movsw" instruction, which should not be intercepted >> at all. Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in >> init_decode_cache") reduced the number of fields cleared by >> init_decode_cache() claiming that they are being cleared elsewhere, >> 'intercept', however, is left uncleared if the instruction does not have >> any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm, >> NearBranch, No16 and of course Intercept itself). > Much better, thanks) Please let me know if you want me to resubmit. No need, thanks. Paolo
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index dd19fb3539e0..bc00642e5d3b 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -5173,6 +5173,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) ctxt->fetch.ptr = ctxt->fetch.data; ctxt->fetch.end = ctxt->fetch.data + insn_len; ctxt->opcode_len = 1; + ctxt->intercept = x86_intercept_none; if (insn_len > 0) memcpy(ctxt->fetch.data, insn, insn_len); else {
Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") reduced the number of fields cleared by init_decode_cache() claiming that they are being cleared elsewhere, 'intercept', however, seems to be left uncleared in some cases. The issue I'm observing manifests itself as following: after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Hyper-V guests on KVM stopped booting with: kvm_nested_vmexit: rip fffff802987d6169 reason EPT_VIOLATION info1 181 info2 0 int_info 0 int_info_err 0 kvm_page_fault: address febd0000 error_code 181 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 kvm_emulate_insn: 0:fffff802987d6169: f3 a5 FAIL kvm_inj_exception: #UD (0x0) Fixes: c44b4c6ab80e ("KVM: emulate: clean up initializations in init_decode_cache") Fixes: 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest mode") Cc: stable@vger.kernel.org Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> --- arch/x86/kvm/emulate.c | 1 + 1 file changed, 1 insertion(+)