linux-kernel - Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 03 Mar 2020 17:35:53 +0100
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org
Cc:     Jim Mattson <jmattson@...gle.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Bandan Das <bsd@...hat.com>, Oliver Upton <oupton@...gle.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] KVM: x86: clear stale x86_emulate_ctxt->intercept value

Paolo Bonzini <pbonzini@...hat.com> writes:

> On 03/03/20 15:33, Vitaly Kuznetsov wrote:
>> Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
>> init_decode_cache") reduced the number of fields cleared by
>> init_decode_cache() claiming that they are being cleared elsewhere,
>> 'intercept', however, seems to be left uncleared in some cases.
>> 
>> The issue I'm observing manifests itself as following:
>> after commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
>> mode") Hyper-V guests on KVM stopped booting with:
>> 
>>  kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
>>     info2 0 int_info 0 int_info_err 0
>>  kvm_page_fault:       address febd0000 error_code 181
>>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5
>>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
>>  kvm_inj_exception:    #UD (0x0)
>
> Slightly rephrased:
>
> After commit 07721feee46b ("KVM: nVMX: Don't emulate instructions in guest
> mode") Hyper-V guests on KVM stopped booting with:
>
>  kvm_nested_vmexit:    rip fffff802987d6169 reason EPT_VIOLATION info1 181
>     info2 0 int_info 0 int_info_err 0
>  kvm_page_fault:       address febd0000 error_code 181
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5
>  kvm_emulate_insn:     0:fffff802987d6169: f3 a5 FAIL
>  kvm_inj_exception:    #UD (0x0)
>
> "f3 a5" is a "rep movsw" instruction, which should not be intercepted
> at all.  Commit c44b4c6ab80e ("KVM: emulate: clean up initializations in
> init_decode_cache") reduced the number of fields cleared by
> init_decode_cache() claiming that they are being cleared elsewhere,
> 'intercept', however, is left uncleared if the instruction does not have
> any of the "slow path" flags (NotImpl, Stack, Op3264, Sse, Mmx, CheckPerm,
> NearBranch, No16 and of course Intercept itself).

Much better, thanks) Please let me know if you want me to resubmit.

-- 
Vitaly