Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20171205010616.5958-1-brijesh.singh@amd.com> <20171205010616.5958-9-brijesh.singh@amd.com>
In-Reply-To: <20171205010616.5958-9-brijesh.singh@amd.com>
From:   Jim Mattson <jmattson@google.com>
Date:   Fri, 1 Feb 2019 12:21:18 -0800
Message-ID: <CALMp9eTpMm4qpNCUj00qk8CA7BmW-uq4YRwHzKa_GAwON2kgyQ@mail.gmail.com>
Subject: Re: [Part2 PATCH v9 38/38] KVM: X86: Restart the guest when insn_len
 is zero and SEV is enabled
To:     Brijesh Singh <brijesh.singh@amd.com>
Cc:     kvm list <kvm@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        "the arch/x86 maintainers" <x86@kernel.org>,
        Borislav Petkov <bp@alien8.de>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>,
        Paolo Bonzini <pbonzini@redhat.com>,
        =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrcmar@redhat.com>,
        Joerg Roedel <joro@8bytes.org>, Borislav Petkov <bp@suse.de>,
        Tom Lendacky <thomas.lendacky@amd.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Dec 4, 2017 at 5:07 PM Brijesh Singh <brijesh.singh@amd.com> wrote:
>
> On AMD platforms, under certain conditions insn_len may be zero on #NPF.
> This can happen if a guest gets a page-fault on data access but the HW
> table walker is not able to read the instruction page (e.g instruction
> page is not present in memory).
>
> Typically, when insn_len is zero, x86_emulate_instruction() walks the
> guest page table and fetches the instruction bytes from guest memory.
> When SEV is enabled, the guest memory is encrypted with guest-specific
> key hence hypervisor will not able to fetch the instruction bytes.
> In those cases we simply restart the guest.
>
> I have encountered this issue when running kernbench inside the guest.
>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: "Radim Kr=C4=8Dm=C3=A1=C5=99" <rkrcmar@redhat.com>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Borislav Petkov <bp@suse.de>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: x86@kernel.org
> Cc: kvm@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
> ---
>  arch/x86/kvm/mmu.c | 10 ++++++++++
>  arch/x86/kvm/svm.c |  6 ++++--
>  2 files changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
> index e5e66e5c6640..d5e5dbd0e5ad 100644
> --- a/arch/x86/kvm/mmu.c
> +++ b/arch/x86/kvm/mmu.c
> @@ -4950,6 +4950,16 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_=
t cr2, u64 error_code,
>         if (mmio_info_in_cache(vcpu, cr2, direct))
>                 emulation_type =3D 0;
>  emulate:
> +       /*
> +        * On AMD platforms, under certain conditions insn_len may be zer=
o on #NPF.
> +        * This can happen if a guest gets a page-fault on data access bu=
t the HW
> +        * table walker is not able to read the instruction page (e.g ins=
truction
> +        * page is not present in memory). In those cases we simply resta=
rt the
> +        * guest.
> +        */
> +       if (unlikely(insn && !insn_len))
> +               return 1;
> +

How does this work, for instance, with MMIO at CPL3 with SMAP enabled?