Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <a70550d3-65fd-03ca-f342-a4f203d62163@oracle.com>
Date:   Thu, 20 Jan 2022 14:16:22 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [PATCH 1/9] KVM: SVM: Never reject emulation due to SMAP errata
 for !SEV guests
Content-Language: en-GB
To:     Sean Christopherson <seanjc@google.com>,
        Paolo Bonzini <pbonzini@redhat.com>
Cc:     Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Brijesh Singh <brijesh.singh@amd.com>,
        Liam Merwick <liam.merwick@oracle.com>
References: <20220120010719.711476-1-seanjc@google.com>
 <20220120010719.711476-2-seanjc@google.com>
From:   Liam Merwick <liam.merwick@oracle.com>
In-Reply-To: <20220120010719.711476-2-seanjc@google.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?d1Q1bEN4WWhETWs0VEt4ZnE0VzU0aFU0bmdoWC85eUQ5MUxTNTNRamNjY2xs?=
 =?utf-8?B?elVmNGxvNEphQkJtbkxudVlUNXY0QW5tcXN4a0gwWFEvMCtKTmtpUE1CVXRz?=
 =?utf-8?B?eFVNWko4T1FGdWh0Kzlod0MrNTY5WEdrRTNrWE5sOW00bE9GYkJvVTFJRlBK?=
 =?utf-8?B?Z2JiTFZZWUF5Y3NEblhVd0ZSdGlqVFpLM1dxVFo2VFZJbVp2Y3RZdXM4YTBq?=
 =?utf-8?B?aUlzdHpVODhFVFRFV0g1eTVyakZBNG5LemRZcHFMbDBxa2tqci8xQjBiMEJq?=
 =?utf-8?B?U2FrenBWTjZwa0dtcno3ZjlQeUdHUHRhSHhRUE9DU01CVVk2U1R5Wi93alNP?=
 =?utf-8?B?cm5vaHZvbGhFWmFzclNMQ0dHblN0YUl2ZmluRnpyUDRUZUZEczhheStXT3p4?=
 =?utf-8?B?WU5TZ0VuZThRcDkwTmJQQmRrazFnQnV6a3V0WEZsS2xJU3kyVzhzQTdyMzlP?=
 =?utf-8?B?bitWZS9LRGVodlVCeXdUcHN0cGUwbUlCeXN4WFFZRGRucjdQRlFRR3JMU0M0?=
 =?utf-8?B?Y0FOaTJuQUFTcU9hU3RTMlZGQU5pcTRYRjFqcHZvdXlDUGlYY0IzTE1FQmJ5?=
 =?utf-8?B?aGJkUy85QU5Ec3FrbWNUcEJFaUg0QUhsTEd4ZWtVVmoxZmZkdXJyYXRpWkVQ?=
 =?utf-8?B?ZUlyd1NWckZuRTBoQlUyN2FPZUN2M1U3Y2hVSWx4ZFlKeUxoYnZxMHNaVkNv?=
 =?utf-8?B?Tmd5QW9DMUdROFdKWlA0QzBDak51V2FESzZYUW9TY1BUdWpkTXo5OWlFWDBZ?=
 =?utf-8?B?am42NlAvNG5UazN2OEJmYjVTSFNMelU5aC8wSFNlQXFDdVRQS3lIQWtUMFZF?=
 =?utf-8?B?LzVTNmtqMU5rZzZzZ2JTTDBMQWh1bHZENysrdmMvOTBXeVZzQ00rV0hmVi9N?=
 =?utf-8?B?NnJKVHVZemFBUUJHVXEvYVZyendlQ2tjUHVMaXlDRlA3dVFTZ3dNNnMyQk4w?=
 =?utf-8?B?SEdpd0pOQ1FkZ0VWOWozSVEyd05rVVVpamtSekoveVVKYzkyN0IrK3RlMzZG?=
 =?utf-8?B?T3E0Y0hOVGdHMWRhSXpVNzE4d1pRTFE5WnFWSytVNVZzZmcwcWVYcXdXNGlq?=
 =?utf-8?B?OWEwLzl2TUQ3WkxrUldYMTZrKzVWWG90VUNQUEtnZXZ2NmF0blZRcDBvMS9y?=
 =?utf-8?B?VjY3MUc4dVdocUZLN0dSVnk5VlF4VlUwK29Ed0UvcmwycWtOeVhVYzRWNjht?=
 =?utf-8?B?ajNuK0RkdlM5RXY0dmNiSmI1MnJnM0ZYU0Mwb3V6NU03R1QyVmhqaEphOVBB?=
 =?utf-8?B?QWk3eVFlZGlVVjgrSCtjVjlvMzYxRHUzMmg1WDc0VDZsL3ZHYWZJWGhrcmlE?=
 =?utf-8?B?VXFiZ1VTREhzZzl4VkpvVEJkVDJOTHFVa1Zwc01QQnNnL0Nmbi96R09BSDdk?=
 =?utf-8?B?K1pZL1EvNXlaSENYVjNnaGxrK3lvaUd1UnM4aDBVSkY2YUU2VUxzYWNsNjFv?=
 =?utf-8?B?RjB5S3lqbjdyZXRsbTJnR2QxamtZYWQ5OUpyT1FaSFFpd2hzVVBuN1lzTWVj?=
 =?utf-8?B?aXBzcklTcUp0TFVhY2MzblhjbUxuRlMzT3hoLzhPaU1XdUQ4Q3QwdVVHT1dn?=
 =?utf-8?B?bkg5Y2d4WGRjSGtvcEUwMUdUbkpDR1RsM1V2eCtzek1qYkZaQW94UlZoY045?=
 =?utf-8?B?UUNRUVIzZkFkQVpRYS9Rck14enQrU24vMm9OSmx2ZGpqTzJRN0IzZnRuVzA2?=
 =?utf-8?B?bTB6bldoSVlHcDNrZUc1ZG1oR0ZKQTNQOElraGZVYTkxdVZFbEhydUgyN0Vj?=
 =?utf-8?B?eDNSWGJjVkhZT0h2Q2lCUUR5NGtFK0VWbmdXaTVTOThwK3N6ajFNRitMMkRK?=
 =?utf-8?B?ZU4yK2Y5VFlxaERWa1RFemRrdnJONGJwdGpITy9RdjZ0dEVValduRUttRWNB?=
 =?utf-8?B?Mjdvb2pzMTdTaDluSHQwejdndWFGYU9TMzc3R0h5SGVRVm56bEJCNERxYTZw?=
 =?utf-8?B?clNWUTV5ZnBTMy9IYTJRYlF2R2N0MjJsUTB5NkNnMFRkaC9RaG1ydXJEeTBO?=
 =?utf-8?B?K05lMTZjbnk1UitRQWlVMEZlTGVCeGY5czlySm5XaWVnMStyTVhEY0wyK1d4?=
 =?utf-8?B?MWdBK0w3MW1tN3VpcmphOUprZlJ6NEp1d2FoYWFCTzBkbW9tSnprUGIzWWRV?=
 =?utf-8?B?SmZWQ2NCTGhyRjA2RGxpQ2VBN3BpWG9KUTc0R0NLYUMwNEM0OE91dTc0aENE?=
 =?utf-8?Q?2kfXEANdg9VZ37JG5zZa9LQ=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7fe1ad53-409c-422a-5564-08d9dc1f7455
X-MS-Exchange-CrossTenant-AuthSource: DS7PR10MB5038.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2022 14:16:30.5981
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: UkNthxO+o0Mvw5L6eeSe/vYQkDm3u4JoTmcACAVYf78xz9w+swT4OyNtbfa54Qg7Ts+RI0OIVsfItVxW8lkxwg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4576
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10232 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 bulkscore=0
 malwarescore=0 adultscore=0 phishscore=0 mlxscore=0 spamscore=0
 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2201200075
X-Proofpoint-GUID: i3SonwktJtemWhL3MmzAGRDwknluoWGA
X-Proofpoint-ORIG-GUID: i3SonwktJtemWhL3MmzAGRDwknluoWGA
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 20/01/2022 01:07, Sean Christopherson wrote:
> Always signal that emulation is possible for !SEV guests regardless of
> whether or not the CPU provided a valid instruction byte stream.  KVM can
> read all guest state (memory and registers) for !SEV guests, i.e. can
> fetch the code stream from memory even if the CPU failed to do so because
> of the SMAP errata.
> 
> Fixes: 05d5a4863525 ("KVM: SVM: Workaround errata#1096 (insn_len maybe zero on SMAP violation)")
> Cc: stable@vger.kernel.org
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Brijesh Singh <brijesh.singh@amd.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Liam Merwick <liam.merwick@oracle.com>

> ---
>   arch/x86/kvm/svm/svm.c | 10 ++++++----
>   1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 6d31d357a83b..aa1649b8cd8f 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4257,8 +4257,13 @@ static bool svm_can_emulate_instruction(struct kvm_vcpu *vcpu, void *insn, int i
>   	bool smep, smap, is_user;
>   	unsigned long cr4;
>   
> +	/* Emulation is always possible when KVM has access to all guest state. */
> +	if (!sev_guest(vcpu->kvm))
> +		return true;
> +
>   	/*
> -	 * When the guest is an SEV-ES guest, emulation is not possible.
> +	 * Emulation is impossible for SEV-ES guests as KVM doesn't have access
> +	 * to guest register state.
>   	 */
>   	if (sev_es_guest(vcpu->kvm))
>   		return false;
> @@ -4318,9 +4323,6 @@ static bool svm_can_emulate_instruction(struct kvm_vcpu *vcpu, void *insn, int i
>   	smap = cr4 & X86_CR4_SMAP;
>   	is_user = svm_get_cpl(vcpu) == 3;
>   	if (smap && (!smep || is_user)) {
> -		if (!sev_guest(vcpu->kvm))
> -			return true;
> -
>   		pr_err_ratelimited("KVM: SEV Guest triggered AMD Erratum 1096\n");
>   		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
>   	}