Patch "kvm: svm: reset mmu on VCPU reset" has been added to the 4.2-stable tree

This is a note to let you know that I've just added the patch titled

kvm: svm: reset mmu on VCPU reset

to the 4.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
kvm-svm-reset-mmu-on-vcpu-reset.patch
and it can be found in the queue-4.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Igor Mammedov <[email protected]>
Date: Fri, 18 Sep 2015 15:39:05 +0200
Subject: kvm: svm: reset mmu on VCPU reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Igor Mammedov <[email protected]>

commit ebae871a509d3c24b32ff67af2671dadffc58770 upstream.

When INIT/SIPI sequence is sent to VCPU which before that was in use by OS, VMRUN might fail with:

KVM: entry failed, hardware error 0xffffffff EAX=00000000 EBX=00000000 ECX=00000000 EDX=000006d3 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000 EIP=00000000 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 00000000 0000ffff 00009300
CS =9a00 0009a000 0000ffff 00009a00
[...]
CR0=60000010 CR2=b6f3e000 CR3=01942000 CR4=000007e0 [...]
EFER=0000000000000000

with corresponding SVM error:
KVM: FAILED VMRUN WITH VMCB:
[...]

 cpl:            0                efer:         0000000000001000
 cr0:            0000000080010010 cr2:          00007fd7fe85bf90
 cr3:            0000000187d0c000 cr4:          0000000000000020

[...]

What happens is that VCPU state right after offlinig:
CR0: 0x80050033 EFER: 0xd01 CR4: 0x7e0
-> long mode with CR3 pointing to longmode page tables

and when VCPU gets INIT/SIPI following transition happens
CR0: 0 -> 0x60000010 EFER: 0x0 CR4: 0x7e0
-> paging disabled with stale CR3

However SVM under the hood puts VCPU in Paged Real Mode* which effectively translates CR0 0x60000010 -> 80010010 after

svm_vcpu_reset()

       -> init_vmcb()
           -> kvm_set_cr0()
               -> svm_set_cr0()

but from kvm_set_cr0() perspective CR0: 0 -> 0x60000010 only caching bits are changed and
commit d81135a57aa6
("KVM: x86: do not reset mmu if CR0.CD and CR0.NW are changed")'
regressed svm_vcpu_reset() which relied on MMU being reset.

As result VMRUN after svm_vcpu_reset() tries to run
VCPU in Paged Real Mode with stale MMU context (longmode page tables), which causes some AMD CPUs** to bail out with VMEXIT_INVALID.

Fix issue by unconditionally resetting MMU context at init_vmcb() time.

* AMD64 Architecture Programmer’s Manual, Volume 2: System Programming, rev: 3.25 15.19 Paged Real Mode
** Opteron 1216

---
 arch/x86/kvm/svm.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1260,6 +1260,7 @@ static void init_vmcb(struct vcpu_svm *s
 	 * It also updates the guest-visible cr0 value.
 	 */
 	(void)kvm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
+	kvm_mmu_reset_context(&svm->vcpu);
 
 	save->cr4 = X86_CR4_PAE;
 	/* rdx = ?? */

Patches currently in stable-queue which might be from [email protected] are

queue-4.2/kvm-svm-reset-mmu-on-vcpu-reset.patch