2022-05-03 01:23:40

by Sean Christopherson

Subject: [PATCH] KVM: VMX: Exit to userspace if vCPU has injected exception and invalid state

Exit to userspace with an emulation error if KVM encounters an injected
exception with invalid guest state, in addition to the existing check of
bailing if there's a pending exception (KVM doesn't support emulating
exceptions except when emulating real mode via vm86).

In theory, KVM should never get to such a situation as KVM is supposed to
exit to userspace before injecting an exception with invalid guest state.
But in practice, userspace can intervene and manually inject an exception
and/or stuff registers to force invalid guest state while a previously
injected exception is awaiting reinjection.

Fixes: fc4fad79fc3d ("KVM: VMX: Reject KVM_RUN if emulation is required with pending exception")
Reported-by: [email protected]
Signed-off-by: Sean Christopherson <[email protected]>
---
arch/x86/kvm/vmx/vmx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index cf8581978bce..c41f0ac700c7 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -5465,7 +5465,7 @@ static bool vmx_emulation_required_with_pending_exception(struct kvm_vcpu *vcpu)
struct vcpu_vmx *vmx = to_vmx(vcpu);

return vmx->emulation_required && !vmx->rmode.vm86_active &&
- vcpu->arch.exception.pending;
+ (vcpu->arch.exception.pending || vcpu->arch.exception.injected);
}

static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)

base-commit: 84e5ffd045f33e4fa32370135436d987478d0bf7
--
2.36.0.464.gb9c8b46e94-goog

2022-05-03 12:49:34

by Paolo Bonzini

Subject: Re: [PATCH] KVM: VMX: Exit to userspace if vCPU has injected exception and invalid state

On 5/3/22 00:18, Sean Christopherson wrote:
> Exit to userspace with an emulation error if KVM encounters an injected
> exception with invalid guest state, in addition to the existing check of
> bailing if there's a pending exception (KVM doesn't support emulating
> exceptions except when emulating real mode via vm86).
>
> In theory, KVM should never get to such a situation as KVM is supposed to
> exit to userspace before injecting an exception with invalid guest state.
> But in practice, userspace can intervene and manually inject an exception
> and/or stuff registers to force invalid guest state while a previously
> injected exception is awaiting reinjection.
>
> Fixes: fc4fad79fc3d ("KVM: VMX: Reject KVM_RUN if emulation is required with pending exception")
> Reported-by: [email protected]
> Signed-off-by: Sean Christopherson <[email protected]>
> ---
> arch/x86/kvm/vmx/vmx.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index cf8581978bce..c41f0ac700c7 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -5465,7 +5465,7 @@ static bool vmx_emulation_required_with_pending_exception(struct kvm_vcpu *vcpu)
> struct vcpu_vmx *vmx = to_vmx(vcpu);
>
> return vmx->emulation_required && !vmx->rmode.vm86_active &&
> - vcpu->arch.exception.pending;
> + (vcpu->arch.exception.pending || vcpu->arch.exception.injected);
> }
>
> static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
>
> base-commit: 84e5ffd045f33e4fa32370135436d987478d0bf7

Queued, thanks.

Paolo