Received: by 2002:a05:6a10:9afc:0:0:0:0 with SMTP id t28csp92010pxm; Tue, 22 Feb 2022 07:00:17 -0800 (PST) X-Google-Smtp-Source: ABdhPJx4CkwjEJnjFcfEwXTyAFSt5VGUHVMZ4eUkQpTxt8yytn5BLzwAmXTwRzQjeNvF2drhyqEk X-Received: by 2002:a05:6402:17d9:b0:410:aaaf:6467 with SMTP id s25-20020a05640217d900b00410aaaf6467mr27693119edy.38.1645542016467; Tue, 22 Feb 2022 07:00:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1645542016; cv=none; d=google.com; s=arc-20160816; b=YsVH+wT9AJyQZBWPlqbcmSeBrHI1XGmmHmCbtlIB6vnslu7e66XuMzvqkVqcDe+2LC 2cBkzSdsH+hkSUOBZX7/9Z64qsDOXmPam5UE0j6U5z+ZZ+wjwsPxDTAFLuISFkCO09te lZi0EkayWJkMrKSsQe/Nr6oNl7/biRg2i0r3N8jvmggyvGA/KI3PRzQsNAf4m6cf8hIR DRr0mVDQeJjeEK3atnWGPTXkQeXdosfpbYEiMe9H9o7H1DgFKdGxART1va7MdUpMh2jf JhZos60INNgWHjbmhC7vdf26si3OthLRUGBF0nXLy65JAIMhMi/OSYyZsTOnwDAoUgg7 bTzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=qhlt2tsOFxzKC8jhvDqBeFjdKIzxmP6uAT4T6+s3v4M=; b=dgt2gI9kvNFa7SWj1XNMXuxliuxftJnx9k3bdv1OFq29XluIqp3LiIdwZCcTGKi2PI D0+n5BJD6G288GzuiJv+6QdLEioo7MgoiAbjO1gs9OsIdpAIFAFknklyE5J08olncEqX VdV7aP1gTczZWWtFjfQlvWkCoLi1NYqFDpXUI2d0gnUxxZQEOgHskQJ8m4lUpx4ALmjE OTok3w9It3vvbpeRXCkGc6HmQfxGpnumXiJe8Lc/1Cl30nC75CvN24NPvg368aYvivNo DQlX+Pd1NRUFKR1gPeuxojR1TePcHFR5+fT3vJVrwZMVYboULhUzevEEdYMeZ2YWtdiT jflQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=os7XBZsd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v5si16367406edi.611.2022.02.22.06.59.51; Tue, 22 Feb 2022 07:00:16 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=os7XBZsd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232693AbiBVOGT (ORCPT + 99 others); Tue, 22 Feb 2022 09:06:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232583AbiBVOGQ (ORCPT ); Tue, 22 Feb 2022 09:06:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D249015F611; Tue, 22 Feb 2022 06:05:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7D977B819EF; Tue, 22 Feb 2022 14:05:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A5D3C340F4; Tue, 22 Feb 2022 14:05:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1645538737; bh=vJs7TKpZfBZPGDl1BKHYpsmyKvfPddQ5Air5Dpbj5ic=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=os7XBZsdl6dQEnOPHsGkRpA0uxoKELLhPqVKvS2H/21G1VdRg5HNmoOl20pnnrRP+ yskZoDU042NPrzp9rHS7GeAC0O+sBerqekpMCpTJzvTok01r8Hf3I80cBpc6Rl3MXB MCNo4YuMjHpWI94wJDQmgtiChHNFwqS3VqZtG7EwN9woU/hNZNkg9PzyNvJlJJLrdg O/PMYaSGrtI4qBvjdkC455CuP3dlxlSRUmT/8wtXkxP5OKnW+Z1heANmbv8GlSsSkK +3py+CSJJ2poYDWTFk8KzORxDRA/JCPdVVsXxXTIUsVVeKZfDoETWslS3A6JmR3Q3a HpEPVsER5hPwA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Maxim Levitsky , Paolo Bonzini , Sasha Levin , tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, kvm@vger.kernel.org Subject: [PATCH MANUALSEL 5.10 2/2] KVM: x86: nSVM: deal with L1 hypervisor that intercepts interrupts but lets L2 control them Date: Tue, 22 Feb 2022 09:05:32 -0500 Message-Id: <20220222140532.211620-2-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220222140532.211620-1-sashal@kernel.org> References: <20220222140532.211620-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maxim Levitsky [ Upstream commit 2b0ecccb55310a4b8ad5d59c703cf8c821be6260 ] Fix a corner case in which the L1 hypervisor intercepts interrupts (INTERCEPT_INTR) and either doesn't set virtual interrupt masking (V_INTR_MASKING) or enters a nested guest with EFLAGS.IF disabled prior to the entry. In this case, despite the fact that L1 intercepts the interrupts, KVM still needs to set up an interrupt window to wait before injecting the INTR vmexit. Currently the KVM instead enters an endless loop of 'req_immediate_exit'. Exactly the same issue also happens for SMIs and NMI. Fix this as well. Note that on VMX, this case is impossible as there is only 'vmexit on external interrupts' execution control which either set, in which case both host and guest's EFLAGS.IF are ignored, or not set, in which case no VMexits are delivered. Signed-off-by: Maxim Levitsky Message-Id: <20220207155447.840194-8-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin --- arch/x86/kvm/svm/svm.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index d515c8e68314c..ec9586a30a50c 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3237,11 +3237,13 @@ static int svm_nmi_allowed(struct kvm_vcpu *vcpu, bool for_injection) if (svm->nested.nested_run_pending) return -EBUSY; + if (svm_nmi_blocked(vcpu)) + return 0; + /* An NMI must not be injected into L2 if it's supposed to VM-Exit. */ if (for_injection && is_guest_mode(vcpu) && nested_exit_on_nmi(svm)) return -EBUSY; - - return !svm_nmi_blocked(vcpu); + return 1; } static bool svm_get_nmi_mask(struct kvm_vcpu *vcpu) @@ -3293,9 +3295,13 @@ bool svm_interrupt_blocked(struct kvm_vcpu *vcpu) static int svm_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection) { struct vcpu_svm *svm = to_svm(vcpu); + if (svm->nested.nested_run_pending) return -EBUSY; + if (svm_interrupt_blocked(vcpu)) + return 0; + /* * An IRQ must not be injected into L2 if it's supposed to VM-Exit, * e.g. if the IRQ arrived asynchronously after checking nested events. @@ -3303,7 +3309,7 @@ static int svm_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection) if (for_injection && is_guest_mode(vcpu) && nested_exit_on_intr(svm)) return -EBUSY; - return !svm_interrupt_blocked(vcpu); + return 1; } static void enable_irq_window(struct kvm_vcpu *vcpu) @@ -4023,11 +4029,14 @@ static int svm_smi_allowed(struct kvm_vcpu *vcpu, bool for_injection) if (svm->nested.nested_run_pending) return -EBUSY; + if (svm_smi_blocked(vcpu)) + return 0; + /* An SMI must not be injected into L2 if it's supposed to VM-Exit. */ if (for_injection && is_guest_mode(vcpu) && nested_exit_on_smi(svm)) return -EBUSY; - return !svm_smi_blocked(vcpu); + return 1; } static int svm_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate) -- 2.34.1