From patchwork Wed Mar 22 14:32:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Christopherson X-Patchwork-Id: 73464 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:604a:0:0:0:0:0 with SMTP id j10csp2376579wrt; Wed, 22 Mar 2023 07:38:15 -0700 (PDT) X-Google-Smtp-Source: AK7set+Fiw727czXmCF60kKGINpAaCcPSDUJohQWKAjpa74ZMhPURykDyvhLjkaCKzGo+3T7q2wT X-Received: by 2002:a17:906:2009:b0:92e:d6e6:f3ad with SMTP id 9-20020a170906200900b0092ed6e6f3admr7485579ejo.6.1679495895697; Wed, 22 Mar 2023 07:38:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1679495895; cv=none; d=google.com; s=arc-20160816; b=iTTtBI2/vrnsh6CfRBAbNi9bgGDDSpKQIitoMZsSYtpPFkTNb2qhHLZgmQ6+aHkzPS 9jBaIZ3/41UbgGf6+SdHiwQDpmKXRRZdC5p2bt9WleWxWfL6stuWICYgLHa8enz36T+z S/7NmpP4SJdWFTiSFQZE0TVjDwYbuGRVKXyrsGvrQ0b/Ce+taPaJvI0pnHrbCgwQ2wsR o2JuyHLp03xNIPkXZFodQQoHe+cGi+wjCLYBrTH7xaLkRyXgcQDvO+UtZFWMfQpkuC4s p8U/54rORgDWaQ4q2poPLRuAYYYIsDTxjErYJ1qDzVPf0Br6hSVEqMvRnWJH3pHXk6v7 K3qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:mime-version:date :reply-to:dkim-signature; bh=yd5LHdKukK1pcNHstBXl6O3ULCGvo/RjlcU+fY8u3H8=; b=AOnxiokWRa5kAPtN0rMuljc05e9GLWi6F8BUwRVzSdcLq8yrO/21DROmrmVurAxB9/ yHNpWbHKO59FzD0hmaXzcAwbTVYMQ+JHLePTUcCEPCPjeXUAUK1BmXVhBnrBgiX8vh4c 8IhydRSVd8VQuPYLC+5GTGjMqhjt2oXpxDAaqN3Xf+JvpVjVHSd3wW4bbMMfUEELozM4 75/piD9Obua2Avd/UL9dCnd8ZI+IzjQMw+keJ/0G5SzwatY2vGv34gXsUEwPiLYtdYpf KfhjX/ONMCoFHD0WgBir+WSTG3xEPaT53rVtJwNG+/WrDtIVj2SV4mjMI0LHlYD2XGrO /eWA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=EBUDuw5g; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qb19-20020a1709077e9300b0093238e57508si18965859ejc.399.2023.03.22.07.37.52; Wed, 22 Mar 2023 07:38:15 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=EBUDuw5g; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229541AbjCVOdh (ORCPT + 99 others); Wed, 22 Mar 2023 10:33:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231176AbjCVOde (ORCPT ); Wed, 22 Mar 2023 10:33:34 -0400 Received: from mail-pg1-x54a.google.com (mail-pg1-x54a.google.com [IPv6:2607:f8b0:4864:20::54a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D037144A0 for ; Wed, 22 Mar 2023 07:33:04 -0700 (PDT) Received: by mail-pg1-x54a.google.com with SMTP id bc19-20020a656d93000000b005072b17a298so4694203pgb.14 for ; Wed, 22 Mar 2023 07:33:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1679495583; h=cc:to:from:subject:message-id:mime-version:date:reply-to:from:to:cc :subject:date:message-id:reply-to; bh=yd5LHdKukK1pcNHstBXl6O3ULCGvo/RjlcU+fY8u3H8=; b=EBUDuw5g01iFFCH1b88omE6dWIzcJJaRfXTxbZIzAYFmfNFThgOnrnl1Ubx3pgcNqq 8aZTv1erC/2+bXzaU26BCN4c+CX0AW5rRhKpZK23CUHzjjWb05rQzH1RYk95pfu9smIi +7x+nkalSgZbPi00VPojdUmeut+2QiltxKWsPIHXr7Cs6orE3wW+oACzqYL0CQQLeF9y SZm4gtjx4XB68qrTj4oSQ8DNVobr49+EtDWSTaPVwhfQFSghQD19aZA4AX74Uf7UTW/G R/JIaxWnQY5y4OTvKR3p+U7IjbXRdQsyII7PH0KWeH4xKvOnrGhCtvR7xeMBFypyWT9V 4axA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1679495583; h=cc:to:from:subject:message-id:mime-version:date:reply-to :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=yd5LHdKukK1pcNHstBXl6O3ULCGvo/RjlcU+fY8u3H8=; b=IRECb85qqyEW4UEtQY7ixI/bMYrTG08vz5/VmoNzf22KTVc8LypIXZczADw1xkvPC7 4zrEhyrV6BXIpICP86SJAPlxLVNToKXdOeQde8ijd7iveRXZzCUarmYaeyyoO84yeGIC Qj3TcgIaiITAVThax+da/SHUDJcWr+mZylz2rQJ1UOKvGhHbVRxFdvElcN1VV/YSCFzV v10Y70Yb58ExP9x69xSmtqBELsx7uNm2PjP0a0oF45QGV8bEvPNsmJzqCloFA+vRjYc+ UFwEyy5sfGxhyV9iLPNIOmTaYzcgACZfBz3xNLASUN1b9GNJujuaZRUNGJQAJY/6Lh6v A3WA== X-Gm-Message-State: AO0yUKXfh9G1xL2Bof18hniThcRjcgX0/SIwG27VMyrszIhzxw7lJAI2 7MuBLrP5F2SJ94QozF1IOwgLEx3YB20= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:244f:b0:623:7446:7075 with SMTP id d15-20020a056a00244f00b0062374467075mr1858312pfj.2.1679495583072; Wed, 22 Mar 2023 07:33:03 -0700 (PDT) Reply-To: Sean Christopherson Date: Wed, 22 Mar 2023 07:32:58 -0700 Mime-Version: 1.0 X-Mailer: git-send-email 2.40.0.rc2.332.ga46443480c-goog Message-ID: <20230322143300.2209476-1-seanjc@google.com> Subject: [PATCH 0/2] KVM: x86: Fix RM exception injection bugs From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Maxim Levitsky X-Spam-Status: No, score=-7.7 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1761079088207912744?= X-GMAIL-MSGID: =?utf-8?q?1761079088207912744?= Fix two bugs introduced by a semi-recent fix for AMD's Page Real Mode. Patch 1 was tested against the syzkaller testcase that exposed the bug[*]. Patch 2 was testing by enabling the VMware backdoor in L1 to turn on #GP interception, hacking L0 KVM to passthrough MSR_IA32_VMX_BASIC to L1 and then writing the MSR from L2 while in Real Mode, thus forcing L0 KVM to emulate the WRMSR from L2 and synthesiz a #GP VM-Exit into L1. Confirmed that bad behavior in L1 with an assertion: [*] https://lkml.kernel.org/r/ZBNrWZQhMX8AHzWM%40google.com Sean Christopherson (2): KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode arch/x86/kvm/vmx/nested.c | 7 ++++++- arch/x86/kvm/x86.c | 11 +++++++++-- 2 files changed, 15 insertions(+), 3 deletions(-) base-commit: 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index bcac3efcde41..ef3bb5ab9654 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -5178,6 +5178,9 @@ static int handle_exception_nmi(struct kvm_vcpu *vcpu) vect_info = vmx->idt_vectoring_info; intr_info = vmx_get_intr_info(vcpu); + WARN_ONCE((intr_info & INTR_INFO_DELIVER_CODE_MASK) && !is_protmode(vcpu), + "Exception VM-Exit shouldn't report error code when CPU is in Real Mode"); + /* * Machine checks are handled by handle_exception_irqoff(), or by * vmx_vcpu_run() if a #MC occurs on VM-Entry. NMIs are handled by