]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
KVM: VMX: Handle event vectoring error in check_emulate_instruction()
authorIvan Orlov <iorlov@amazon.com>
Tue, 17 Dec 2024 18:14:55 +0000 (18:14 +0000)
committerSean Christopherson <seanjc@google.com>
Wed, 18 Dec 2024 23:14:44 +0000 (15:14 -0800)
commit47ef3ef843c0f6e8006094d707b4aac18ed87e53
tree9396cb9c42eff76308ffcfbfe3e3156c219e8748
parent704fc6021b9ecd1e5db4c099bb8ed226760d2159
KVM: VMX: Handle event vectoring error in check_emulate_instruction()

Move handling of emulation during event vectoring, which KVM doesn't
support, into VMX's check_emulate_instruction(), so that KVM detects
all unsupported emulation, not just cached emulated MMIO (EPT misconfig).
E.g. on emulated MMIO that isn't cached (EPT Violation) or occurs with
legacy shadow paging (#PF).

Rejecting emulation on other sources of emulation also fixes a largely
theoretical flaw (thanks to the "unprotect and retry" logic), where KVM
could incorrectly inject a #DF:

  1. CPU executes an instruction and hits a #GP
  2. While vectoring the #GP, a shadow #PF occurs
  3. On the #PF VM-Exit, KVM re-injects #GP
  4. KVM emulates because of the write-protected page
  5. KVM "successfully" emulates and also detects the #GP
  6. KVM synthesizes a #GP, and since #GP has already been injected,
     incorrectly escalates to a #DF.

Fix the comment about EMULTYPE_PF as this flag doesn't necessarily
mean MMIO anymore: it can also be set due to the write protection
violation.

Note, handle_ept_misconfig() checks vmx_check_emulate_instruction() before
attempting emulation of any kind.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Ivan Orlov <iorlov@amazon.com>
Link: https://lore.kernel.org/r/20241217181458.68690-5-iorlov@amazon.com
[sean: massage changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
arch/x86/include/asm/kvm_host.h
arch/x86/kvm/vmx/vmx.c