From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9ABF3C32792 for ; Thu, 3 Oct 2019 16:51:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6E9AF2070B for ; Thu, 3 Oct 2019 16:51:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570121498; bh=HkSEERbdu0ptmKFS8yZrxNwEEt/j0Egt1cU9AB/mPiM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=FTADZpm711jKCI8bqNQh4/t3EHY2X9BKhmJTblx3dsyOBWCSFR+RfUehGCdQUvb9Z 48RK6e7DJpQyVkpOoFAbYswChWLJbn2NyhZ+4vahdPZuHLfjD0a5+Hc79L2NcDg7Mp sFR1V1bExgBE47HcBrikdNr0MvHlFWKUGEGigBUM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2406058AbfJCQvh (ORCPT ); Thu, 3 Oct 2019 12:51:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:39000 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2406046AbfJCQve (ORCPT ); Thu, 3 Oct 2019 12:51:34 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 462B92070B; Thu, 3 Oct 2019 16:51:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570121493; bh=HkSEERbdu0ptmKFS8yZrxNwEEt/j0Egt1cU9AB/mPiM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LbvvILldClxxGGCRXyhw8vZQuHPHDKgvFUsFhrKHNYAIYgQ7sP87VhIQ/mnrtByA6 sbpaz89JqhRiLLfDyNZuPmWlwWa7CwJRpB3tZ1iUPvdmWE+gKs6Okn25SJbBoIIsM+ 2qxZdkJkV8cATof1o06rFwXGBh/tIAYpWlEtEtU0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Denis Lunev , Roman Kagan , Denis Plotnikov , Jan Dakinevich , Paolo Bonzini Subject: [PATCH 5.3 262/344] KVM: x86: always stop emulation on page fault Date: Thu, 3 Oct 2019 17:53:47 +0200 Message-Id: <20191003154606.313278078@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191003154540.062170222@linuxfoundation.org> References: <20191003154540.062170222@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jan Dakinevich commit 8530a79c5a9f4e29e6ffb35ec1a79d81f4968ec8 upstream. inject_emulated_exception() returns true if and only if nested page fault happens. However, page fault can come from guest page tables walk, either nested or not nested. In both cases we should stop an attempt to read under RIP and give guest to step over its own page fault handler. This is also visible when an emulated instruction causes a #GP fault and the VMware backdoor is enabled. To handle the VMware backdoor, KVM intercepts #GP faults; with only the next patch applied, x86_emulate_instruction() injects a #GP but returns EMULATE_FAIL instead of EMULATE_DONE. EMULATE_FAIL causes handle_exception_nmi() (or gp_interception() for SVM) to re-inject the original #GP because it thinks emulation failed due to a non-VMware opcode. This patch prevents the issue as x86_emulate_instruction() will return EMULATE_DONE after injecting the #GP. Fixes: 6ea6e84309ca ("KVM: x86: inject exceptions produced by x86_decode_insn") Cc: stable@vger.kernel.org Cc: Denis Lunev Cc: Roman Kagan Cc: Denis Plotnikov Signed-off-by: Jan Dakinevich Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -6528,8 +6528,10 @@ int x86_emulate_instruction(struct kvm_v if (reexecute_instruction(vcpu, cr2, write_fault_to_spt, emulation_type)) return EMULATE_DONE; - if (ctxt->have_exception && inject_emulated_exception(vcpu)) + if (ctxt->have_exception) { + inject_emulated_exception(vcpu); return EMULATE_DONE; + } if (emulation_type & EMULTYPE_SKIP) return EMULATE_FAIL; return handle_emulation_failure(vcpu, emulation_type);