KVM: x86: Assert that the emulator doesn't load CS with garbage in !RM

[PATCH] KVM: x86: Assert that the emulator doesn't load CS with garbage in !RM

Posted by Sean Christopherson 2 years, 6 months ago

Yell loudly if KVM attempts to load CS outside of Real Mode without an
accompanying control transfer type, i.e. on X86_TRANSFER_NONE.  KVM uses
X86_TRANSFER_NONE when emulating IRET and exceptions/interrupts for Real
Mode, but IRET emulation for Protected Mode is non-existent.  WARN instead
of trying to pass in a less-wrong type, e.g. X86_TRANSFER_RET, as
emulating IRET goes even beyond emulating FAR RET (which KVM also doesn't
fully support).

Reported-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/emulate.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index baf97c56aefa..07e5f473f6fe 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1640,6 +1640,14 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
 			goto exception;
 		break;
 	case VCPU_SREG_CS:
+		/*
+		 * KVM uses "none" when loading CS as part of emulating Real
+		 * Mode exceptions and IRET (handled above).  In all other
+		 * cases, loading CS without a control transfer is a KVM bug.
+		 */
+		if (WARN_ON_ONCE(transfer == X86_TRANSFER_NONE))
+			goto exception;
+
 		if (!(seg_desc.type & 8))
 			goto exception;
 

base-commit: 62ef199250cd46fb66fe98267137b7f64e0b41b4
-- 
2.39.2.637.g21b0678d19-goog

Re: [PATCH] KVM: x86: Assert that the emulator doesn't load CS with garbage in !RM

Posted by Sean Christopherson 2 years, 5 months ago

On Thu, 16 Feb 2023 12:22:54 -0800, Sean Christopherson wrote:
> Yell loudly if KVM attempts to load CS outside of Real Mode without an
> accompanying control transfer type, i.e. on X86_TRANSFER_NONE.  KVM uses
> X86_TRANSFER_NONE when emulating IRET and exceptions/interrupts for Real
> Mode, but IRET emulation for Protected Mode is non-existent.  WARN instead
> of trying to pass in a less-wrong type, e.g. X86_TRANSFER_RET, as
> emulating IRET goes even beyond emulating FAR RET (which KVM also doesn't
> fully support).
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/1] KVM: x86: Assert that the emulator doesn't load CS with garbage in !RM
      https://github.com/kvm-x86/linux/commit/65966aaca18a

--
https://github.com/kvm-x86/linux/tree/next
https://github.com/kvm-x86/linux/tree/fixes