From: Hao Zhang RSM can restore state that indicates the vCPU was running L2 when SMI arrived. KVM then re-enters nested guest mode and marks nested_run_pending so that the next KVM_RUN completes the pending nested transition. Unlike a normal nested VMLAUNCH/VMRESUME, the state restored by RSM comes from SMRAM. Userspace can modify SMRAM before RSM. The resulting L2 state may require invalid-guest-state emulation. If KVM trusts that pending run, VMX can synthesize EXIT_REASON_INVALID_STATE before hardware VM-Entry completes the pending run and trip the nested_run_pending invariant. Do not treat an RSM-created pending nested run as KVM-trusted state. Mark the run as KVM_NESTED_RUN_PENDING_UNTRUSTED for both VMX and SVM, matching the existing userspace-modified-state handling in kvm_x86_vcpu_pre_run(). Fixes: 2bb8cafea80b ("KVM: vVMX: signal failure for nested VMEntry if emulation_required") Suggested-by: Sean Christopherson Signed-off-by: Hao Zhang --- Changes in v2: - Mark nested state restored by RSM from SMRAM as KVM_NESTED_RUN_PENDING_UNTRUSTED. - Keep the BUG check in __vmx_handle_exit(), but make it apply only to KVM_NESTED_RUN_PENDING. Link to v1: https://lore.kernel.org/all/al3Qbq-jUYE-_72N@192.168.1.215/ arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/vmx/vmx.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 4d2bacd00ec4..f54757bd8382 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5096,7 +5096,7 @@ static int svm_leave_smm(struct kvm_vcpu *vcpu, const union kvm_smram *smram) goto unmap_save; ret = 0; - vcpu->arch.nested_run_pending = KVM_NESTED_RUN_PENDING; + vcpu->arch.nested_run_pending = KVM_NESTED_RUN_PENDING_UNTRUSTED; unmap_save: kvm_vcpu_unmap(vcpu, &map_save); diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index cc75feec05da..333072cc9bce 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -6720,7 +6720,8 @@ static int __vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath) * invalid guest state should never happen as that means KVM knowingly * allowed a nested VM-Enter with an invalid vmcs12. More below. */ - if (KVM_BUG_ON(vcpu->arch.nested_run_pending, vcpu->kvm)) + if (KVM_BUG_ON(vcpu->arch.nested_run_pending == KVM_NESTED_RUN_PENDING, + vcpu->kvm)) return -EIO; if (is_guest_mode(vcpu)) { @@ -8436,7 +8437,7 @@ int vmx_leave_smm(struct kvm_vcpu *vcpu, const union kvm_smram *smram) if (ret != NVMX_VMENTRY_SUCCESS) return 1; - vcpu->arch.nested_run_pending = KVM_NESTED_RUN_PENDING; + vcpu->arch.nested_run_pending = KVM_NESTED_RUN_PENDING_UNTRUSTED; vmx->nested.smm.guest_mode = false; } return 0; base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb -- 2.15.0