[PATCH v3 1/2] KVM: x86: Fix sign-extension of the INT n vector in the emulator

[PATCH v3 1/2] KVM: x86: Fix sign-extension of the INT n vector in the emulator

[Kayra Cizmeci]

Currently the INT n operand use SrcImmByte which translates vectors
above 127 to negative numbers. And this negative numbers gets to
(vector << 2) and from there vector are handed and without any
warnings.

Use SrcImmUByte so the vector never translates to negative.

Signed-off-by: Kayra Cizmeci <kayracizmeci@gmail.com>
---
v1: adds IDT limit check to __emulate_int_real(), link:
https://lore.kernel.org/kvm/20260608123503.23298-1-kayracizmeci@gmail.com/
v2: fixes the sign-extension of INT n, link:
https://lore.kernel.org/kvm/20260608134642.25849-1-kayracizmeci@gmail.com/
v3: rewrote commit messages, split 1 commit into 2 commits and rebased
onto current mainline.

 arch/x86/kvm/emulate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index b566ab5c7515..ec3138801bb7 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4314,7 +4314,7 @@ static const struct opcode opcode_table[256] = {
 	I(Stack, em_leave),
 	I(ImplicitOps | SrcImmU16 | IsBranch | ShadowStack, em_ret_far_imm),
 	I(ImplicitOps | IsBranch | ShadowStack, em_ret_far),
-	D(ImplicitOps | IsBranch), DI(SrcImmByte | IsBranch | ShadowStack, intn),
+	D(ImplicitOps | IsBranch), DI(SrcImmUByte | IsBranch | ShadowStack, intn),
 	D(ImplicitOps | No64 | IsBranch),
 	II(ImplicitOps | IsBranch | ShadowStack, em_iret, iret),
 	/* 0xD0 - 0xD7 */
-- 
2.53.0

[PATCH v3 2/2] KVM: x86: Add limit check to IDT in __emulate_int_real()

[Kayra Cizmeci]

Currently there are no limit check at __emulate_int_real(),
and normally greater numbers than the IDT limits needs to
cause a #GP, but currently there is no limit check for doing that.

So add a limit check for IDT to catch greater numbers than the IDT
limit and if the number is greater than the IDT limit inject a #GP.

Signed-off-by: Kayra Cizmeci <kayracizmeci@gmail.com>
---
v1: adds IDT limit check to __emulate_int_real(), link:
https://lore.kernel.org/kvm/20260608123503.23298-1-kayracizmeci@gmail.com/
v2: fixes the sign-extension of INT n, link:
https://lore.kernel.org/kvm/20260608134642.25849-1-kayracizmeci@gmail.com/
v3: rewrote commit messages, split 1 commit into 2 commits and rebased
onto current mainline.

 arch/x86/kvm/emulate.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index ec3138801bb7..68d099131d47 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2023,7 +2023,11 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
 	gva_t eip_addr;
 	u16 cs, eip;
 
-	/* TODO: Add limit checks */
+	ops->get_idt(ctxt, &dt);
+
+	if (dt.size < (irq << 2) + 3)
+		return emulate_gp(ctxt, 0);
+
 	ctxt->src.val = ctxt->eflags;
 	rc = em_push(ctxt);
 	if (rc != X86EMUL_CONTINUE)
@@ -2041,8 +2045,6 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
 	if (rc != X86EMUL_CONTINUE)
 		return rc;
 
-	ops->get_idt(ctxt, &dt);
-
 	eip_addr = dt.address + (irq << 2);
 	cs_addr = dt.address + (irq << 2) + 2;
 
-- 
2.53.0

Re: [PATCH v3 2/2] KVM: x86: Add limit check to IDT in __emulate_int_real()

[Kayra Cizmeci]

Gentle Ping.

Re: [PATCH v3 2/2] KVM: x86: Add limit check to IDT in __emulate_int_real()

[Kayra Cizmeci]

Gentle Ping, :-)