[Bug 216033] KVM VMX nested virtualization: VMXON does not check guest CR0 against IA32_VMX_CR0_FIXED0

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=216033

Sean Christopherson (seanjc@google.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |seanjc@google.com

--- Comment #1 from Sean Christopherson (seanjc@google.com) ---
Ugh, KVM is comically wrong.  It _deliberately_ avoids checking CR0/CR4 with a
comment saying that "most faulting conditions have already been checked by
hardware", but the SDM pseudocode makes it very clear that only the (CR0.PE =
0) or (CR4.VMXE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
checks are performed before the VM-Exit occurs.

        /*
         * The Intel VMX Instruction Reference lists a bunch of bits that are
         * prerequisite to running VMXON, most notably cr4.VMXE must be set to
         * 1 (see vmx_is_valid_cr4() for when we allow the guest to set this).
         * Otherwise, we should fail with #UD.  But most faulting conditions
         * have already been checked by hardware, prior to the VM-exit for
         * VMXON.  We do test guest cr4.VMXE because processor CR4 always has
         * that bit set to 1 in non-root mode.
         */
        if (!kvm_read_cr4_bits(vcpu, X86_CR4_VMXE)) {
                kvm_queue_exception(vcpu, UD_VECTOR);
                return 1;
        }

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.