[PATCH v3 1/2] KVM: nVMX: Reject nested VM-entry in a non-active state blocked by STI/MOV-SS

[<amirmohammad.eftekhar@cispa.de>]

From: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>

nested_check_guest_non_reg_state() only checks that guest_activity_state is
one of ACTIVE/HLT/WAIT_SIPI; it does not enforce the SDM's requirement that
the activity state indicate the active state when the interruptibility-state
field blocks by STI or MOV SS.  KVM cannot rely on hardware to catch the
miss: prepare_vmcs02() never writes GUEST_ACTIVITY_STATE, so vmcs02 always
carries the active state and the physical VMLAUNCH cannot reject the illegal
combination.  Add the cross-check.

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
---
 arch/x86/kvm/vmx/nested.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index b25216862740..6e2ec1912f12 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3311,6 +3311,11 @@ static int nested_check_guest_non_reg_state(struct vmcs12 *vmcs12)
 	       vmcs12->guest_activity_state != GUEST_ACTIVITY_WAIT_SIPI))
 		return -EINVAL;
 
+	if (CC(vmcs12->guest_activity_state != GUEST_ACTIVITY_ACTIVE &&
+	       (vmcs12->guest_interruptibility_info &
+		(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS))))
+		return -EINVAL;
+
 	return 0;
 }
 
-- 
2.34.1