[PATCH v3 2/2] KVM: nVMX: Reject nested VM-entry in wait-for-SIPI with a pending event injection

[<amirmohammad.eftekhar@cispa.de>]

From: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>

The SDM allows no interruptions in the wait-for-SIPI activity state, but
nested_check_guest_non_reg_state() accepts a vmcs12 with WAIT_SIPI and a valid
VM-entry interruption-information field.  Hardware does not catch it: KVM
emulates wait-for-SIPI in software only after a successful entry (the mp_state
= INIT_RECEIVED arm) while the injection is copied into vmcs02, so the physical
VMLAUNCH sees {active, valid injection} -- a legal pair -- and succeeds.  From
L1's point of view a VMLAUNCH that bare metal rejects with a VM-entry failure
instead succeeds, with L2 parked in wait-for-SIPI holding a stale
VM_ENTRY_INTR_INFO.  Reject the combination.

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
---
 arch/x86/kvm/vmx/nested.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 6e2ec1912f12..d98d33234e9f 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3316,6 +3316,10 @@ static int nested_check_guest_non_reg_state(struct vmcs12 *vmcs12)
 		(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS))))
 		return -EINVAL;
 
+	if (vmcs12->guest_activity_state == GUEST_ACTIVITY_WAIT_SIPI &&
+	    CC(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK))
+		return -EINVAL;
+
 	return 0;
 }
 
-- 
2.34.1