On 12/18/24 18:39, Sean Christopherson wrote:
I definitely think it's worth explaining that moving the detection covers new emulation cases, and also calling out that handle_ept_misconfig() consults vmx_check_emulate_instruction(), i.e. that moving the detection shouldn't affect KVM's overall handlng of EPT Misconfig.
--
Move handling of emulation during event vectoring, which KVM doesn't support, into VMX's check_emulate_instruction(), so that KVM detects all unsupported emulation, not just cached emulated MMIO (EPT misconfig). E.g. on emulated MMIO that isn't cached (EPT Violation) or occurs with legacy shadow paging (#PF).
Rejecting emulation on other sources of emulation also fixes a largely theoretical flaw (thanks to the "unprotect and retry" logic), where KVM could incorrectly inject a #DF:
- CPU executes an instruction and hits a #GP
- While vectoring the #GP, a shadow #PF occurs
- On the #PF VM-Exit, KVM re-injects #GP
- KVM emulates because of the write-protected page
- KVM "successfully" emulates and also detects the #GP
- KVM synthesizes a #GP, and since #GP has already been injected, incorrectly escalates to a #DF.
Fix the comment about EMULTYPE_PF as this flag doesn't necessarily mean MMIO anymore: it can also be set due to the write protection violation.
Note, handle_ept_misconfig() checks vmx_check_emulate_instruction() before attempting emulation of any kind.
Yeah, I thought that covering the change in non-cacheable MMIO / shadow paged #PF handling, but forgot to include it into the commit message :( Could you please fix the message when applying? The message you suggested looks good to me.
Thanks!