[Devel] [PATCH RHEL7 COMMIT] ms/KVM: nVMX: Disallow VM-entry in MOV-SS shadow

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-957.10.1.vz7.85.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-957.10.1.vz7.85.7
------>
commit dacf7f48e6c6987a9fb0888c666b618febfbd496
Author: Jim Mattson <jmattson at google.com>
Date:   Mon Apr 1 15:31:50 2019 +0300

    ms/KVM: nVMX: Disallow VM-entry in MOV-SS shadow
    
    Immediately following MOV-to-SS/POP-to-SS, VM-entry is
    disallowed. This check comes after the check for a valid VMCS. When
    this check fails, the instruction pointer should fall through to the
    next instruction, the ALU flags should be set to indicate VMfailValid,
    and the VM-instruction error should be set to 26 ("VM entry with
    events blocked by MOV SS").
    
    Signed-off-by: Jim Mattson <jmattson at google.com>
    Signed-off-by: Radim Krčmář <rkrcmar at redhat.com>
    
    https://jira.sw.ru/browse/PSBM-92865
    (cherry picked from commit b3f1dfb6e818a2352c38e3e37bb983eae98621b5)
    
    Signed-off-by: Jan Dakinevich <jan.dakinevich at virtuozzo.com>
    Reviewed-by: Roman Kagan <rkagan at virtuozzo.com>
---
 arch/x86/kvm/vmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 69d7a5965f1b..4f0e649f46a8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10819,6 +10819,7 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
 {
 	struct vmcs12 *vmcs12;
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	u32 interrupt_shadow = vmx_get_interrupt_shadow(vcpu);
 	u32 exit_qual;
 	int ret;
 
@@ -10843,6 +10844,12 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
 	 * for misconfigurations which will anyway be caught by the processor
 	 * when using the merged vmcs02.
 	 */
+	if (interrupt_shadow & KVM_X86_SHADOW_INT_MOV_SS) {
+		nested_vmx_failValid(vcpu,
+				     VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS);
+		goto out;
+	}
+
 	if (vmcs12->launch_state == launch) {
 		nested_vmx_failValid(vcpu,
 			launch ? VMXERR_VMLAUNCH_NONCLEAR_VMCS