Re: [PATCH 0/5] kvm: fix latent guest entry/exit bugs

From: Paolo Bonzini
Date: Mon Jan 17 2022 - 12:45:45 EST


On 1/14/22 16:19, Mark Rutland wrote:
I also think there is another issue here. When an IRQ is taken from SIE, will
user_mode(regs) always be false, or could it be true if the guest userspace is
running? If it can be true I think tha context tracking checks can complain,
and it*might* be possible to trigger a panic().

I think that it would be false, because the guest PSW is in the SIE block and switched on SIE entry and exit, but I might be incorrect.

Paolo

In irqentry_enter(), if user_mode(regs) == true, we call
irqentry_enter_from_user_mode -> __enter_from_user_mode(). There we check that
the context is CONTEXT_USER, but IIUC that will be CONTEXT_GUEST at this point.
We also call arch_check_user_regs(), and IIUC this might permit a malicious
guest to trigger a host panic by way of debug_user_asce(), but I may have
misunderstood and that might not be possible.