blob: 7ef068c39a8bb61d15ff3b7649aed97ceadbfd4d [file] [log] [blame]
From dd364b335e287b9d90aa10e0a84c28f75a9f5520 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <>
Date: Tue, 1 Oct 2019 09:21:23 -0700
Subject: [PATCH] KVM: nVMX: Fix consistency check on injected exception error
commit 567926cca99ba1750be8aae9c4178796bf9bb90b upstream.
Current versions of Intel's SDM incorrectly state that "bits 31:15 of
the VM-Entry exception error-code field" must be zero. In reality, bits
31:16 must be zero, i.e. error codes are 16-bit values.
The bogus error code check manifests as an unexpected VM-Entry failure
due to an invalid code field (error number 7) in L1, e.g. when injecting
a #GP with error_code=0x9f00.
Nadav previously reported the bug[*], both to KVM and Intel, and fixed
the associated kvm-unit-test.
Reported-by: Nadav Amit <>
Signed-off-by: Sean Christopherson <>
Reviewed-by: Jim Mattson <>
Signed-off-by: Paolo Bonzini <>
Signed-off-by: Paul Gortmaker <>
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 74ac35bbf1ef..22437ad335b0 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2567,7 +2567,7 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
/* VM-entry exception error code */
if (has_error_code &&
- vmcs12->vm_entry_exception_error_code & GENMASK(31, 15))
+ vmcs12->vm_entry_exception_error_code & GENMASK(31, 16))
return -EINVAL;
/* VM-entry interruption-info field: reserved bits */