kvm: nVMX: Fix fault priority for VMX operations

When checking emulated VMX instructions for faults, the #UD for "IF
(not in VMX operation)" should take precedence over the #GP for "ELSIF
CPL > 0."

Suggested-by: Eric Northup <digitaleric@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index d19bb602ff07f96281fe9230e95b280ebb2c134d..ccc9d75124a6096dc0e1afb5216de31ac7829b6a 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8159,15 +8159,16 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
  */
 static int nested_vmx_check_permission(struct kvm_vcpu *vcpu)
 {
-       if (vmx_get_cpl(vcpu)) {
-               kvm_inject_gp(vcpu, 0);
+       if (!to_vmx(vcpu)->nested.vmxon) {
+               kvm_queue_exception(vcpu, UD_VECTOR);
                return 0;
        }
 
-       if (!to_vmx(vcpu)->nested.vmxon) {
-               kvm_queue_exception(vcpu, UD_VECTOR);
+       if (vmx_get_cpl(vcpu)) {
+               kvm_inject_gp(vcpu, 0);
                return 0;
        }
+
        return 1;
 }