KVM: SVM: avoid emulation with stale next_rip (e42c6828) · Commits · 戴 / test

svm->next_rip is reset in svm_vcpu_run() only after calling svm_exit_handlers_fastpath(), which will cause SVM's skip_emulated_instruction() to write a stale RIP. We can move svm_exit_handlers_fastpath towards the end of svm_vcpu_run(). To align VMX with SVM, keep svm_complete_interrupts() close as well. Suggested-by:

Sean Christopherson <sean.j.christopherson@intel.com> Cc: Paul K. <kronenpj@kronenpj.dyndns.org> Reviewed-by:

Vitaly Kuznetsov <vkuznets@redhat.com> Signed-off-by:

Wanpeng Li <wanpengli@tencent.com> [Also move vmcb_mark_all_clean before any possible write to the VMCB. - Paolo]

arch/x86/kvm/svm/svm.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -2938,8 +2938,6 @@ static int handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
		if (npt_enabled)
		vcpu->arch.cr3 = svm->vmcb->save.cr3;

		svm_complete_interrupts(svm);

		if (is_guest_mode(vcpu)) {
		int vmexit;

		@@ -3504,7 +3502,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu)
		stgi();

		/* Any pending NMI will happen here */
		exit_fastpath = svm_exit_handlers_fastpath(vcpu);

		if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
		kvm_after_interrupt(&svm->vcpu);
		@@ -3518,6 +3515,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu)
		}

		svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
		vmcb_mark_all_clean(svm->vmcb);

		/* if exit due to PF check for async PF */
		if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
		@@ -3537,7 +3535,8 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu)
		SVM_EXIT_EXCP_BASE + MC_VECTOR))
		svm_handle_mce(svm);

		vmcb_mark_all_clean(svm->vmcb);
		svm_complete_interrupts(svm);
		exit_fastpath = svm_exit_handlers_fastpath(vcpu);
		return exit_fastpath;
		}

Admin message