KVM: prevent spurious exit to userspace during task switch emulation.
PATCH 1/1 KVM: prevent spurious exit to userspace during task switch emulation.
kvm_task_switch() never requires userspace exit, so no matter what the function returns we should not exit to userspace.
Signed-off-by Gleb Natapov <[email protected]>
arch/x86/kvm/svm.c +2 -1
@@ -2254,7 +2254,8 @@ static int task_switch_interception(struct vcpu_svm *svm) (int_vec == OF_VECTOR || int_vec == BP_VECTOR)))skip_emulated_instruction (&svm->vcpu); -return kvm_task_switch (&svm->vcpu, tss_selector, reason); +kvm_task_switch (&svm->vcpu, tss_selector, reason); +return 1 ; }static int cpuid_interception (struct vcpu_svm *svm)
arch/x86/kvm/vmx.c +1 -2
@@ -3306,8 +3306,7 @@ static int handle_task_switch(struct kvm_vcpu *vcpu) type != INTR_TYPE_NMI_INTR))skip_emulated_instruction (vcpu); -if (!kvm_task_switch (vcpu, tss_selector, reason)) -return 0 ; +kvm_task_switch (vcpu, tss_selector, reason);/* clear all local breakpoint enable flags */ vmcs_writel (GUEST_DR7 ,vmcs_readl (GUEST_DR7 ) & ~55 );
--
Gleb.
Quoted 24 lines · Gleb Natapov
kvm_task_switch()never requires userspace exit, so no matter what the function returns we should not exit to userspace.Signed-off-by Gleb Natapov<[email protected]>arch/x86/kvm/svm.c +2
-1@@ -2254,7 +2254,8 @@ static int task_switch_interception(struct vcpu_svm *svm) (int_vec == OF_VECTOR || int_vec == BP_VECTOR)))skip_emulated_instruction (&svm->vcpu); -return kvm_task_switch (&svm->vcpu, tss_selector, reason); +kvm_task_switch (&svm->vcpu, tss_selector, reason); +return 1 ; }static int cpuid_interception (struct vcpu_svm *svm)arch/x86/kvm/vmx.c +0
-0
arch/x86/kvm/vmx.c static int handle_task_switch(struct kvm_vcpu *vcpu) · line 3311
Quoted 8 lines
arch/x86/kvm/vmx.c +1
-2@@ -3306,8 +3306,7 @@ static int handle_task_switch(struct kvm_vcpu *vcpu) type != INTR_TYPE_NMI_INTR))skip_emulated_instruction (vcpu); -if (!kvm_task_switch (vcpu, tss_selector, reason)) -return 0 ; +kvm_task_switch (vcpu, tss_selector, reason);
Ignoring the return seems wrong. At the very least log errors in dmesg (rate-limited).
Signature · 2 lines
I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain.