Skip to content

KVM: nSVM: Fix RIP usage in the control area after restore

Yosry Ahmed kvm lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest4 patches 7 repliesIn review

Changes in v1 from the cover letter

- Only set NextRIP in vmcb02 if supported by the CPU [Sean].
- Rework the fixes to delay using RIP and CS base until before VMRUN, instead of fixing up the fields using them when RIP or CS is set [Sean].

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/4KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUNarch/x86/kvm/svm/nested.c+16 -90 replies
2/4KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU runarch/x86/kvm/svm/nested.c arch/x86/kvm/svm/svm.c+26 -177 replies
3/4KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU runarch/x86/kvm/svm/nested.c arch/x86/kvm/svm/svm.c+18 -90 replies
4/4DO NOT MERGE: KVM: selftests: Reproduce nested RIP restore bugtools/testing/selftests/kvm/lib/x86/processor.c tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c+61 -160 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH v1 0/4] KVM: nSVM: Fix RIP usage in the control area after restore

Fix a few bugs in using L2's RIP to construct fields in vmcb02 after save+restore. The main problem is that the vmcb12_rip (and maybe vmcb12_cs_base) values passed to nested_vmcb02_prepare_control() in the restore path are broken.

The series fixes that by delaying initializing the fields depending on RIP and CS base until shortly before VMRUN, to use the most up-to-date fields regardless of save+restore order.

It also fixes another bug where using vmcb12_rip is incorrect, even if it was restored correctly (patch 1).

Patch 4 is a reproducer, not intended for merging. It modifies svm_nested_soft_inject_test to reproduce the bug.

RFC -> v1:
- Only set NextRIP in vmcb02 if supported by the CPU [Sean].
- Rework the fixes to delay using RIP and CS base until before VMRUN, instead of fixing up the fields using them when RIP or CS is set [Sean].

RFC: https://lore.kernel.org/kvm/[email protected]/

Yosry Ahmed (4):
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run DO NOT MERGE: KVM: selftests: Reproduce nested RIP restore bug

 arch/x86/kvm/svm/nested.c                     | 35 ++++-----
 arch/x86/kvm/svm/svm.c                        | 28 +++++++
 .../testing/selftests/kvm/lib/x86/processor.c |  3 +
 .../kvm/x86/svm_nested_soft_inject_test.c     | 74 +++++++++++++++----
 4 files changed, 105 insertions(+), 35 deletions(-)

base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49

Signature · 1 line
2.53.0.345.g96ddfc5eaa-goog