From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2C7D285419; Wed, 25 Feb 2026 01:00:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771981203; cv=none; b=gnc/BETjWmzPuC256E4rk/qOeF7TZQYB0Y7Pbovg+4TUZ9B/F1+Pegq8K4DpNVILLPm1yHOus6nlxU2Wu6IlnhrPAKDeFq2sQPS/R5b/XnCsPr3i5ZutsG2saNrxs8qcUimYz2XEsyLSvAzl2CYn9paAn7B8u2/nUMoaGIy7gOk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771981203; c=relaxed/simple; bh=FavqCuxwPI2jjEa8BSTc8DH2PtmtIb+TIzINQXl1X+w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GGR/ew6MtrqNx6fISbpT2PUIQImZqvgF89BL+lnh/HLSLPEGXSvkqDZUzXcRaObeGNEBQFqtgoeEbH2az300H+M3Tsnhw7LLtgRObZpF+1gQpTnB0Csc/x5OKgus3tluypUA7gWGr2xTA4OcCD/92z2fIFRzKU1vlS9o3s+0Soo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=J6r5QVWj; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="J6r5QVWj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DDFDC116D0; Wed, 25 Feb 2026 01:00:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1771981203; bh=FavqCuxwPI2jjEa8BSTc8DH2PtmtIb+TIzINQXl1X+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J6r5QVWjVceXFSgUpkcP7WbDG86YQWboasi78WVoxH+KyzKYjF5mjGoC0DdA8n3fX kEZF61o2RzlIwBsL+F51TmdSsGq+2rCZM1ys4ngJHi2FZJIoTKdTtLcg8IE8OkCqwQ taImdHlRXiVgSTPE0xWBaMZVSnA0ue3THP5lRVnvAkPkU2FqaIqzbhGthvEMjl2R7O 6Tc4PxkcswXCw5uJ0tnolNt00tf3FuyoLKOvE9KmCK6pfleE2SqJBYlQMdE3PGxouu 3NxmixNOeOjDLuv5pDLBtPy6XQm6TNJn70U5eUYRGhfnTZkVnKbhH7lc1sz+weJhR1 juaE3+nZKNVwg== From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH v3 7/8] KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Date: Wed, 25 Feb 2026 00:59:49 +0000 Message-ID: <20260225005950.3739782-8-yosry@kernel.org> X-Mailer: git-send-email 2.53.0.414.gf7e9f6c205-goog In-Reply-To: <20260225005950.3739782-1-yosry@kernel.org> References: <20260225005950.3739782-1-yosry@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In the save+restore path, when restoring nested state, the values of RIP and CS base passed into nested_vmcb02_prepare_control() are mostly incorrect. They are both pulled from the vmcb02. For CS base, the value is only correct if system regs are restored before nested state. The value of RIP is whatever the vCPU had in vmcb02 before restoring nested state (zero on a freshly created vCPU). Instead, take a similar approach to NextRIP, and delay initializing the RIP tracking fields until shortly before the vCPU is run, to make sure the most up-to-date values of RIP and CS base are used regardless of KVM_SET_SREGS, KVM_SET_REGS, and KVM_SET_NESTED_STATE's relative ordering. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 17 ++++++++--------- arch/x86/kvm/svm/svm.c | 10 ++++++++++ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index dcd4a8eb156f2..4499241b4e401 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -742,9 +742,7 @@ static bool is_evtinj_nmi(u32 evtinj) return type == SVM_EVTINJ_TYPE_NMI; } -static void nested_vmcb02_prepare_control(struct vcpu_svm *svm, - unsigned long vmcb12_rip, - unsigned long vmcb12_csbase) +static void nested_vmcb02_prepare_control(struct vcpu_svm *svm) { u32 int_ctl_vmcb01_bits = V_INTR_MASKING_MASK; u32 int_ctl_vmcb12_bits = V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK; @@ -856,14 +854,15 @@ static void nested_vmcb02_prepare_control(struct vcpu_svm *svm, vmcb02->control.next_rip = svm->nested.ctl.next_rip; svm->nmi_l1_to_l2 = is_evtinj_nmi(vmcb02->control.event_inj); + + /* + * soft_int_csbase, soft_int_old_rip, and soft_int_next_rip (if L1 + * doesn't have NRIPS) are initialized later, before the vCPU is run. + */ if (is_evtinj_soft(vmcb02->control.event_inj)) { svm->soft_int_injected = true; - svm->soft_int_csbase = vmcb12_csbase; - svm->soft_int_old_rip = vmcb12_rip; if (guest_cpu_cap_has(vcpu, X86_FEATURE_NRIPS)) svm->soft_int_next_rip = svm->nested.ctl.next_rip; - else - svm->soft_int_next_rip = vmcb12_rip; } /* LBR_CTL_ENABLE_MASK is controlled by svm_update_lbrv() */ @@ -961,7 +960,7 @@ int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmcb12_gpa, nested_svm_copy_common_state(svm->vmcb01.ptr, svm->nested.vmcb02.ptr); svm_switch_vmcb(svm, &svm->nested.vmcb02); - nested_vmcb02_prepare_control(svm, vmcb12->save.rip, vmcb12->save.cs.base); + nested_vmcb02_prepare_control(svm); nested_vmcb02_prepare_save(svm, vmcb12); ret = nested_svm_load_cr3(&svm->vcpu, svm->nested.save.cr3, @@ -1906,7 +1905,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, nested_copy_vmcb_control_to_cache(svm, ctl); svm_switch_vmcb(svm, &svm->nested.vmcb02); - nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.cs.base); + nested_vmcb02_prepare_control(svm); /* * While the nested guest CR3 is already checked and set by diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index ded4372f2d499..7948e601ea784 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3670,11 +3670,21 @@ static int pre_svm_run(struct kvm_vcpu *vcpu) * This is done here (as opposed to when preparing vmcb02) to use the * most up-to-date value of RIP regardless of the order of restoring * registers and nested state in the vCPU save+restore path. + * + * Simiarly, initialize svm->soft_int_* fields here to use the most + * up-to-date values of RIP and CS base, regardless of restore order. */ if (is_guest_mode(vcpu) && svm->nested.nested_run_pending) { if (boot_cpu_has(X86_FEATURE_NRIPS) && !guest_cpu_cap_has(vcpu, X86_FEATURE_NRIPS)) svm->vmcb->control.next_rip = kvm_rip_read(vcpu); + + if (svm->soft_int_injected) { + svm->soft_int_csbase = svm->vmcb->save.cs.base; + svm->soft_int_old_rip = kvm_rip_read(vcpu); + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_NRIPS)) + svm->soft_int_next_rip = kvm_rip_read(vcpu); + } } return 0; -- 2.53.0.414.gf7e9f6c205-goog