From nobody Fri Oct 23 15:32:29 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1790881561; cv=none; d=zohomail.com; s=zohoarc; b=IhNJow+8FNc+r4g5uhAl55U1JV0aVC5iZgYTz29HEpJemBR6x3X6FOups+yJ7IPsOfVEjbfjjgu3gTDiMTlYf2joFEvhnQkofpyWhWANVbpVUbQVH/B88pPC7q7QnCyIsw2nOVybGwVTU1lfhQCReZx+mGnspUq+gRfOEjPufQs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790881561; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FIVa2PiOVK72PchuP6HMQQz39IJEJGCAfEAUandj3qM=; b=X3nUVyZkKyGuh8XjBRwhF5CyY1iHLbMOY//zzBiV6uZNhsVGVCaptcpSlw73ex3hadkz6etSlaiuOw7nAjrHNWySu3JZZmikNCBxNTVaQWoLPyfJ6Qbc3hwAOTwEFpa6hjUoZWjEmywhEZ0c0ql/DwBZJ0R0ewGYuT9f9ZQlyJY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1790881561347251.95612406708437; Thu, 1 Oct 2026 12:06:01 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1438699.1657356 (Exim 4.92) (envelope-from ) id 1xCM5w-00023Q-F3; Thu, 01 Oct 2026 19:05:28 +0000 Received: by outflank-mailman (output) from mailman id 1438699.1657356; Thu, 01 Oct 2026 19:05:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xCM5w-00023J-Bv; Thu, 01 Oct 2026 19:05:28 +0000 Received: by outflank-mailman (input) for mailman id 1438699; Thu, 01 Oct 2026 19:05:27 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) id 1xCM5v-00023D-BA for xen-devel@lists.xenproject.org; Thu, 01 Oct 2026 19:05:27 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xCM5u-00FPDP-OM for xen-devel@lists.xenproject.org; Thu, 01 Oct 2026 21:05:26 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6abeaeda-2eae-0a2a0a5409dd-0a2a4503b20e-48 for ; Thu, 01 Oct 2026 21:05:26 +0200 Received: from [74.125.225.99] (helo=mail-wr2-f35.google.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6abeaef1-fae8-0a2a45030019-4a7de1638482-3 for ; Thu, 01 Oct 2026 21:05:21 +0200 Received: by mail-wr2-f35.google.com with SMTP id ffacd0b85a97d-482f63546c5so6094238f8f.2 for ; Thu, 01 Oct 2026 12:05:21 -0700 (PDT) Received: from localhost.localdomain (host-78-146-248-75.as13285.net. [78.146.248.75]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48b38306dd4sm204087f8f.43.2026.10.01.12.05.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Oct 2026 12:05:20 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=citrix.com header.i="@citrix.com" header.h="Content-Transfer-Encoding:Content-Type:MIME-Version:Message-Id:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1790881521; x=1791486321; darn=lists.xenproject.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=FIVa2PiOVK72PchuP6HMQQz39IJEJGCAfEAUandj3qM=; b=eJr5z3JFWqGCG7oVn8qXNLsmU399LxlcSbrrnMggrGXziJrZOsqYV9EA9wWILl/rof R2TLKHQBxEU6tgWhR6TvmTa0L7top14acDfU+DZP6K3/jPEjvoGvnt7g7HMhlAqwsOPM fDM8dtjA6mSuE92D3AAy9rtLsS3eU3aJNATIo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790881521; x=1791486321; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=FIVa2PiOVK72PchuP6HMQQz39IJEJGCAfEAUandj3qM=; b=cbi45I/7tmBVPoOrfD+9HS+jUwd21viT6bM85rFTx+amJ4jk+9kkcPy53+Cqh1swnz a/Tzz6Wsun0xmLSMmmZH56aCuDU3amgZg724NZtxT0JfhGi8jXfFkzBr5DmEl4k1pzp5 utaUO8EBOQs7Dd0WhsP+9MrHZCEzC+rfZeXOBaK+oiq7jJsa5VDPNj4/KF4Jr6nHLkl5 cNdj9DHDRXKPXWrFHRkCiNCEKuiWFqT/C7eumFEWbdzN/FUzKgrvmnGCUAxvswldv4gC ONQf5PLqyZ9kO89T7ShAUZD+xDfJgAyV+4lBoY0d2nhFFs0XJPuRNHW/fqRSAF4IafeJ 6Cmw== X-Gm-Message-State: AFq9FYLmFhd19xZ0K30CBVP4cJGSrQo/PlNLQUNRMTsIxff1vJIjNCGz 9wQGTxi9MSddr12la1q3qagb+wJsm4saozNu7GNtffspFi40dctrKXL9wwiK9PiiPnTnH/p8MwE vjKRbW1I= X-Gm-Gg: AYBFou2qbRo9K+sL526jNYJnS1qs0akVIEp0fghABZhYDZmJ3XynLDnsr4jYPtOtW06 OlLCPh1tQlOv5vmBPt/uIfsVCM0KpmKRNhuDZH+0GOyfIot1qcpWVaBJkRX6MmavrJDcPHjXHo+ Xl06ISmbl++BSO3VZ74tL2P7W29d078P6fK5UcndGbiBQeYLXC0rmheF9yCZgs/jAFr706NGvUD Z403486qJTuJ1aUDJ70K5XdVb96BHFDTm6HAfQpj0soQDpEP3p/U8Pjj677/HdfNzw5vFRXI43C iqHYo+qcXlgq7ed95zcmaTyDlv/1mhURZzsHEOZPfsX6LMVw5XRIkT8TJqNEMOfEdqJvjkXr/ux Q/H3c1ZhoScfT/5to277RmHNirBmD8C+uUJ5ImNYBxVLQVxLTL0kpr0G57OmZp1AQ556WoWwa23 f+zyEUqVDKxciki+sbdCtHapN51sGpPfBh1wqUdUIh/h7bDM4qDP1LpYutXdke4yLRg9CFbMSRp Jjvd/7JeJfMaYnshPKyXzE+1Su73hjGK4VchnjsSKMAFgot X-Received: by 2002:a05:6000:4694:b0:48a:fbcf:6f43 with SMTP id ffacd0b85a97d-48b1276e0d5mr554389f8f.54.1790881520893; Thu, 01 Oct 2026 12:05:20 -0700 (PDT) From: Andrew Cooper To: Xen-devel Cc: Andrew Cooper , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Teddy Astie , Jason Andryuk , Ross Lagerwall , Doug Covelli , Sean Christopherson , Paolo Bonzini , Borislav Petkov , David Kaplan , David Woodhouse , Shivansh Dhiman , Nikunj Dadhania , Santosh Shukla Subject: [PATCH] x86/svm: Work around VMRUN's corruption of VMCB.INTR_SHADOW Date: Thu, 1 Oct 2026 20:05:18 +0100 Message-Id: <20261001190518.438643-1-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-purgate-ID: tlsNG-33051d/1790881526-76CF84E9-72E7AA16/10/78276251493 X-purgate-type: spam X-purgate-size: 5580 X-ZohoMail-DKIM: pass (identity @citrix.com) X-ZM-MESSAGEID: 1790881563099158500 I was asked me to explain the comment beside STI in the svm_asm_do_resume(), and, in trying to do so, things unravelled. The original fix inherited from KVM prevented the guests INTR_SHADOW being changed from 0 to 1. This prevents undue delay to interrupts, but it caused the value to get changed from 1 to 0 if the guest was in an INTR_SHADOW. Whether this matters for IDT guests is unknown; it depends on what else VMR= UN can do beside event injection and still write back the wrong value. This d= oes matter for FRED guests, as INTR_SHADOW is exposed architecturally in the FR= ED frame via the STB field. Fixes: c989ff614f6b ("x86/svm: Separate STI and VMRUN instructions in svm_a= sm_do_resume()") Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monn=C3=A9 CC: Teddy Astie CC: Jason Andryuk CC: Ross Lagerwall CC: Doug Covelli CC: Sean Christopherson CC: Paolo Bonzini CC: Borislav Petkov CC: David Kaplan CC: David Woodhouse CC: Shivansh Dhiman CC: Nikunj Dadhania CC: Santosh Shukla AMD have confirmed this is broken back to at least Zen1. Hopefully an erra= tum will be issued. Slightly RFC. I don't currently have a Venice system to demonstrate the FR= ED part of this. CC-ing the KVM folk and AMD FRED folk too, as someone will presumably want to adapt this fix. Concerning encrypted VMs, there is no fix; INTR_SHADOW is encrypted state which the VMM can't access. --- xen/arch/x86/hvm/svm/entry.S | 40 ++++++++++++++++++++++++------- xen/arch/x86/x86_64/asm-offsets.c | 9 +++++++ 2 files changed, 41 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/hvm/svm/entry.S b/xen/arch/x86/hvm/svm/entry.S index d9613a2a8fed..99a98050793f 100644 --- a/xen/arch/x86/hvm/svm/entry.S +++ b/xen/arch/x86/hvm/svm/entry.S @@ -57,6 +57,37 @@ __UNLIKELY_END(nsvm_hap) =20 clgi =20 + /* + * Interrupts need enabling prior to VMRUN. Anywhere after CLGI is + * safe. + * + * On all Zen CPUs to date, VMRUN has a bug and mixes up the host = and + * guest INTR_SHADOW state. If there is a VMExit during VMRUN + * (e.g. taking NPT_FAULT during event injection), then the host's + * INTR_SHADOW gets written back into the VMCB, corrupting guest + * state. + * + * This is believed to go unnoticed for pre-FRED guests (injecting + * events cancels INTR_SHADOW), but FRED changes this behaviour to= be + * able to observe and restore the shadow via the STB field in a F= RED + * frame. + * + * In order to fix, arrange for Xen's INTR_SHADOW at the point of + * VMRUN to match the guest's INTR_SHADOW. This way, if a VMExit + * occurs, the VMCB is corrupted with the "correct" value. + * + * Commonly the guest will not be in an INTR_SHADOW. In this case, + * execute STI early to get Xen's INTR_SHADOW over and done with; = the + * second STI does nothing as INTR_SHADOW only occurs when IF chan= ges + * from 0 to 1. If the guest is in an INTR_SHADOW, skip the early= STI + * so the late STI does trigger INTR_SHADOW and cover VMRUN. + */ + mov VCPU_svm_vmcb(%rbx), %rax + testb $1, VMCB_int_stat(%rax) + jnz 1f + sti +1: + /* WARNING! `ret`, `call *`, `jmp *` not safe beyond this point. */ /* SPEC_CTRL_EXIT_TO_SVM Req: b=3Dcurr %rsp=3Dregs/cpuinfo, = Clob: acd */ .macro svm_vmentry_spec_ctrl @@ -74,19 +105,12 @@ __UNLIKELY_END(nsvm_hap) ALTERNATIVE "", svm_vmentry_spec_ctrl, X86_FEATURE_SC_MSR_HVM ALTERNATIVE "", DO_SPEC_CTRL_DIV, X86_FEATURE_SC_DIV =20 - /* - * Set EFLAGS.IF after CLGI covers us from real interrupts, but not - * immediately prior to VMRUN. The VMRUN instruction leaks it's - * INTR_SHADOW into guest state if a VMExit occurs before VMRUN - * completes (e.g. taking #NPF during event injecting.) - */ - sti - mov VCPU_svm_vmcb_pa(%rbx),%rax POP_GPRS skip_rax=3D1 /* %rax restored by VMRUN. */ =20 SPEC_CTRL_COND_VERW /* Req: %rsp=3Deframe C= lob: efl */ =20 + sti vmrun =20 PUSH_AND_CLEAR_GPRS diff --git a/xen/arch/x86/x86_64/asm-offsets.c b/xen/arch/x86/x86_64/asm-of= fsets.c index baf266ab8013..4872ef89b0df 100644 --- a/xen/arch/x86/x86_64/asm-offsets.c +++ b/xen/arch/x86/x86_64/asm-offsets.c @@ -21,6 +21,10 @@ # include "../boot/video.h" #endif =20 +#ifdef CONFIG_AMD_SVM +# include "../hvm/svm/vmcb.h" +#endif + #define DEFINE(_sym, _val) = \ asm volatile ( "\n.ascii\"=3D=3D>#define " #_sym " %0 /* " #_val " */<= =3D=3D\""\ :: "i" (_val) ) @@ -133,6 +137,11 @@ void __dummy__(void) BLANK(); #endif =20 +#ifdef CONFIG_AMD_SVM + OFFSET(VMCB_int_stat, struct vmcb_struct, int_stat); + BLANK(); +#endif + #ifdef CONFIG_PV32 OFFSET(DOMAIN_is_32bit_pv, struct domain, arch.pv.is_32bit); BLANK(); base-commit: f9b72572c8d5b6d312fd0b5014f65bed20efac40 --=20 2.39.5