From nobody Wed Feb 11 02:05:35 2026 Received: from out-170.mta1.migadu.com (out-170.mta1.migadu.com [95.215.58.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F21901A254E for ; Tue, 10 Feb 2026 00:55:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770684919; cv=none; b=bsbhqDmTz00rT4H/7NKZDj8yZqBiRQ+2rJI/V7rFeXxViq7Ej7o3IeE8AxpQbHCOQzxnnSU1v5rVLqax/Mtv78XEDmtsQ3yGfxWdUBI0SztTuIeqnhDWOWfxOfCsKrQ5AJ/6hGBUEhojTFwgxxny4+vZRC2nliJfLe64vwgIprQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770684919; c=relaxed/simple; bh=0xYTA5O8n2Un7nIegn4K2tJVnxu5c3fQRxZ2nWTeMVI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oHRnCxQGzMlYn8oUTYpNdfP/+BC+ENEUEX7WPgp09++yVechAwnyRf9CrmT6UMxDDyeItKjUZGIo12Q2/SyPKdTFNW2E0uBclc6HcjAAHUfGyTdkCaFLLRIsahTEohsRzWFj2D4hOeyME25VCGyGw4aKu2bjoiVuuCNnf0tICqk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=cuQvDLCG; arc=none smtp.client-ip=95.215.58.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="cuQvDLCG" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1770684916; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ojZz514RvzyouqbQnt4yvqck/hytcluQX/sLI1bmLEw=; b=cuQvDLCG8jNbQtONDjaeA868o012sFQs+ompDLcD/Lduo7vbDQU1NIb91Zy+riDbRM6Mcq zWjcdpHUmcDNJy/6e7KBluJSCyf4l0ABntpgJabATXKxwhhvIG4ONGjWF2WGiZh+J70lNm Xm8QIkFqSv3FHwkEKOjOao2s7/Hq+kU= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed , stable@vger.kernel.org Subject: [PATCH 1/4] KVM: nSVM: Sync next_rip to cached vmcb12 after VMRUN of L2 Date: Tue, 10 Feb 2026 00:54:46 +0000 Message-ID: <20260210005449.3125133-2-yosry.ahmed@linux.dev> In-Reply-To: <20260210005449.3125133-1-yosry.ahmed@linux.dev> References: <20260210005449.3125133-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs fields written by the CPU from vmcb02 to the cached vmcb12. This is because the cached vmcb12 is used as the authoritative copy of some of the controls, and is the payload when saving/restoring nested state. next_rip is also written by the CPU (in some cases) after VMRUN, but is not sync'd to cached vmcb12. As a result, it is corrupted after save/restore (replaced by the original value written by L1 on nested VMRUN). This could cause problems for both KVM (e.g. when injecting a soft IRQ) or L1 (e.g. when using next_rip to advance RIP after emulating an instruction). Fix this by sync'ing next_rip in nested_sync_control_from_vmcb02(). Move the call to nested_sync_control_from_vmcb02() (and the entire is_guest_mode() block) after svm_complete_interrupts(), as it may update next_rip in vmcb02. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET= _NESTED_STATE") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 6 ++++-- arch/x86/kvm/svm/svm.c | 26 +++++++++++++++----------- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index de90b104a0dd..70086ba6497f 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -519,8 +519,10 @@ void nested_copy_vmcb_save_to_cache(struct vcpu_svm *s= vm, void nested_sync_control_from_vmcb02(struct vcpu_svm *svm) { u32 mask; - svm->nested.ctl.event_inj =3D svm->vmcb->control.event_inj; - svm->nested.ctl.event_inj_err =3D svm->vmcb->control.event_inj_err; + + svm->nested.ctl.event_inj =3D svm->vmcb->control.event_inj; + svm->nested.ctl.event_inj_err =3D svm->vmcb->control.event_inj_err; + svm->nested.ctl.next_rip =3D svm->vmcb->control.next_rip; =20 /* Only a few fields of int_ctl are written by the processor. */ mask =3D V_IRQ_MASK | V_TPR_MASK; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 5f0136dbdde6..6d8d4d19455e 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -4399,17 +4399,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm= _vcpu *vcpu, u64 run_flags) sync_cr8_to_lapic(vcpu); =20 svm->next_rip =3D 0; - if (is_guest_mode(vcpu)) { - nested_sync_control_from_vmcb02(svm); - - /* Track VMRUNs that have made past consistency checking */ - if (svm->nested.nested_run_pending && - !svm_is_vmrun_failure(svm->vmcb->control.exit_code)) - ++vcpu->stat.nested_run; - - svm->nested.nested_run_pending =3D 0; - } - svm->vmcb->control.tlb_ctl =3D TLB_CONTROL_DO_NOTHING; =20 /* @@ -4435,6 +4424,21 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm= _vcpu *vcpu, u64 run_flags) =20 svm_complete_interrupts(vcpu); =20 + /* + * svm_complete_interrupts() may update svm->vmcb->control.next_rip, + * which is sync'd by nested_sync_control_from_vmcb02() below. + */ + if (is_guest_mode(vcpu)) { + nested_sync_control_from_vmcb02(svm); + + /* Track VMRUNs that have made past consistency checking */ + if (svm->nested.nested_run_pending && + !svm_is_vmrun_failure(svm->vmcb->control.exit_code)) + ++vcpu->stat.nested_run; + + svm->nested.nested_run_pending =3D 0; + } + return svm_exit_handlers_fastpath(vcpu); } =20 base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a --=20 2.53.0.rc2.204.g2597b5adb4-goog