2020-09-09 02:57:37

by Wanpeng Li

Subject: [PATCH 1/3] KVM: SVM: Get rid of handle_fastpath_set_msr_irqoff()

From: Wanpeng Li <[email protected]>

Analysis from Sean:

| svm->next_rip is reset in svm_vcpu_run() only after calling
| svm_exit_handlers_fastpath(), which will cause SVM's
| skip_emulated_instruction() to write a stale RIP.

Let's get rid of handle_fastpath_set_msr_irqoff() in svm_exit_handlers_fastpath()
to have a quick fix.

Reported-by: Paul K. <[email protected]>
Suggested-by: Sean Christopherson <[email protected]>
Cc: Paul K. <[email protected]>
Cc: <[email protected]> # v5.8-rc1+
Fixes: 404d5d7bff0d (KVM: X86: Introduce more exit_fastpath_completion enum values)
Signed-off-by: Wanpeng Li <[email protected]>
---
arch/x86/kvm/svm/svm.c | 5 -----
1 file changed, 5 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 19e622a..c61bc3b 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -3349,11 +3349,6 @@ static void svm_cancel_injection(struct kvm_vcpu *vcpu)

static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
{
- if (!is_guest_mode(vcpu) &&
- to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR &&
- to_svm(vcpu)->vmcb->control.exit_info_1)
- return handle_fastpath_set_msr_irqoff(vcpu);
-
return EXIT_FASTPATH_NONE;
}

--
2.7.4

2020-09-09 08:24:30

by Vitaly Kuznetsov

Subject: Re: [PATCH 1/3] KVM: SVM: Get rid of handle_fastpath_set_msr_irqoff()

Wanpeng Li <[email protected]> writes:

> From: Wanpeng Li <[email protected]>
>
> Analysis from Sean:
>
> | svm->next_rip is reset in svm_vcpu_run() only after calling
> | svm_exit_handlers_fastpath(), which will cause SVM's
> | skip_emulated_instruction() to write a stale RIP.
>

This should only happen when svm->vmcb->control.next_rip is not set by
hardware as skip_emulated_instruction() itself sets 'svm->next_rip'
otherwise, right?

> Let's get rid of handle_fastpath_set_msr_irqoff() in svm_exit_handlers_fastpath()
> to have a quick fix.

which in the light of the whole seeries seems to be appropriate, so:

Reviewed-by: Vitaly Kuznetsov <[email protected]>

>
> Reported-by: Paul K. <[email protected]>
> Suggested-by: Sean Christopherson <[email protected]>
> Cc: Paul K. <[email protected]>
> Cc: <[email protected]> # v5.8-rc1+
> Fixes: 404d5d7bff0d (KVM: X86: Introduce more exit_fastpath_completion enum values)
> Signed-off-by: Wanpeng Li <[email protected]>
> ---
> arch/x86/kvm/svm/svm.c | 5 -----
> 1 file changed, 5 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 19e622a..c61bc3b 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -3349,11 +3349,6 @@ static void svm_cancel_injection(struct kvm_vcpu *vcpu)
>
> static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
> {
> - if (!is_guest_mode(vcpu) &&
> - to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR &&
> - to_svm(vcpu)->vmcb->control.exit_info_1)
> - return handle_fastpath_set_msr_irqoff(vcpu);
> -
> return EXIT_FASTPATH_NONE;
> }

--
Vitaly

2020-09-09 08:40:03

by Wanpeng Li

Subject: Re: [PATCH 1/3] KVM: SVM: Get rid of handle_fastpath_set_msr_irqoff()

On Wed, 9 Sep 2020 at 16:23, Vitaly Kuznetsov <[email protected]> wrote:
>
> Wanpeng Li <[email protected]> writes:
>
> > From: Wanpeng Li <[email protected]>
> >
> > Analysis from Sean:
> >
> > | svm->next_rip is reset in svm_vcpu_run() only after calling
> > | svm_exit_handlers_fastpath(), which will cause SVM's
> > | skip_emulated_instruction() to write a stale RIP.
> >
>
> This should only happen when svm->vmcb->control.next_rip is not set by
> hardware as skip_emulated_instruction() itself sets 'svm->next_rip'
> otherwise, right?

The bug is reported here
https://bugzilla.kernel.org/show_bug.cgi?id=209155 , the old machine
which the reporter uses doesn't have NRIP save on #VMEXIT support. :)

Wanpeng