[PATCH v2] x86/svm: Sync nextrip during virtual VMRUN

[chunjie.zhu@xxxxxxxxxx]

From: Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>

NextRIP is consumed on VMRUN as the return address pushed onto the
stack for injected soft exceptions/interrupts.  nsvm_vmcb_prepare4vmrun()
builds n2vmcb from the virtual VMCB on every entry to the L2 guest, but
never copied this field, leaving n2vmcb->nextrip stale.  Injecting an
event in this state can wedge the L2 vCPU, as the APM does not define
behaviour for a VMRUN with a garbage NextRIP.

Nested virt is only offered on NRIPS-capable hardware, and NRIPS is
required to be advertised to L1 (see start_nested_svm()), so the L1
hypervisor is required to keep NextRIP correct.  Therefore no
conditional logic is needed here; an unconditional sync suffices.

Suggested-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Signed-off-by: Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>
---
Changes in v2:
- Retitle from "x86/svm: mandatory update VMCB nextrip for soft
  interrupts" to "x86/svm: Sync nextrip during virtual VMRUN" (Andrew
  Cooper).
- Move the rationale out of the in-code comment and into the commit
  message; keep the code comment short (Jan Beulich).
- Drop the stray non-ASCII whitespace characters from the comment
  (Jan Beulich).
- Drop the speculation about garbage/invalid NextRIP values: nested
  virt is only enabled on NRIPS-capable hardware and NRIPS is
  mandatorily advertised to L1, so the L1 hypervisor is required to
  keep NextRIP valid and no conditional sync is needed (Andrew
  Cooper).
- Cc AMD SVM maintainers/reviewers per submission guidelines (Jan
  Beulich).

 xen/arch/x86/hvm/svm/nestedsvm.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c
index faacfe007832..f2f3f9d14ec6 100644
--- a/xen/arch/x86/hvm/svm/nestedsvm.c
+++ b/xen/arch/x86/hvm/svm/nestedsvm.c
@@ -465,7 +465,14 @@ static int nsvm_vmcb_prepare4vmrun(struct vcpu *v, struct 
cpu_user_regs *regs)
     n2vmcb->virt_ext.bytes =
         n1vmcb->virt_ext.bytes | ns_vmcb->virt_ext.bytes;
 
-    /* NextRIP - only evaluated on #VMEXIT. */
+    /*
+     * NextRIP is consumed on VMRUN as the return address pushed on the
+     * stack for injected soft exceptions/interrupts. Nested virt is only
+     * available on NRIPS-capable hardware and NRIPS is required to be
+     * advertised to L1 (see start_nested_svm), so the L1 hypervisor is
+     * required to keep this field correct.
+     */
+    n2vmcb->nextrip = ns_vmcb->nextrip;
 
     /*
      * VMCB Save State Area
-- 
2.34.1