Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e3e9ed3d authored by Joerg Roedel's avatar Joerg Roedel Committed by Avi Kivity
Browse files

KVM: SVM: Fix fault-rip on vmsave/vmload emulation 



When the emulation of vmload or vmsave fails because the
guest passed an unsupported physical address it gets an #GP
with rip pointing to the instruction after vmsave/vmload.
This is a bug and fixed by this patch.

Signed-off-by: default avatarJoerg Roedel <joerg.roedel@amd.com>
Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent 92a1f12d

arch/x86/kvm/svm.c

+6 −6
Original line number Original line Diff line number Diff line
@@ -2518,13 +2518,13 @@ static int vmload_interception(struct vcpu_svm *svm) 
	if (nested_svm_check_permissions(svm))

	if (nested_svm_check_permissions(svm))

		return 1;

		return 1;





	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;

	skip_emulated_instruction(&svm->vcpu);



	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);

	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);

	if (!nested_vmcb)

	if (!nested_vmcb)

		return 1;

		return 1;





	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;

	skip_emulated_instruction(&svm->vcpu);



	nested_svm_vmloadsave(nested_vmcb, svm->vmcb);

	nested_svm_vmloadsave(nested_vmcb, svm->vmcb);

	nested_svm_unmap(page);

	nested_svm_unmap(page);
@@ -2539,13 +2539,13 @@ static int vmsave_interception(struct vcpu_svm *svm) 
	if (nested_svm_check_permissions(svm))

	if (nested_svm_check_permissions(svm))

		return 1;

		return 1;





	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;

	skip_emulated_instruction(&svm->vcpu);



	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);

	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);

	if (!nested_vmcb)

	if (!nested_vmcb)

		return 1;

		return 1;





	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;

	skip_emulated_instruction(&svm->vcpu);



	nested_svm_vmloadsave(svm->vmcb, nested_vmcb);

	nested_svm_vmloadsave(svm->vmcb, nested_vmcb);

	nested_svm_unmap(page);

	nested_svm_unmap(page);