[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] x86/nSVM: Save L2's CR4 on #VMEXIT, not Xen's
- To: Lin Liu <lin.liu01@xxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx
- From: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
- Date: Wed, 23 Sep 2026 12:16:41 +0100
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QxfeYVCK/ABHBpdU2TQPFB2PkdQGMgpkvrmStIswxk8=; b=Yf4VzTFJkxZWF8Zj2V3RlrARUJy51Xh3MjmYxc/ew7+Lr0CjynI9cvnUqeEpFFSpZzbBIAzE3HK/4ref9Csq6H93f5MsmZfaPsmHw799MU0mlq/djuJ1gzzJnJtgbwITDt+NN6J3dYLib4jgPXHrAix0Zs5JzIYswsEXkcc9Yf+5Qp0Bak3UJaELvFdBSWPmrKmTiVtj23R0HK55/TN+CJMTpfn5GN6MtFt53JnWFNfQweatq9PildM0FhEz5DAkQajrGh6LEJFtrM+bwPef4WGdSo35yvSv+vWKyAXV7mvkmLzyWJ8GIxsBxXj9+AsvtQdP1MOL6AK61QbbcpMDZw==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Ko156pzfNLv/coan9zKcYFk7a+dOlodbFjsWaFwDjIgBthz615Brrb8GqgJU07a25u67m3nToYFm8LAkALVcg4XIxwVjRPs1rJcnHShKDXtAMs2Efr7IDRmICHaQyH5F8LJBMNUvhVHOXMongqcKYLLp4nQlgDFWj8QbURsBG9vb/qZNaK5r4FeDNEXud1Xk1ORUb6QdvoOSdUjbhspaWWIlLiLkUmyhph9ykk6hvqBQLohN7hSHdBofGYBUNIUzUeQY5WW63OopBaqLwyVl/qvtbX1SwzqyyoxSnca9axi6c0XUoikOBxuuFOPWq0+kW5O8o7PuSkXy5hy9iDZlNQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: Jan Beulich <jbeulich@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Roger Pau Monné <roger@xxxxxxxxxxxxxx>, Jason Andryuk <jason.andryuk@xxxxxxx>, Teddy Astie <teddy.astie@xxxxxxxxxx>
- Delivery-date: Wed, 23 Sep 2026 11:16:58 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 9/23/26 10:51 AM, Lin Liu wrote:
Xen leaks the host's CR4 bits to L1.
nsvm_vmcb_prepare4vmrun() constructs the shadow VMCB's CR4 via
hvm_set_cr4(), and svm_update_guest_cr() ORs in HVM_CR4_HOST_MASK.
nsvm_vmcb_prepare4vmexit() then copies CR4 back out of the shadow VMCB
instead of the value kept in v->arch.hvm.guest_cr[4], so L1 reads back
Xen's bits - under HAP, CR4.MCE.
Fixes: 9a779e4fc161 ("Implement SVM specific part for Nested Virtualization")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lin Liu <lin.liu01@xxxxxxxxxx>
---
xen/arch/x86/hvm/svm/nestedsvm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c
index a8b15d6eae..8d99b0affc 100644
--- a/xen/arch/x86/hvm/svm/nestedsvm.c
+++ b/xen/arch/x86/hvm/svm/nestedsvm.c
@@ -1082,7 +1082,7 @@ nsvm_vmcb_prepare4vmexit(struct vcpu *v, struct
cpu_user_regs *regs)
ns_vmcb->_efer = n2vmcb->_efer;
/* CRn */
- ns_vmcb->_cr4 = n2vmcb->_cr4;
+ ns_vmcb->_cr4 = v->arch.hvm.guest_cr[4];
ns_vmcb->_cr0 = n2vmcb->_cr0;
/* DRn */
Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
Did you consider addressing similar issues with the other state copied from
n2vmcb as well? i.e. I think something similar would apply to CR0, EFER, etc.
As an aside, it is confusing that the same CR value also appears in
v->arch.hvm.nvcpu.guest_cr[4]. The SVM code doesn't seem to use it and I
haven't checked why the VMX code needs it. Perhaps something to clean up in
future.
Ross
|
