From 9d6b6e4f739451d67478194e651b5bef0f8cb5b3 Mon Sep 17 00:00:00 2001 From: Chunjie Zhu Date: Tue, 13 Oct 2026 11:11:19 +0200 Subject: [PATCH] x86/svm: Sync nextrip during virtual VMRUN NextRIP is consumed on VMRUN as the return address pushed onto the stack for injected soft exceptions/interrupts. nsvm_vmcb_prepare4vmrun() builds n2vmcb from the virtual VMCB on every entry to the L2 guest, but never copied this field, leaving n2vmcb->nextrip stale. Injecting an event in this state can wedge the L2 vCPU, as the APM does not define behaviour for a VMRUN with a garbage NextRIP. Nested virt is only offered on NRIPS-capable hardware, and NRIPS is required to be advertised to L1 (see start_nested_svm()), so the L1 hypervisor is required to keep NextRIP correct. Therefore no conditional logic is needed here; an unconditional sync suffices. Suggested-by: Andrew Cooper Signed-off-by: Chunjie Zhu Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/svm/nestedsvm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c index 2e3b70345b..2b998e26bc 100644 --- a/xen/arch/x86/hvm/svm/nestedsvm.c +++ b/xen/arch/x86/hvm/svm/nestedsvm.c @@ -460,7 +460,14 @@ static int nsvm_vmcb_prepare4vmrun(struct vcpu *v, struct cpu_user_regs *regs) n2vmcb->virt_ext.bytes = n1vmcb->virt_ext.bytes | ns_vmcb->virt_ext.bytes; - /* NextRIP - only evaluated on #VMEXIT. */ + /* + * NextRIP is consumed on VMRUN as the return address pushed on the + * stack for injected soft exceptions/interrupts. Nested virt is only + * available on NRIPS-capable hardware and NRIPS is required to be + * advertised to L1 (see start_nested_svm), so the L1 hypervisor is + * required to keep this field correct. + */ + n2vmcb->nextrip = ns_vmcb->nextrip; /* * VMCB Save State Area