| Message ID | e8ff17592ae36b015bbe7d052b642e21acbccc24.1634870747.git.houwenlong93@linux.alibaba.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: some fixes about RDMSR/WRMSR instruction emulation | expand |
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 3ea4f6ef2474..4e0dc5b06d03 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7950,7 +7950,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, writeback = false; r = 0; vcpu->arch.complete_userspace_io = complete_emulated_mmio; - } else if (r == EMULATION_RESTART) + } else if (vcpu->arch.complete_userspace_io) + r = 0; + else if (r == EMULATION_RESTART) goto restart; else r = 1;
In em_rdmsr()/em_wrmsr(), it returns X86EMUL_IO_NEEDED if MSR accesses needed to exit to userspace. However, x86_emulate_insn() doesn't return X86EMUL_*, so x86_emulate_instruction() doesn't directly act on X86EMUL_IO_NEEDED, it instead looks for other signals to differentiate between PIO, MMIO, etc... So RDMSR/WRMSR emulation won't exit to userspace now. The userspace_msr_exit_test testcase in seftests had tested RDMSR/WRMSR emulation with kvm.force_enable_prefix enabled and it was passed. Because x86_emulate_instruction() returns 1 and guest continues, but RIP has been updated to point to RDMSR/WRMSR. Then guest would execute RDMSR/WRMSR and exit to userspace by kvm_emulate_rdmsr()/kvm_emulate_wrmsr() finally. In such situation, instruction emulation didn't take effect but userspace exit information had been filled, which was inappropriate. Since X86EMUL_IO_NEEDED path would provide a complete_userspace_io callback, x86_emulate_instruction() should return 0 if callback is not NULL. Then RDMSR/WRMSR instruction emulation can exit to userspace and skip RDMSR/WRMSR execution and inteception. Fixes: 1ae099540e8c7 ("KVM: x86: Allow deflecting unknown MSR accesses to user space") Signed-off-by: Hou Wenlong <houwenlong93@linux.alibaba.com> --- arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)