Re: [PATCH] x86/svm: mandatory update VMCB nextrip for soft interrupts

Le 06/08/2026 à 05:17, Chunjie Zhu a écrit :
> Signed-off-by: Chunjie Zhu <[email protected]>
> ---
>   xen/arch/x86/hvm/svm/nestedsvm.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c
> index b06124c2c9ed..815713b8b506 100644
> --- a/xen/arch/x86/hvm/svm/nestedsvm.c
> +++ b/xen/arch/x86/hvm/svm/nestedsvm.c
> @@ -449,7 +449,14 @@ static int nsvm_vmcb_prepare4vmrun(struct vcpu *v, struct cpu_user_regs *regs)
>       n2vmcb->virt_ext.bytes =
>           n1vmcb->virt_ext.bytes | ns_vmcb->virt_ext.bytes;
>   
> -    /* NextRIP - only evaluated on #VMEXIT. */
> +    /* next_rip is consumed on VMRUN as the return address pushed on the
> +     * stack·for·injected·soft·exceptions/interrupts. This assignment
> +     * statement must be enforced, otherwise, it might cause vcpu wedge.
> +     *

Well, it's more that nrip semantics requires nrip to be properly 
configured in the vmcb. That looks like a missing piece, but we may 
still want to keep some informations about what happens on the #VMEXIT side.

> +     * APM Vol.2 Event Injection does not specifies what happens if NEXTRIP
> +     * holds an invalid/garbage value.

To me, it's similar to setting RIP directly to a bogus value. nrip is 
just a "next instruction rip" basically (wrt event injection, ...).

> +     */
> +    n2vmcb->nextrip = ns_vmcb->nextrip;
>   
>       /*
>        * VMCB Save State Area

Teddy

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEGAIew9LzHY3pdrqtZg+p0QLLz9AFAmp0VIkFAwAAAAAACgkQZg+p0QLLz9D1
OAv8CTskpTSydVdROIYyIF8Mf17Yj/Tqg8xy9XWovx3ENaMf77enPEB4WK8cj7Ch9oPR25s9HNtO
oruWr9d94kW+EsroKP3TvcVlhX6zV0T5lst0it2c7HSHgiPc1oWhNigRbOQzbIhlCw9mBUJ968sc
28APvzUunNizul5VQ2YIuaGanELbW67ZEJxR8ueMotQPnJAJgpoUAESDdAD3AlqV+q5TtTqpTZWJ
uJX06Pq4IfL8FPlhlGLedQhxImhGHYJplIJX5AvN6TiNpWEZmQUQlKVLFiLPZJchRYH1VXBclt5h
1Wxulj3fEH2tL981/Oe6ySG4RHHbrY5IFdWVumMW53ePKWSCRR97Z45uF9EBDbIjJNao7oenSDF+
GSM2cnM3yvM9oAjROtNxTI6J9S+M4WN+ZmvG/ziyiRsMBrG+viWeG8CK4gbhOZG+RCoPGLcGClKL
qeePJ4Aou0FbyadIMH0JJR5dJZhVJs6pp1cqD44IjilzBf7AFEiQK2QYD4W2
=mrhF
-----END PGP SIGNATURE-----