Commit 127ccae2 authored by Yosry Ahmed's avatar Yosry Ahmed Committed by Sean Christopherson
Browse files

KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation 



Commit cc3ed80a ("KVM: nSVM: always use vmcb01 to for vmsave/vmload
of guest state") made KVM always use vmcb01 for the fields controlled by
VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code
to always use vmcb01.

As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not
intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01
instead of the current VMCB.

Fixes: cc3ed80a ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state")
Cc: Maxim Levitsky <mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarYosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20260110004821.3411245-2-yosry.ahmed@linux.dev


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent f00ccded

arch/x86/kvm/svm/svm.c

+3 −2
Original line number Diff line number Diff line
@@ -2122,12 +2122,13 @@ static int vmload_vmsave_interception(struct kvm_vcpu *vcpu, bool vmload) 


	ret = kvm_skip_emulated_instruction(vcpu);



	/* KVM always performs VMLOAD/VMSAVE on VMCB01 (see __svm_vcpu_run()) */

	if (vmload) {

		svm_copy_vmloadsave_state(svm->vmcb, vmcb12);

		svm_copy_vmloadsave_state(svm->vmcb01.ptr, vmcb12);

		svm->sysenter_eip_hi = 0;

		svm->sysenter_esp_hi = 0;

	} else {

		svm_copy_vmloadsave_state(vmcb12, svm->vmcb);

		svm_copy_vmloadsave_state(vmcb12, svm->vmcb01.ptr);

	}



	kvm_vcpu_unmap(vcpu, &map);