On Wed, Jul 31, 2019 at 5:13 PM Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > > On 01/08/19 01:56, Sean Christopherson wrote: > > On Wed, Jul 31, 2019 at 04:45:21PM -0700, Jim Mattson wrote: > >> On Wed, Jul 31, 2019 at 4:37 PM Sean Christopherson > >> <sean.j.christopherson@xxxxxxxxx> wrote: > >> > >>> At a glance, the full emulator models behavior correctly, e.g. see > >>> toggle_interruptibility() and setters of ctxt->interruptibility. > >>> > >>> I'm pretty sure that leaves the EPT misconfig MMIO and APIC access EOI > >>> fast paths as the only (VMX) path that would incorrectly handle a > >>> MOV/POP SS. Reading the guest's instruction stream to detect MOV/POP SS > >>> would defeat the whole "fast path" thing, not to mention both paths aren't > >>> exactly architecturally compliant in the first place. > >> > >> The proposed patch clears the interrupt shadow in the VMCB on all > >> paths through svm's skip_emulated_instruction. If this happens at the > >> tail end of emulation, it doesn't matter if the full emulator does the > >> right thing. > > > > Unless I'm missing something, skip_emulated_instruction() isn't called in > > the emulation case, x86_emulate_instruction() updates %rip directly, e.g.: > > Indeed. skip_emulated_instruction() is only used when the vmexit code > takes care of emulation directly. Mea culpa. I had incorrectly assumed that "skip_emulated_instruction" was used when an instruction was emulated. I retract my objection. Having now been twice bitten by misleading function names, I'll be more careful in the future.
