When emulating POPA and exiting to userspace for MMIO, reset modified RSP
as emulation context may not be reset. POPA may generate more multiple
reads, i.e. multiple POPs from the stack, but if stack points to MMIO,
KVM needs to emulate multiple MMIO reads.
When one MMIO done, POPA may be re-emulated with EMULTYPE_NO_DECODE set,
i.e. ctxt will not be reset, but RSP is modified by previous emulation of
current POPA instruction, which eventually leads to emulation error.
The commit 0dc902267cb3 ("KVM: x86: Suppress pending MMIO write exits if
emulator detects exception") provides a detailed analysis of how KVM
emulates multiple MMIO reads, and its correctness can be verified in the
POPA instruction with this patch.
Signed-off-by: Tao Su <tao1.su@xxxxxxxxxxxxxxx>
---
For testing, we can add POPA to the emulator case in kvm-unit-test.
---
arch/x86/kvm/emulate.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index e72aed25d721..3746fef6ca60 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1999,6 +1999,7 @@ static int em_pushf(struct x86_emulate_ctxt *ctxt)
static int em_popa(struct x86_emulate_ctxt *ctxt)
{
+ unsigned long old_esp = reg_read(ctxt, VCPU_REGS_RSP);
int rc = X86EMUL_CONTINUE;
int reg = VCPU_REGS_RDI;
u32 val = 0;
@@ -2010,8 +2011,11 @@ static int em_popa(struct x86_emulate_ctxt *ctxt)
}
rc = emulate_pop(ctxt, &val, ctxt->op_bytes);
- if (rc != X86EMUL_CONTINUE)
+ if (rc != X86EMUL_CONTINUE) {
+ assign_register(reg_rmw(ctxt, VCPU_REGS_RSP),
+ old_esp, ctxt->op_bytes);
break;
+ }
assign_register(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
--reg;
}
base-commit: 786c8248dbd33a5a7a07f7c6e55a7bfc68d2ca48
--
2.34.1
