[PATCH] KVM: SVM: Sync CR8 to the local APIC after marking the VMCB clean

[Sean Christopherson]

From: Chris Oo <cho@xxxxxxxxxxxxx>

Sync CR8 from the VMCB to the TPR *after* marking all VMCB fields as clean,
as syncing CR8 can toggle the CR8 write intercept and thus mark INTERCEPTS
as dirty.  Clobbering the dirty bit can result in KVM failing to detect CR8
writes if the underlying "hardware" uses the clean bits to optimize VMRUN,
e.g. when KVM is running on Hyper-V.

Failure to intercept CR8 usually manifests as hangs when running Windows as
L2, as KVM's view of vTPR stays high and so KVM never injects pending IRQs.

Fixes: bb365a506b1e ("KVM: x86: Unconditionally recompute CR8 intercept on PPR update")
Cc: stable@xxxxxxxxxxxxxxx
Cc: Carlos López <clopez@xxxxxxx>
Cc: Stefano Garzarella <sgarzare@xxxxxxxxxx>
Not-signed-off-by: Chris Oo <cho@xxxxxxxxxxxxx>
[sean: rewrite changelog, massage comment]
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
---

Chris, as mentioned, I need your SoB.

 arch/x86/kvm/svm/svm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 581bc3a23c95..3152846a6ccd 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4726,8 +4726,6 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
 		kvm_after_interrupt(vcpu);
 
-	sync_cr8_to_lapic(vcpu);
-
 	svm->next_rip = 0;
 	if (is_guest_mode(vcpu)) {
 		nested_sync_control_from_vmcb02(svm);
@@ -4758,6 +4756,13 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu, u64 run_flags)
 			       vcpu_to_pmu(vcpu)->global_ctrl);
 	}
 
+	/*
+	 * Note!  Any action that might dirty the VMCB must be done *after*
+	 * marking all VMCB fields as clean, e.g. syncing CR8 can toggle the
+	 * CR8 write intercept and thus mark the intercepts field dirty.
+	 */
+	sync_cr8_to_lapic(vcpu);
+
 	/* if exit due to PF check for async PF */
 	if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
 		vcpu->arch.apf.host_apf_flags =

base-commit: d21eef2084a9af87ac2a783bc7c2b175ba114e4e
-- 
2.56.1.703.gf848ed807c-goog