In svm_set_nested_state(), the value of RIP from vmcb02 is passed into nested_vmcb02_prepare_control(). However, even if RIP is restored with KVM_SET_REGS prior to KVM_SET_NESTED_STATE, its value is not reflected into the VMCB until the vCPU is run. Use the value from KVM's cache instead, which is what KVM_SET_REGS updates. Not that the passed RIP is still incorrect if KVM_SET_REGS is not called prior to KVM_SET_NESTED_STATE, this will be fixed separately. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index eebbe00714e3..aec17c80ed73 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1911,7 +1911,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, nested_copy_vmcb_control_to_cache(svm, ctl); svm_switch_vmcb(svm, &svm->nested.vmcb02); - nested_vmcb02_prepare_control(svm, svm->vmcb->save.rip, svm->vmcb->save.cs.base); + nested_vmcb02_prepare_control(svm, kvm_rip_read(vcpu), svm->vmcb->save.cs.base); /* * While the nested guest CR3 is already checked and set by -- 2.53.0.273.g2a3d683680-goog