Re: [PATCH v2 08/16] riscv: kvm: Use generated instruction headers for csr code

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] KVM's `guest_context.zero` can be overwritten by MMIO reads with `rd=x0`, corrupting subsequent emulated instructions that read `x0`.
--

commit 6e0c9adf0592e2c6310d9a0a01fa605f82581d3e
Author: Charlie Jenkins <thecharlesjenkins@gmail.com>

riscv: kvm: Use generated instruction headers for csr code

Migrate the csr parsing code to use the generated instruction headers
instead of the hand-written instruction composition functions.

> diff --git a/arch/riscv/kvm/vcpu_insn.c b/arch/riscv/kvm/vcpu_insn.c
> index f09f9251d1f0a..8ccf6ec722f03 100644
> --- a/arch/riscv/kvm/vcpu_insn.c
> +++ b/arch/riscv/kvm/vcpu_insn.c
> @@ -146,43 +146,44 @@ int kvm_riscv_vcpu_csr_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
>  
>  static int csr_insn(struct kvm_vcpu *vcpu, struct kvm_run *run, ulong insn)
>  {
> +	#define GET_REG(_rd) (*((unsigned long *)(&vcpu->arch.guest_context) + _rd))

[Severity: High]
This isn't a bug introduced by this patch, but KVM's software copy of the
zero register (which this GET_REG macro can read) can be permanently
corrupted by a pre-existing issue in MMIO emulation.

When an MMIO load uses x0 as the destination register (e.g., lw x0, (a0)),
kvm_riscv_vcpu_mmio_return() in arch/riscv/kvm/vcpu_insn.c unconditionally
stores the result:

    *((ulong *)(&vcpu->arch.guest_context) + vcpu->arch.mmio_decode.rd) =
        (long)data << shift >> shift;

Because rd is 0, this overwrites guest_context.zero at index 0.

Unlike kvm_riscv_vcpu_csr_return() which checks if (vcpu->arch.csr_decode.rd)
before writing, the MMIO return path lacks this guard.

Since instruction emulation like the CSR emulation here uses x0 as an
operand and reads from guest_context via GET_REG(), could the corrupted
non-zero value be used instead of the hardware-mandated 0, leading to
incorrect guest execution?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260621-riscv_insn_table-v2-0-7f0810ee2274@gmail.com?part=8