Re: [PATCH v3 2/9] KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Synthesized EXITINFO1 is incorrectly populated for SVM_EXIT_CR0_SEL_WRITE intercepts triggered by MOV CR0, violating the AMD APM.
--

--- Patch [2]: [PATCH v3 2/9] KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts ---
commit 60593c4facd0e8bdc8b0aa501c98449feeced81a
Author: Tina Zhang <zhang_wei@open-hieco.net>

KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts

This commit populates the architectural EXITINFO fields when DecodeAssists
is exposed to L1 and KVM synthesizes a nested VM-Exit for emulated
instructions. It targets specific intercepts like MOV CR/DR, INTn, and
INVLPG.

> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index d68cba12c772b..b63234a2feb8d 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4822,6 +4822,52 @@ static const struct __x86_intercept {
[ ... ]
> +static void svm_prepare_decode_assist_exit_info(struct kvm_vcpu *vcpu,
> +						const struct x86_instruction_info *info)
> +{
> +	struct vmcb *vmcb = to_svm(vcpu)->vmcb;
> +	u64 exit_info_1;
> +
> +	if (!guest_cpu_cap_has(vcpu, X86_FEATURE_DECODEASSISTS))
> +		return;
> +
> +	switch (info->intercept) {
> +	case x86_intercept_cr_read:
> +	case x86_intercept_cr_write:
> +		/* MOV CRx: bit 63 set, GPR number in bits 3:0. */
> +		exit_info_1 = BIT_ULL(63) | (info->modrm_rm & 0xf);

[Severity: High]
Will this incorrectly populate exit_info_1 for selective CR0 writes?

In svm_check_intercept(), the exit code can be dynamically upgraded to
SVM_EXIT_CR0_SEL_WRITE for MOV CR0 instructions:

svm_check_intercept() {
        ...
        cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
        val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;
        if (cr0 ^ val)
                icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;
        ...
}

Since svm_prepare_decode_assist_exit_info() is subsequently called and
only checks the original instruction intercept (x86_intercept_cr_write),
could this wrongly populate exit_info_1 with decode assist information
instead of leaving it zero as required by the AMD architecture manual
for SVM_EXIT_CR0_SEL_WRITE?

> +		break;
> +	case x86_intercept_clts:
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785411877.git.zhang_wei@open-hieco.net?part=2