Re: [PATCH v4 5/8] RISC-V: KVM: Handle software-check exits for VCPU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `vcpu_redirect` unconditionally sets `VSSTATUS.SPP` to 1 and fails to set `HSTATUS.SPVP` to 1, causing guest user-to-kernel privilege escalation or fatal guest crashes.
--

commit b591989d8fd2e996d0f963c15186f3a08e706f56
Author: Inochi Amaoto <inochiama@gmail.com>

RISC-V: KVM: Handle software-check exits for VCPU

The patch introduces handling for EXC_SOFTWARE_CHECK in RISC-V KVM to support
Zicfiss/Zicfilp extensions. It delegates these exceptions to VS mode via
vcpu_redirect().

> diff --git a/arch/riscv/kvm/vcpu_exit.c b/arch/riscv/kvm/vcpu_exit.c
> index 0bb0c51e3c890..12eebeabdf146 100644
> --- a/arch/riscv/kvm/vcpu_exit.c
> +++ b/arch/riscv/kvm/vcpu_exit.c
[ ... ]
> @@ -243,6 +243,10 @@ int kvm_riscv_vcpu_exit(struct kvm_vcpu *vcpu, struct kvm_run *run,
>  		run->exit_reason = KVM_EXIT_DEBUG;
>  		ret = 0;
>  		break;
> +	case EXC_SOFTWARE_CHECK:
> +		if (vcpu->arch.cfg.henvcfg & (ENVCFG_LPE | ENVCFG_SSE))
> +			ret = vcpu_redirect(vcpu, trap);
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[Severity: High]
This is a pre-existing issue, but using vcpu_redirect() here exposes an
underlying architectural flaw in KVM RISC-V's exception redirection logic.

When KVM redirects a trap to the guest, kvm_riscv_vcpu_trap_redirect() attempts
to copy the host's sstatus.SPP bit into the guest's VSSTATUS.SPP:

arch/riscv/kvm/vcpu_exit.c:kvm_riscv_vcpu_trap_redirect() {
    ...
	/* Change Guest SSTATUS.SPP bit */
	vsstatus &= ~SR_SPP;
	if (vcpu->arch.guest_context.sstatus & SR_SPP)
		vsstatus |= SR_SPP;
    ...

Since taking a trap from V=1 to HS-mode always sets the host's sstatus.SPP to 1,
VSSTATUS.SPP is unconditionally set to 1. This falsely tells the guest OS that
the exception originated in supervisor mode, even if it actually occurred in
user mode (VU-mode).

Additionally, kvm_riscv_vcpu_trap_redirect() fails to update HSTATUS.SPVP:

    ...
	/* Set Guest privilege mode to supervisor */
	vcpu->arch.guest_context.sstatus |= SR_SPP;
}

Because sret from HS-mode uses HSTATUS.SPVP to determine the return privilege
mode for the guest, the guest will resume in VU-mode at the supervisor
exception vector (vstvec).

Does this enable guest user space to execute the kernel's trap handler with
user privileges, leading to privilege escalation or fatal guest crashes?

> +		break;
>  	default:
>  		break;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701020746.170157-1-inochiama@gmail.com?part=5