Re: [PATCH v6 3/8] RISC-V: KVM: Allow Zicfiss/Zicfilp extensions for Guest/VM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Missing context switch logic and ONE_REG state management for the unbanked `CSR_SSP` register (Zicfiss).
- [High] Missing hardware enablement for Zicfiss (`ENVCFG_SSE`) and Zicfilp (`ENVCFG_LPE`) in the hypervisor's `henvcfg` register.
--

--- Patch [3]: [PATCH v6 3/8] RISC-V: KVM: Allow Zicfiss/Zicfilp extensions for Guest/VM ---
commit e9ffdcbcaf04d693405f356426ae62f60a2aa04c
Author: Inochi Amaoto <inochiama@gmail.com>

RISC-V: KVM: Allow Zicfiss/Zicfilp extensions for Guest/VM

This commit extends the KVM ISA extension array to allow userspace to detect
and enable the Zicfiss and Zicfilp extensions for the guest VM.

> diff --git a/arch/riscv/include/uapi/asm/kvm.h b/arch/riscv/include/uapi/asm/kvm.h
> index 7bbea8812d927..a27de850fa4cc 100644
> --- a/arch/riscv/include/uapi/asm/kvm.h
> +++ b/arch/riscv/include/uapi/asm/kvm.h
[ ... ]
> @@ -199,6 +199,8 @@ enum KVM_RISCV_ISA_EXT_ID {
>  	KVM_RISCV_ISA_EXT_ZCLSD,
>  	KVM_RISCV_ISA_EXT_ZILSD,
>  	KVM_RISCV_ISA_EXT_ZALASR,
> +	KVM_RISCV_ISA_EXT_ZICFILP,
> +	KVM_RISCV_ISA_EXT_ZICFISS,
>  	KVM_RISCV_ISA_EXT_MAX,
>  };
>  
> diff --git a/arch/riscv/kvm/isa.c b/arch/riscv/kvm/isa.c
> index 1132d909cc25c..9852a91fdecc9 100644
> --- a/arch/riscv/kvm/isa.c
> +++ b/arch/riscv/kvm/isa.c
[ ... ]
> @@ -65,6 +65,8 @@ static const unsigned long kvm_isa_ext_arr[] = {
>  	KVM_ISA_EXT_ARR(ZICBOP),
>  	KVM_ISA_EXT_ARR(ZICBOZ),
>  	KVM_ISA_EXT_ARR(ZICCRSE),
> +	KVM_ISA_EXT_ARR(ZICFILP),

[Severity: High]
Is hardware enablement for Zicfiss and Zicfilp missing in the hypervisor's
henvcfg register?

KVM populates cfg->henvcfg based on enabled ISA extensions here:

arch/riscv/kvm/vcpu_config.c:kvm_riscv_vcpu_config_ran_once() {
    ...
    if (riscv_isa_extension_available(isa, ZICBOM))
        cfg->henvcfg |= (ENVCFG_CBIE | ENVCFG_CBCFE);
    ...
}

If ENVCFG_SSE and ENVCFG_LPE are not delegated to henvcfg, will the guest
kernel's attempts to set senvcfg.SSE and senvcfg.LPE silently fail?

This would leave the fields read-only zero in the guest, preventing the
advertised CFI extensions from being used.

> +	KVM_ISA_EXT_ARR(ZICFISS),

[Severity: High]
Will the guest's CSR_SSP register be corrupted when context switching?

When a guest with Zicfiss enabled sets a valid shadow stack pointer in
CSR_SSP, and a VM exit occurs, the host scheduler may preempt the KVM vCPU
thread.

The host's exception return path overwrites CSR_SSP for the new process, and
upon switching back, the host's exception entry path zeroes CSR_SSP.

Since the C-level CSR context switch logic in
kvm_riscv_vcpu_swap_in_guest_state() and the assembly path in
__kvm_riscv_switch_to() lack save/restore operations for CSR_SSP:

arch/riscv/kvm/vcpu_switch.S:__kvm_riscv_switch_to() {
    ...
    SAVE_HOST_AND_RESTORE_GUEST_CSRS .Lkvm_switch_return
    ...
    SAVE_GUEST_AND_RESTORE_HOST_CSRS
    ...
}

Does this cause the guest to resume with a zeroed CSR_SSP and crash on its
next CFI instruction? Should CSR_SSP also be exposed via the ONE_REG
interface for state management?

>  	KVM_ISA_EXT_ARR(ZICNTR),
>  	KVM_ISA_EXT_ARR(ZICOND),
>  	KVM_ISA_EXT_ARR(ZICSR),

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713010302.303278-1-inochiama@gmail.com?part=3