Re: [PATCH v4 2/9] KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The population of EXITINFO1 and EXITINFO2 for INVLPG and INVLPGA is incorrectly gated behind the X86_FEATURE_DECODEASSISTS CPU capability.
--

--- Patch [2]: [PATCH v4 2/9] KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts ---
commit 03ef081906dd422c2f595e7c28afbf6acdb25b23
Author: Tina Zhang <zhang_wei@open-hieco.net>

KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts

This commit populates the architectural EXITINFO fields during an emulated
L1 intercept when DecodeAssists is exposed to L1. It updates EXITINFO1 and
EXITINFO2 for several instructions including MOV CR/DR, INTn, and INVLPG.

> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4810,6 +4810,52 @@ static const struct __x86_intercept {
>  #undef POST_EX
>  #undef POST_MEM
>  
> +static void svm_prepare_decode_assist_exit_info(struct kvm_vcpu *vcpu,
> +						const struct x86_instruction_info *info)
> +{
> +	struct vmcb *vmcb = to_svm(vcpu)->vmcb;
> +	u64 exit_info_1;
> +
> +	if (!guest_cpu_cap_has(vcpu, X86_FEATURE_DECODEASSISTS))
> +		return;

[Severity: High]
Does this early return prevent INVLPG and INVLPGA from updating EXITINFO1 and
EXITINFO2 when the guest lacks the Decode Assists feature?

According to the AMD APM, the INVLPG and INVLPGA intercepts populate these
fields unconditionally. If KVM does not expose Decode Assists to the L1
hypervisor, this return might leave EXITINFO1 uninitialized or stale.

When an L2 guest executes INVLPG under these conditions, could the L1
hypervisor receive an incorrect address and flush the wrong shadow page table
entry?

> +
> +	switch (info->intercept) {
> +	case x86_intercept_cr_read:

[ ... ]

> +	case x86_intercept_intn:
> +		/* INTn: software interrupt number in bits 7:0. */
> +		exit_info_1 = info->src_val & 0xff;
> +		break;
> +	case x86_intercept_invlpg:
> +		/* INVLPG: linear address of the target page. */
> +		exit_info_1 = info->intercept_linear_addr;
> +		break;
> +	case x86_intercept_invlpga:
> +		/* INVLPGA: the address remains available in guest rAX. */
> +		exit_info_1 = 0;
> +		break;
> +	default:
> +		return;
> +	}
> +
> +	vmcb->control.exit_info_1 = exit_info_1;
> +	vmcb->control.exit_info_2 = 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1787116250.git.zhang_wei@open-hieco.net?part=2