Re: [PATCH v4 2/2] KVM: x86: Add support for cmpxchg16b emulation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing guest CPUID check for X86_FEATURE_CX16 allows guest to invoke CMPXCHG16B emulation regardless of guest capabilities.
--

commit 17ba312dad40f9de38e63207a6f7c861db26c57a
Author: Sairaj Kodilkar <sarunkod@amd.com>
Subject: KVM: x86: Add support for cmpxchg16b emulation

This commit extends cmpxchg8b emulation in KVM to support the cmpxchg16b
instruction when the destination memory is 128-bit and REX.W is set. This
addresses an emulation failure where guests, such as the AMD IOMMU driver,
use 128-bit cmpxchg operations on MMIO regions.

Link: https://github.com/AMDESE/qemu-iommu/blob/wip/for_iommufd_hw_queue-v8_amd_viommu_20260106/hw/i386/amd_viommu.c#L517

> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index c1b21282187f3..535842336d766 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c

[ ... ]

> @@ -2184,24 +2184,36 @@ static int em_call_near_abs(struct x86_emulate_ctxt *ctxt)

[ ... ]

>  static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
>  {

[ ... ]

> -	if (ctxt->dst.bytes == 16)
> +	if (WARN_ON_ONCE(8 + !!(ctxt->rex_bits & REX_W) * 8 != ctxt->dst.bytes))
>  		return X86EMUL_UNHANDLEABLE;
>  
> -	if (((u32) (old >> 0) != (u32) reg_read(ctxt, VCPU_REGS_RAX)) ||
> -	    ((u32) (old >> 32) != (u32) reg_read(ctxt, VCPU_REGS_RDX))) {
> -		*reg_write(ctxt, VCPU_REGS_RAX) = (u32) (old >> 0);
> -		*reg_write(ctxt, VCPU_REGS_RDX) = (u32) (old >> 32);
> -		ctxt->eflags &= ~X86_EFLAGS_ZF;
> -	} else {
> -		ctxt->dst.val64 = ((u64)reg_read(ctxt, VCPU_REGS_RCX) << 32) |
> -			(u32) reg_read(ctxt, VCPU_REGS_RBX);
> -
> -		ctxt->eflags |= X86_EFLAGS_ZF;
> -	}
> +	if (!(ctxt->rex_bits & REX_W))
> +		em_cmpxchg8b_16b(ctxt, 32, 64);
> +#ifdef CONFIG_X86_64
> +	else
> +		em_cmpxchg8b_16b(ctxt, 64, 128);

[Severity: Medium]
Does this unconditionally allow a guest to invoke cmpxchg16b emulation
without checking if the guest CPUID actually supports X86_FEATURE_CX16?

If a hypervisor intentionally hides the CX16 CPUID feature to mimic older
hardware, it seems a guest could still execute a 128-bit cmpxchg targeting
an MMIO address, trapping to KVM and triggering this unconditional emulation
path in em_cmpxchg8b().

This appears to violate KVM guidelines requiring guest-visible features to be
discoverable and adhere to the guest CPUID configuration, which can break
live migration capability negotiation. Could we add a capability check for
X86_FEATURE_CX16 before performing the 128-bit emulation?

> +#endif
>  	return X86EMUL_CONTINUE;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908074739.10748-1-sarunkod@amd.com?part=2