Re: [PATCH v2] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

[Omar Sandoval <osandov@osandov.com>]

On Fri, Oct 31, 2025 at 03:44:13PM -0700, Sean Christopherson wrote:
> On Wed, Oct 29, 2025, Omar Sandoval wrote:
> > @@ -2153,6 +2158,10 @@ u64 vcpu_tsc_khz(struct kvm_vcpu *vcpu);
> >  #define EMULTYPE_PF		    (1 << 6)
> >  #define EMULTYPE_COMPLETE_USER_EXIT (1 << 7)
> >  #define EMULTYPE_WRITE_PF_TO_SP	    (1 << 8)
> > +#define EMULTYPE_SKIP_SOFT_INT	    (1 << 9)
> > +
> > +#define EMULTYPE_SET_SOFT_INT_VECTOR(v)	(((v) & 0xff) << 16)
> > +#define EMULTYPE_GET_SOFT_INT_VECTOR(e)	(((e) >> 16) & 0xff)
> >  
> >  static inline bool kvm_can_emulate_event_vectoring(int emul_type)
> >  {
> 
> ...
> 
> > +static int svm_update_soft_interrupt_rip(struct kvm_vcpu *vcpu, u8 vector)
> >  {
> > +	const int emul_type = EMULTYPE_SKIP | EMULTYPE_SKIP_SOFT_INT |
> > +			      EMULTYPE_GET_SOFT_INT_VECTOR(vector);
> 
> Apparently our friendly neighborhood test bots[*] are the only ones that tested
> this :-)
> 
> This should be EMULTYPE_SET_SOFT_INT_VECTOR()
>                         ^
>                         |

Oof, I'm disappointed that I missed that. FWIW, I did test this with my
reproducer, and it passed, only because this buggy version will always
retry an INT3. I don't have a test case for the original bug that commit
6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the
instruction") fixed.

> And I suspect EMULTYPE_SET_SOFT_INT_VECTOR() needs to cast (v) to a u32 so as
> not to overflow the shift.

u8 (unsigned char) gets promoted to int before the shift, so this won't
overflow, but we might as well make smatch happy.

I'll send a new version.

Thanks,
Omar

> [*] https://lore.kernel.org/all/202510310909.y5ClH2qW-lkp@intel.com