Re: [PATCH 2/2] KVM: selftests: Verify that L2's LMSW leaves L1-owned CR0 bits alone

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] KVM: selftests: unordered l2_cr0 store and zero check in l2_lmsw_test()
--

commit 81df08b65f8d95b00451c4c4a33f93d0001cf528
Author: Mahmoud Abumandour <ma.mandourr@gmail.com>

KVM: selftests: Verify that L2's LMSW leaves L1-owned CR0 bits alone

This commit adds a nested VMX test case to nested_exceptions_test to verify
that an LMSW in L2 that exits to L0 preserves L1-owned CR0.TS and reads an
L1-owned CR0.NE from the CR0 read shadow.

> diff --git a/tools/testing/selftests/kvm/x86/nested_exceptions_test.c b/tools/testing/selftests/kvm/x86/nested_exceptions_test.c
> index f47432526ea16..7113018ee62a9 100644
> --- a/tools/testing/selftests/kvm/x86/nested_exceptions_test.c
> +++ b/tools/testing/selftests/kvm/x86/nested_exceptions_test.c
> @@ -109,6 +109,40 @@ static void l1_svm_code(struct svm_test_data *svm)
>  	GUEST_DONE();
>  }
>  
> +static u64 l2_cr0;
> +
> +static void l2_lmsw_test(void)
> +{
> +	/* Toggle CR0.MP, which KVM intercepts and L1 doesn't. */
> +	asm volatile("lmsw %w0" : : "r" (get_cr0() ^ X86_CR0_MP));
> +	l2_cr0 = get_cr0();
> +	asm volatile("fnop");
> +	GUEST_FAIL("L2's FNOP didn't take #NM");
> +}
> +
> +/*
> + * L1 owns CR0.TS (set) and CR0.NE, both with a read shadow of 0.  L2's LMSW
> + * must leave both alone: FNOP takes #NM and L2 reads NE as 0.
> + */
> +static void vmx_run_l2_lmsw(void)
> +{
> +	u64 cr0 = vmread(GUEST_CR0);
> +
> +	vmwrite(CR0_GUEST_HOST_MASK, X86_CR0_TS | X86_CR0_NE);
> +	vmwrite(CR0_READ_SHADOW, cr0 & ~(X86_CR0_TS | X86_CR0_NE));
> +	vmwrite(GUEST_CR0, cr0 | X86_CR0_TS);
> +	vmwrite(EXCEPTION_BITMAP, BIT(NM_VECTOR));
> +	vmwrite(GUEST_RIP, (u64)l2_lmsw_test);
> +	vmresume();
> +
> +	GUEST_ASSERT_EQ(vmread(VM_EXIT_REASON), EXIT_REASON_EXCEPTION_NMI);
> +	GUEST_ASSERT_EQ(vmread(VM_EXIT_INTR_INFO) & 0xff, NM_VECTOR);
> +	GUEST_ASSERT(!(l2_cr0 & X86_CR0_NE));

[Severity: Medium]
Can the store to l2_cr0 in l2_lmsw_test() be reordered past the fnop
instruction, causing the assertion in vmx_run_l2_lmsw() to pass vacuously?

In tools/testing/selftests/kvm/include/x86/processor.h:get_cr0(), the inline
assembly reads CR0 into a register, and l2_lmsw_test() then stores that
register to static u64 l2_cr0, which is zero-initialized in .bss and not
marked volatile (nor written via WRITE_ONCE()).

Because asm volatile("fnop") does not have a memory clobber, the compiler is
only required to order the volatile asm inside get_cr0() before fnop, while
the plain C store to l2_cr0 can be scheduled after fnop (before the function
call in GUEST_FAIL()). When fnop triggers #NM and exits to L1, any store
scheduled after fnop never executes, leaving l2_cr0 at 0.

In vmx_run_l2_lmsw(), GUEST_ASSERT(!(l2_cr0 & X86_CR0_NE)) only tests that
X86_CR0_NE is clear, which succeeds when l2_cr0 is still 0.

Should l2_cr0 be written with WRITE_ONCE() (or given a memory clobber on fnop)
and checked against the full expected CR0 value
(cr0 & ~(X86_CR0_TS | X86_CR0_NE)) ^ X86_CR0_MP via GUEST_ASSERT_EQ()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029235040.12013-1-ma.mandourr@gmail.com?part=2