Re: [PATCH v2 4/4] KVM: selftests: Check VMPTRLD with active eVMCS

On Tue, Aug 18, 2026, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Code relying on CPU flags after `KVM_ASM_SAFE` incorrectly evaluates them because the macro's cleanup instructions unconditionally clobber the flags.
> --
> 
> --- Patch [4]: [PATCH v2 4/4] KVM: selftests: Check VMPTRLD with active eVMCS ---
> commit d5821824a958c354147206d0cf6cf26eaeb71cc6
> Author: Vitaly Kuznetsov <[email protected]>
> 
> KVM: selftests: Check VMPTRLD with active eVMCS
> 
> This commit verifies that VMPTRLD triggers a #UD when eVMCS is active.
> It uses the KVM_ASM_SAFE framework to safely handle the expected
> exceptions from VMPTRLD testing.
> 
> > diff --git a/tools/testing/selftests/kvm/include/x86/vmx.h b/tools/testing/selftests/kvm/include/x86/vmx.h
> > index 047d02aa96889..e6adde3970d4d 100644
> > --- a/tools/testing/selftests/kvm/include/x86/vmx.h
> > +++ b/tools/testing/selftests/kvm/include/x86/vmx.h
> [ ... ]
> > @@ -336,6 +333,22 @@ static inline int vmptrld(u64 vmcs_pa)
> >  	return ret;
> >  }
> >  
> > +static inline int vmptrld_safe(u64 vmcs_pa)
> > +{
> > +	u64 error_code;
> > +	u8 vector;
> > +	u8 failed;
> > +
> > +	asm volatile(KVM_ASM_SAFE("vmptrld %[pa]")
> > +		     "\n\tsetna %[failed]"
> 
> [Severity: Medium]
> Will this setna instruction incorrectly evaluate CPU flags?
> 
> The KVM_ASM_SAFE macro executes xor %%r9, %%r9 on its success path, which
> unconditionally clears the Carry Flag (CF=0) and sets the Zero Flag (ZF=1).

Shame on me, I should know better after dealing with ba5ca5e5e6a1 ("x86/retpoline:
Don't clobber RFLAGS during srso_safe_ret()").

Untested, but I think the fix is simply:

diff --git tools/testing/selftests/kvm/include/x86/processor.h tools/testing/selftests/kvm/include/x86/processor.h
index 6e6f70035508..119715ffe93f 100644
--- tools/testing/selftests/kvm/include/x86/processor.h
+++ tools/testing/selftests/kvm/include/x86/processor.h
@@ -1318,7 +1318,7 @@ gva_t vm_alloc_stack(struct kvm_vm *vm, int nr_pages);
        "lea 1f(%%rip), %%r10\n\t"                              \
        "lea 2f(%%rip), %%r11\n\t"                              \
        fep "1: " insn "\n\t"                                   \
-       "xor %%r9, %%r9\n\t"                                    \
+       "mov $0, %%r9\n\t"                                      \
        "2:\n\t"                                                \
        "mov  %%r9b, %[vector]\n\t"                             \
        "mov  %%r10, %[error_code]\n\t"