Re: [PATCH v2 4/4] KVM: selftests: Check VMPTRLD with active eVMCS

Sean Christopherson <[email protected]> writes:

> On Tue, Aug 18, 2026, Sean Christopherson wrote:
>> On Tue, Aug 18, 2026, [email protected] wrote:
>> > > +	asm volatile(KVM_ASM_SAFE("vmptrld %[pa]")
>> > > +		     "\n\tsetna %[failed]"
>> > 
>> > [Severity: Medium]
>> > Will this setna instruction incorrectly evaluate CPU flags?
>> > 
>> > The KVM_ASM_SAFE macro executes xor %%r9, %%r9 on its success path, which
>> > unconditionally clears the Carry Flag (CF=0) and sets the Zero Flag (ZF=1).
>> 
>> Shame on me, I should know better after dealing with ba5ca5e5e6a1 ("x86/retpoline:
>> Don't clobber RFLAGS during srso_safe_ret()").
>> 
>> Untested, but I think the fix is simply:
>> 
>> diff --git tools/testing/selftests/kvm/include/x86/processor.h tools/testing/selftests/kvm/include/x86/processor.h
>> index 6e6f70035508..119715ffe93f 100644
>> --- tools/testing/selftests/kvm/include/x86/processor.h
>> +++ tools/testing/selftests/kvm/include/x86/processor.h
>> @@ -1318,7 +1318,7 @@ gva_t vm_alloc_stack(struct kvm_vm *vm, int nr_pages);
>>         "lea 1f(%%rip), %%r10\n\t"                              \
>>         "lea 2f(%%rip), %%r11\n\t"                              \
>>         fep "1: " insn "\n\t"                                   \
>> -       "xor %%r9, %%r9\n\t"                                    \
>> +       "mov $0, %%r9\n\t"                                      \
>>         "2:\n\t"                                                \
>>         "mov  %%r9b, %[vector]\n\t"                             \
>>         "mov  %%r10, %[error_code]\n\t"
>
> Vitaly, I'll send a v3 of this series with a rather large pile of additional
> selftests changes.  As often seems to be the case, my desire validate a simple
> fix has snowballed...

Sure,

I guess you can start using 'Provoked-by:' tag in such cases :-)

-- 
Vitaly