[PATCH 0/4] KVM: nVMX: Adjust VMPTRLD/VMPTRST behavior with active eVMCS

[PATCH 0/4] KVM: nVMX: Adjust VMPTRLD/VMPTRST behavior with active eVMCS

[Vitaly Kuznetsov]

It was reported (https://bugzilla.kernel.org/show_bug.cgi?id=221841) that
KVM's emulation of VMPTRLD/VMPTRST instructions when Enlightened VMCS is
active is sub-optimal: returning '1' does not make the L1 guest skip the
instruction so a hang is likely to happen. While TLFS does not really
specify the expected behavior, genuine Hyper-V seems to return #UD for
VMPTRLD and eVMCS pointer for VMPTRST. Alter the behavior in KVM and check
it in selftests.

Note: this is not a security issue. Misbehaving L1 can only do self-harm
by doing VMPTRLD/VMPTRST when it also uses eVMCS.

Vitaly Kuznetsov (4):
  KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used
  KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used
  KVM: selftests: Adapt to the updated VMPTRST behavior when eVMCS is
    used
  KVM: selftests: Check VMPTRLD with active eVMCS

 arch/x86/kvm/vmx/nested.c                     | 22 +++++++++++++------
 tools/testing/selftests/kvm/include/x86/vmx.h |  6 -----
 .../testing/selftests/kvm/x86/hyperv_evmcs.c  | 18 ++++++++++-----
 3 files changed, 28 insertions(+), 18 deletions(-)

-- 
2.55.0

[PATCH 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used

[Vitaly Kuznetsov]

VMPTRLD with active eVMCS is already forbidden, however, returning 1
without skipping the instruction or queuing an exception will likely
result in L1 getting stuck. Genuine Hyper-V seems to inject #UD under
similar circumstances, mimic the behavior in KVM.

Reported-by: f734222792@gmail.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 arch/x86/kvm/vmx/nested.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index ddf6df7bee93..216f54a0b8ae 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5879,6 +5879,12 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
 	if (!nested_vmx_check_permission(vcpu))
 		return 1;
 
+	/* Forbid normal VMPTRLD if Enlightened version was used */
+	if (nested_vmx_is_evmptr12_valid(vmx)) {
+		kvm_queue_exception(vcpu, UD_VECTOR);
+		return 1;
+	}
+
 	if (nested_vmx_get_vmptr(vcpu, &vmptr, &r))
 		return r;
 
@@ -5888,10 +5894,6 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
 	if (vmptr == vmx->nested.vmxon_ptr)
 		return nested_vmx_fail(vcpu, VMXERR_VMPTRLD_VMXON_POINTER);
 
-	/* Forbid normal VMPTRLD if Enlightened version was used */
-	if (nested_vmx_is_evmptr12_valid(vmx))
-		return 1;
-
 	if (vmx->nested.current_vmptr != vmptr) {
 		struct gfn_to_hva_cache *ghc = &vmx->nested.vmcs12_cache;
 		struct vmcs_hdr hdr;
-- 
2.55.0

Re: [PATCH 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fixes an infinite VM-exit loop in `handle_vmptrld` by injecting a `#UD` exception when eVMCS is active, but misses the identical pre-existing bug in its sibling function `handle_vmptrst`. This problem wasn't introduced by this patch, but represents an incomplete fix for the class of bugs described in the commit message.
--

--- Patch [1]: [PATCH 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used ---
commit 34f5c31113003a4163d028b0ce4bfea669ca97f5
Author: Vitaly Kuznetsov <vkuznets@redhat.com>

KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used
    
This commit updates the VMPTRLD emulation to inject a #UD exception when
eVMCS is active, rather than returning 1 without skipping the instruction.
This resolves an issue where returning 1 without advancing the instruction
pointer would cause the L1 guest to get stuck in an infinite VM-exit loop.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 6957bb6f5cf7e..c78c67525ac9b 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -5883,6 +5883,12 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
>  	if (!nested_vmx_check_permission(vcpu))
>  		return 1;
>  
> +	/* Forbid normal VMPTRLD if Enlightened version was used */
> +	if (nested_vmx_is_evmptr12_valid(vmx)) {
> +		kvm_queue_exception(vcpu, UD_VECTOR);
> +		return 1;
> +	}
> +

[Severity: High]
This isn't a bug introduced by this patch, but does handle_vmptrst() need the
same fix?

Looking at handle_vmptrst() further down in arch/x86/kvm/vmx/nested.c, it
appears to have the identical pattern that this patch fixes for VMPTRLD:

    if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
        return 1;

Could this unhandled return cause the same infinite VM-exit loop if a guest
executes VMPTRST while eVMCS is active?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814162221.2144473-1-vkuznets@redhat.com?part=1

Re: [PATCH 1/4] KVM: nVMX: Make VMPTRLD result in #UD when eVMCS is used

[Sean Christopherson]

On Fri, Aug 14, 2026, sashiko-bot@kernel.org wrote:
> [Severity: High]
> This isn't a bug introduced by this patch, but does handle_vmptrst() need the
> same fix?

LOL, one of these days Sashiko will look at the next patch before responding.

[PATCH 2/4] KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used

[Vitaly Kuznetsov]

VMPTRST with active eVMCS is currently forbidden, however, returning 1
without skipping the instruction will likely result in L1 getting
stuck. While TLFS does not specify the expected behavior, genuine Hyper-V
seems to be returning eVMCS GPA. Implement the same behavior in KVM.

Reported-by: f734222792@gmail.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 arch/x86/kvm/vmx/nested.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 216f54a0b8ae..0f5e4b47ecb1 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5946,7 +5946,7 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
 {
 	unsigned long exit_qual = vmx_get_exit_qual(vcpu);
 	u32 instr_info = vmcs_read32(VMX_INSTRUCTION_INFO);
-	gpa_t current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
+	gpa_t current_vmptr;
 	struct x86_exception e;
 	gva_t gva;
 	int r;
@@ -5954,8 +5954,14 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
 	if (!nested_vmx_check_permission(vcpu))
 		return 1;
 
-	if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
-		return 1;
+	/*
+	 * Hyper-V TLFS does not specify the behavior of VMPTRST when eVMCS is used
+	 * but genuine Hyper-V seems to be returning eVMCS GPA.
+	 */
+	if (nested_vmx_is_evmptr12_valid(to_vmx(vcpu)))
+		current_vmptr = to_vmx(vcpu)->nested.hv_evmcs_vmptr;
+	else
+		current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
 
 	if (get_vmx_mem_address(vcpu, exit_qual, instr_info,
 				true, sizeof(gpa_t), &gva))
-- 
2.55.0

Re: [PATCH 2/4] KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Compilation failure when CONFIG_KVM_HYPERV is disabled.
--

--- Patch [2]: [PATCH 2/4] KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used ---
commit e9f713cf2125ef734863ce5fc9c30ea6f602ede7
Author: Vitaly Kuznetsov <vkuznets@redhat.com>

KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used
    
This commit changes the behavior of VMPTRST to return the eVMCS GPA when
eVMCS is active. This aligns KVM's behavior with genuine Hyper-V instead of
returning 1 without skipping the instruction.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221841

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index c78c67525ac9b..d13a4d47bc68f 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
[ ... ]
> @@ -5958,8 +5958,14 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
>  	if (!nested_vmx_check_permission(vcpu))
>  		return 1;
>  
> -	if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
> -		return 1;
> +	/*
> +	 * Hyper-V TLFS does not specify the behavior of VMPTRST when eVMCS is used
> +	 * but genuine Hyper-V seems to be returning eVMCS GPA.
> +	 */
> +	if (nested_vmx_is_evmptr12_valid(to_vmx(vcpu)))
> +		current_vmptr = to_vmx(vcpu)->nested.hv_evmcs_vmptr;

[Severity: Low]
Will this cause a build failure when CONFIG_KVM_HYPERV is disabled?

Because nested_vmx_is_evmptr12_valid() is a static inline function rather
than a preprocessor macro, the compiler still evaluates and type-checks
this branch even when the helper is hardcoded to return false. If the
hv_evmcs_vmptr member in struct nested_vmx is conditionally compiled based
on CONFIG_KVM_HYPERV, the compiler will fail to find it here.

> +	else
> +		current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
>  
>  	if (get_vmx_mem_address(vcpu, exit_qual, instr_info,
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814162221.2144473-1-vkuznets@redhat.com?part=2

Re: [PATCH 2/4] KVM: nVMX: Make VMPTRST return eVMCS GPA when it is used

[Sean Christopherson]

On Fri, Aug 14, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> > index c78c67525ac9b..d13a4d47bc68f 100644
> > --- a/arch/x86/kvm/vmx/nested.c
> > +++ b/arch/x86/kvm/vmx/nested.c
> [ ... ]
> > @@ -5958,8 +5958,14 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
> >  	if (!nested_vmx_check_permission(vcpu))
> >  		return 1;
> >  
> > -	if (unlikely(nested_vmx_is_evmptr12_valid(to_vmx(vcpu))))
> > -		return 1;
> > +	/*
> > +	 * Hyper-V TLFS does not specify the behavior of VMPTRST when eVMCS is used
> > +	 * but genuine Hyper-V seems to be returning eVMCS GPA.
> > +	 */
> > +	if (nested_vmx_is_evmptr12_valid(to_vmx(vcpu)))
> > +		current_vmptr = to_vmx(vcpu)->nested.hv_evmcs_vmptr;
> 
> [Severity: Low]
> Will this cause a build failure when CONFIG_KVM_HYPERV is disabled?
> 
> Because nested_vmx_is_evmptr12_valid() is a static inline function rather
> than a preprocessor macro, the compiler still evaluates and type-checks
> this branch even when the helper is hardcoded to return false. If the
> hv_evmcs_vmptr member in struct nested_vmx is conditionally compiled based
> on CONFIG_KVM_HYPERV, the compiler will fail to find it here.

Yep.

arch/x86/kvm/vmx/nested.c: In function ‘handle_vmptrst’:
arch/x86/kvm/vmx/nested.c:5971:53: error: ‘struct nested_vmx’ has no member named ‘hv_evmcs_vmptr’
 5971 |                 current_vmptr = to_vmx(vcpu)->nested.hv_evmcs_vmptr;
      |                                                     ^

[PATCH 3/4] KVM: selftests: Adapt to the updated VMPTRST behavior when eVMCS is used

[Vitaly Kuznetsov]

Previously, VMPTRST was forbidden with eVMCS and selftests were mocking the
correct behavior in vmptrst() by returning enlightened vmptr directly.
Since KVM's behavior has changed to match genuine Hyper-V, adjust evmcs
test accordingly.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 tools/testing/selftests/kvm/include/x86/vmx.h  | 3 ---
 tools/testing/selftests/kvm/x86/hyperv_evmcs.c | 5 ++---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/kvm/include/x86/vmx.h b/tools/testing/selftests/kvm/include/x86/vmx.h
index 90fffaf91595..047d02aa9688 100644
--- a/tools/testing/selftests/kvm/include/x86/vmx.h
+++ b/tools/testing/selftests/kvm/include/x86/vmx.h
@@ -341,9 +341,6 @@ static inline int vmptrst(u64 *value)
 	u64 tmp;
 	u8 ret;
 
-	if (enable_evmcs)
-		return evmcs_vmptrst(value);
-
 	__asm__ __volatile__("vmptrst %[value]; setna %[ret]"
 		: [value]"=m"(tmp), [ret]"=rm"(ret)
 		: : "cc", "memory");
diff --git a/tools/testing/selftests/kvm/x86/hyperv_evmcs.c b/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
index c7fa114aee20..88262ddf7fcb 100644
--- a/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
+++ b/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
@@ -95,16 +95,15 @@ void guest_code(struct vmx_pages *vmx_pages, struct hyperv_test_pages *hv_pages,
 	GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
 	GUEST_SYNC(3);
 	GUEST_ASSERT(load_evmcs(hv_pages));
-	GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa);
+	/* VMPTRST returns -1 until VMLAUNCH with eVMCS ptr set */
+	GUEST_ASSERT(vmptrstz() == -1);
 
 	GUEST_SYNC(4);
-	GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa);
 
 	prepare_vmcs(vmx_pages, l2_guest_code,
 		     &l2_guest_stack[L2_GUEST_STACK_SIZE]);
 
 	GUEST_SYNC(5);
-	GUEST_ASSERT(vmptrstz() == hv_pages->enlightened_vmcs_gpa);
 	current_evmcs->revision_id = -1u;
 	GUEST_ASSERT(vmlaunch());
 	current_evmcs->revision_id = EVMCS_VERSION;
-- 
2.55.0

Re: [PATCH 3/4] KVM: selftests: Adapt to the updated VMPTRST behavior when eVMCS is used

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The helper function `evmcs_vmptrst` became completely unused after this patch removed its only caller in `vmptrst()`, but its definition was left behind.
--

--- Patch [3]: [PATCH 3/4] KVM: selftests: Adapt to the updated VMPTRST behavior when eVMCS is used ---
commit 18309c20d40234d7991916df5f035584459347c3
Author: Vitaly Kuznetsov <vkuznets@redhat.com>

KVM: selftests: Adapt to the updated VMPTRST behavior when eVMCS is used

This commit updates selftests to stop mocking VMPTRST behavior with eVMCS,
adjusting them to match genuine Hyper-V behavior. It removes the
eVMCS-specific branch from vmptrst() and modifies the eVMCS test expectations.

> diff --git a/tools/testing/selftests/kvm/include/x86/vmx.h b/tools/testing/selftests/kvm/include/x86/vmx.h
> --- a/tools/testing/selftests/kvm/include/x86/vmx.h
> +++ b/tools/testing/selftests/kvm/include/x86/vmx.h
> @@ -341,9 +341,6 @@ static inline int vmptrst(u64 *value)
>  	u64 tmp;
>  	u8 ret;
>  
> -	if (enable_evmcs)
> -		return evmcs_vmptrst(value);
> -

[Severity: Low]
Does this leave evmcs_vmptrst() as unused dead code?

Since this was the only caller, the definition in 
tools/testing/selftests/kvm/include/x86/evmcs.h is left behind:

static inline int evmcs_vmptrst(u64 *value)
{
	*value = current_vp_assist->current_nested_vmcs &
		~HV_X64_MSR_VP_ASSIST_PAGE_ENABLE;

	return 0;
}

Could this definition be removed as well to keep the header clean?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814162221.2144473-1-vkuznets@redhat.com?part=3

[PATCH 4/4] KVM: selftests: Check VMPTRLD with active eVMCS

[Vitaly Kuznetsov]

Check that VMPTRLD when eVMCS is active results in #UD. This matches
genuine Hyper-V's behavior.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
 tools/testing/selftests/kvm/include/x86/vmx.h  |  3 ---
 tools/testing/selftests/kvm/x86/hyperv_evmcs.c | 13 +++++++++++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/kvm/include/x86/vmx.h b/tools/testing/selftests/kvm/include/x86/vmx.h
index 047d02aa9688..e2178a6683ca 100644
--- a/tools/testing/selftests/kvm/include/x86/vmx.h
+++ b/tools/testing/selftests/kvm/include/x86/vmx.h
@@ -325,9 +325,6 @@ static inline int vmptrld(u64 vmcs_pa)
 {
 	u8 ret;
 
-	if (enable_evmcs)
-		return -1;
-
 	__asm__ __volatile__ ("vmptrld %[pa]; setna %[ret]"
 		: [ret]"=rm"(ret)
 		: [pa]"m"(vmcs_pa)
diff --git a/tools/testing/selftests/kvm/x86/hyperv_evmcs.c b/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
index 88262ddf7fcb..6a6d940a7891 100644
--- a/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
+++ b/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
@@ -18,12 +18,16 @@
 #include "hyperv.h"
 #include "vmx.h"
 
+#define VMLAUNCH_INSN_SIZE 3
+#define VMPTRLD_INSN_SIZE 5
+
 static int ud_count;
+static int ud_insn_skip_size;
 
 static void guest_ud_handler(struct ex_regs *regs)
 {
 	ud_count++;
-	regs->rip += 3; /* VMLAUNCH */
+	regs->rip += ud_insn_skip_size;
 }
 
 static void guest_nmi_handler(struct ex_regs *regs)
@@ -182,10 +186,15 @@ void guest_code(struct vmx_pages *vmx_pages, struct hyperv_test_pages *hv_pages,
 	GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
 	GUEST_SYNC(11);
 
+	ud_insn_skip_size = VMPTRLD_INSN_SIZE;
+	vmptrld(hv_pages->enlightened_vmcs_gpa);
+	GUEST_ASSERT(ud_count == 1);
+
 	/* Try enlightened vmptrld with an incorrect GPA */
+	ud_insn_skip_size = VMLAUNCH_INSN_SIZE;
 	evmcs_vmptrld(0xdeadbeef, hv_pages->enlightened_vmcs);
 	GUEST_ASSERT(vmlaunch());
-	GUEST_ASSERT(ud_count == 1);
+	GUEST_ASSERT(ud_count == 2);
 	GUEST_DONE();
 }
 
-- 
2.55.0

Re: [PATCH 4/4] KVM: selftests: Check VMPTRLD with active eVMCS

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The hardcoded `VMPTRLD_INSN_SIZE` of 5 bytes is brittle because `vmptrld` is executed using an inline assembly memory operand constraint (`"m"`), which results in a variable-sized instruction depending on compiler optimizations and register allocation.
--

--- Patch [4]: [PATCH 4/4] KVM: selftests: Check VMPTRLD with active eVMCS ---
commit 80c84d1f71bebfd26712329b4fe8a487216ec3fb
Author: Vitaly Kuznetsov <vkuznets@redhat.com>

KVM: selftests: Check VMPTRLD with active eVMCS

Check that VMPTRLD when eVMCS is active results in #UD. This matches
genuine Hyper-V's behavior.

> diff --git a/tools/testing/selftests/kvm/x86/hyperv_evmcs.c b/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
> index 88262ddf7fcb2..6a6d940a78918 100644
> --- a/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
> +++ b/tools/testing/selftests/kvm/x86/hyperv_evmcs.c
> @@ -18,12 +18,16 @@
>  #include "hyperv.h"
>  #include "vmx.h"
>  
> +#define VMLAUNCH_INSN_SIZE 3
> +#define VMPTRLD_INSN_SIZE 5
> +
>  static int ud_count;
> +static int ud_insn_skip_size;
>  
>  static void guest_ud_handler(struct ex_regs *regs)
>  {
>  	ud_count++;
> -	regs->rip += 3; /* VMLAUNCH */
> +	regs->rip += ud_insn_skip_size;
>  }

[ ... ]

> @@ -182,10 +186,15 @@ void guest_code(struct vmx_pages *vmx_pages, struct hyperv_test_pages *hv_pages,
>  	GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
>  	GUEST_SYNC(11);
>  
> +	ud_insn_skip_size = VMPTRLD_INSN_SIZE;
> +	vmptrld(hv_pages->enlightened_vmcs_gpa);

[Severity: Medium]
Could this hardcoded instruction size lead to guest instruction stream
corruption?

The vmptrld() inline assembly in include/x86/vmx.h uses a memory operand
constraint ("m") for the physical address:

static inline int vmptrld(u64 vmcs_pa)
{
	u8 ret;

	__asm__ __volatile__ ("vmptrld %[pa]; setna %[ret]"
		: [ret]"=rm"(ret)
		: [pa]"m"(vmcs_pa)
		: "cc", "memory");
        ...
}

Depending on compiler optimizations and register allocation, the resulting
instruction might not be exactly 5 bytes in size (for example, it could be 4
or 7 bytes depending on the chosen addressing mode).

Since guest_ud_handler() unconditionally advances regs->rip by
ud_insn_skip_size, if the generated instruction length does not match
VMPTRLD_INSN_SIZE, resuming the guest could land in the middle of an
instruction and cause #GP faults or infinite #UD loops.

> +	GUEST_ASSERT(ud_count == 1);
> +
>  	/* Try enlightened vmptrld with an incorrect GPA */
> +	ud_insn_skip_size = VMLAUNCH_INSN_SIZE;
>  	evmcs_vmptrld(0xdeadbeef, hv_pages->enlightened_vmcs);
>  	GUEST_ASSERT(vmlaunch());
> -	GUEST_ASSERT(ud_count == 1);
> +	GUEST_ASSERT(ud_count == 2);
>  	GUEST_DONE();
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814162221.2144473-1-vkuznets@redhat.com?part=4