Re: [PATCH v7 09/20] KVM: nVMX: Propagate extended instruction information

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing Support for EVMCS Field / Reachable WARN_ON
--

commit 24f2192a997da0f16691df1c9b88d4d8d59b8258
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: nVMX: Propagate extended instruction information

Define the new extended_instruction_info field in struct vmcs12 and
propagate it to nested VMX. Gate the propagation on the guest APX
enumeration, which aligns with bare metal behavior.

Link: https://lore.kernel.org/aRvOSnaUt1E+%2FpkC@intel.com

[ ... ]

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 7229934c38bb1..69302b806a98e 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -4773,6 +4773,12 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>  		vmcs12->vm_exit_intr_info = exit_intr_info;
>  		vmcs12->vm_exit_instruction_len = exit_insn_len;
>  		vmcs12->vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
> +		/*
> +		 * The APX enumeration guarantees the presence of the extended
> +		 * fields. This CPUID bit alone is sufficient to rely on it.
> +		 */
> +		if (guest_cpu_cap_has(vcpu, X86_FEATURE_APX))
> +			vmcs12->extended_instruction_info = vmcs_read64(EXTENDED_INSTRUCTION_INFO);

[Severity: High]
Could this lead to a host-side Denial of Service when KVM is running as a
nested hypervisor on top of Hyper-V?

When EVMCS is active (kvm_is_using_evmcs() returns true) and the L2 guest
has the APX feature, prepare_vmcs12() will unconditionally execute
vmcs_read64(EXTENDED_INSTRUCTION_INFO).

Since EXTENDED_INSTRUCTION_INFO does not appear to be present in the EVMCS
mapping array (vmcs_field_to_evmcs_1), won't the subsequent call to
get_evmcs_offset() return -ENOENT and trigger a WARN_ONCE?

If panic_on_warn is enabled, an unprivileged L2 guest could potentially
trigger a host panic just by issuing a nested VM-exit.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902021804.718676-1-chang.seok.bae@intel.com?part=9