Re: [PATCH v8 08/20] KVM: VMX: Support instruction information extension

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: vmx: eVMCS mapping missing for EXTENDED_INSTRUCTION_INFO on APX hosts
--

commit 2d697a70afdaa50d39579af2713731bbc6805336
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: VMX: Support instruction information extension

Define the VMCS field offset for the extended instruction information.
Then, support 5-bit register indices retrieval from VMCS fields.
Note the APX enumeration alone indicates the extension is available.

Link: https://lore.kernel.org/aakEsXJgO-3m2xca@google.com

> diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
> index 863b08478544f..4a76af6137201 100644
> --- a/arch/x86/kvm/vmx/vmx.h
> +++ b/arch/x86/kvm/vmx/vmx.h
[ ... ]
> @@ -714,20 +723,22 @@ static inline bool vmx_guest_state_valid(struct kvm_vcpu *vcpu)
>  
>  void dump_vmcs(struct kvm_vcpu *vcpu);
>  
> -/* A placeholder to smoothen 64-bit extension */
>  static inline u64 vmx_get_instr_info(void)
>  {
> -	return vmcs_read32(VMX_INSTRUCTION_INFO);
> +	return vmx_instr_info_extended() ? vmcs_read64(EXTENDED_INSTRUCTION_INFO) :
> +					   vmcs_read32(VMX_INSTRUCTION_INFO);
>  }

[Severity: High]
Is a new eVMCS mapping required here?

When KVM runs as L1 on top of Hyper-V (using eVMCS), vmx_get_instr_info()
unconditionally calls vmcs_read64(EXTENDED_INSTRUCTION_INFO) if the underlying
host CPU exposes APX (cpu_feature_enabled(X86_FEATURE_APX)).

Because EXTENDED_INSTRUCTION_INFO (0x2406) is not defined in the eVMCS mapping
(vmcs_field_to_evmcs_1 in arch/x86/kvm/vmx/hyperv_evmcs.c), evmcs_read64()
fails with -ENOENT, triggers a WARN_ONCE, and returns 0.

This is reachable by any L2 guest performing a CR access or VMX instruction
when KVM runs on an APX-capable host under Hyper-V.

It causes KVM to incorrectly decode operands for all control-register accesses
and nested VMX instructions (defaulting to the RAX register), leading to total
failure of nested virtualization.

Note: The related vmcs12 nesting issue raised in the original concern was
correctly resolved in follow-up patch 9 (commit 50ba47ea51df), but the eVMCS
issue remains broken through the end of the series.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930210750.1487547-1-chang.seok.bae@intel.com?part=8