Re: [PATCH v6 15/20] KVM: x86: Guard valid XCR0.APX settings

Re: [PATCH v6 15/20] KVM: x86: Guard valid XCR0.APX settings

[Christian Ludloff]

> In the non-compacted XSAVE format, APX and MPX conflict on the same
> offset. Although MPX is being deprecated in practice, KVM should
> explicitly reject such configurations that set both bits.

The ISA does not preclude an implementation that
supports both MPX and APX simultaneously.

Properly written SW deals with that possibility...  :)

--
C.

Re: [PATCH v6 15/20] KVM: x86: Guard valid XCR0.APX settings

[Sean Christopherson]

On Wed, Jul 29, 2026, Christian Ludloff wrote:
> > In the non-compacted XSAVE format, APX and MPX conflict on the same
> > offset. Although MPX is being deprecated in practice, KVM should
> > explicitly reject such configurations that set both bits.
> 
> The ISA does not preclude an implementation that
> supports both MPX and APX simultaneously.
> 
> Properly written SW deals with that possibility...  :)

Off-topic, can you fix your mail client/configuration to use In-Reply-To?  I assume
that's what breaks threading for myself and lore.

Thanks!

[PATCH v6 00/20] KVM: x86: Enable APX for guests

[Chang S. Bae]

Hi Paolo,

On 7/21/2026 12:09 AM, Paolo Bonzini wrote:
> please give a read to its comments in case it found something important.

Here is a small follow-up revision addressing Sashiko's comments:

 * Patch02: Fix "register saving" wording in the changelog.
 * Patch17: Add the APX leaf to cpuid_function_is_indexed().

Rerunning Sashiko locally, it still appears to be somewhat confused by
the potential in-kernel usages and a few ordering of changes, so it may
report similar issues again on this posting.

I assume the V5 changes are still under review, so attaching the previous
cover letter and leaving the V5 notes in each patch.

---

One topic worth highlighting first is about how to handle userspace
writes to the APX state through the KVM XSAVE API, following the
discussion here:

  https://lore.kernel.org/CABgObfaocwfLdUBKJYYYEDH8X3n6iEbMsscbaCe_C=8JNnhDBA@mail.gmail.com

So what this revision ended up with is just to keep those copy paths from
userspace and acknowledge the redundant copy to VCPU cache / guest
fpstate. Patch3 has more context on that.

Besides that, this revision has several fixes and improvements. Sean
gave feedbacks. 0-day spotted on an issue. Also, since the preparatory
patches have been merged into the mainline, finally a review bot could
provide some feedbacks as well. The major changes are:

 1. VMX Instruction Information Extension

    During the time of V4, 0-day reported out an issue with patch7.
    Fixing that also revealed patch4 was missing another function.

    With a review bot's feeback, patch7 was also updated to ensure EGPR
    indices for handling debug-register accesses. Also looking at
    associated macros, patch6 was added for further cleanup.

 2. Emulator Register Tracking

    The review bot at hand also found a potential shift-out-bounds issue
    in the register tracking. Patch10 was fixed.

 3. APX Feature Exposure

    As per Sean's feedback, the APX XCR0 and userspace exposure were
    reworked a bit in patch14-18.

Thanks,
Chang

Reference:
 * Repo: git://github.com/intel/apx.git apx-kvm_v6
 * V5: https://lore.kernel.org/20260512011502.53072-1-chang.seok.bae@intel.com
 * KVM-unit-test patch: https://lore.kernel.org/20260420212355.507827-1-chang.seok.bae@intel.com

Chang S. Bae (19):
  KVM: x86: Extend VCPU registers for EGPRs
  KVM: VMX: Save guest EGPRs in VCPU cache
  KVM: x86: Support APX state for XSAVE ABI
  KVM: VMX: Refactor VMX instruction information access
  KVM: VMX: Refactor instruction information decoding
  KVM: VMX: Remove unused control-register access defines
  KVM: VMX: Refactor register index retrieval from exit qualification
  KVM: VMX: Support instruction information extension
  KVM: nVMX: Propagate extended instruction information
  KVM: x86: Support EGPR accessing and tracking for emulator
  KVM: x86: Handle EGPR index and REX2-incompatible opcodes
  KVM: x86: Support REX2-prefixed opcode decode
  KVM: x86: Reject EVEX-prefixed instructions
  KVM: x86: Guard valid XCR0.APX settings
  KVM: x86: Add APX to supported XCR0
  KVM: x86: Expose APX foundation feature to userspace
  KVM: x86: Expose APX sub-features to userspace
  KVM: x86: selftests: Add APX state and ABI test
  KVM: x86: selftests: Add APX state handling and XCR0 sanity checks

Sean Christopherson (1):
  KVM: x86: Move KVM_SUPPORTED_{XCR0,XSS} into kvm_x86_vendor_init()

 arch/x86/Kconfig.assembler                    |   5 +
 arch/x86/include/asm/cpuid/api.h              |   1 +
 arch/x86/include/asm/kvm_host.h               |  19 ++
 arch/x86/include/asm/kvm_vcpu_regs.h          |  50 +++++
 arch/x86/include/asm/vmx.h                    |  22 +-
 arch/x86/kvm/Kconfig                          |   4 +
 arch/x86/kvm/cpuid.c                          |  27 ++-
 arch/x86/kvm/cpuid.h                          |   2 +
 arch/x86/kvm/emulate.c                        | 121 +++++++----
 arch/x86/kvm/kvm_emulate.h                    |  21 +-
 arch/x86/kvm/reverse_cpuid.h                  |   6 +
 arch/x86/kvm/svm/svm.c                        |   8 +-
 arch/x86/kvm/vmenter.h                        |   1 +
 arch/x86/kvm/vmx/nested.c                     |  75 +++----
 arch/x86/kvm/vmx/nested.h                     |   2 +-
 arch/x86/kvm/vmx/vmcs12.c                     |   1 +
 arch/x86/kvm/vmx/vmcs12.h                     |   3 +-
 arch/x86/kvm/vmx/vmenter.S                    |  31 ++-
 arch/x86/kvm/vmx/vmx.c                        |  28 ++-
 arch/x86/kvm/vmx/vmx.h                        |  77 ++++++-
 arch/x86/kvm/x86.c                            |  92 +++++++--
 tools/testing/selftests/kvm/Makefile.kvm      |   1 +
 .../selftests/kvm/include/x86/processor.h     | 120 +++++++++++
 tools/testing/selftests/kvm/x86/apx_test.c    | 191 ++++++++++++++++++
 tools/testing/selftests/kvm/x86/state_test.c  |   3 +
 .../selftests/kvm/x86/xcr0_cpuid_test.c       |  19 ++
 26 files changed, 802 insertions(+), 128 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/x86/apx_test.c


base-commit: a204badd8432f93b7e862e7dac6db0fe3d65f370
-- 
2.53.0

[PATCH v6 15/20] KVM: x86: Guard valid XCR0.APX settings

[Chang S. Bae]

Prevent invalid XCR0.APX configurations in two cases: conflict with MPX
and lack of SVM support.

In the non-compacted XSAVE format, APX and MPX conflict on the same
offset. Although MPX is being deprecated in practice, KVM should
explicitly reject such configurations that set both bits.

At this point, only VMX supports EGPRs. SVM will require corresponding
extensions to handle EGPR indices.

Updating the supported XCR0 mask will be done separately.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
Link: https://lore.kernel.org/ab3f4937-38f5-4354-8850-bf773c159bbe@redhat.com
---
 arch/x86/kvm/svm/svm.c | 7 ++++++-
 arch/x86/kvm/x86.c     | 4 ++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index ef69a51ab27f..eb1b2ba1261d 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -5612,8 +5612,13 @@ static __init int svm_hardware_setup(void)
 		return -EOPNOTSUPP;
 	}
 
+	/*
+	 * APX introduces EGPRs, which require additional VMCB support.
+	 * Disable APX until the necessary extensions are handled.
+	 */
 	kvm_caps.supported_xcr0 &= ~(XFEATURE_MASK_BNDREGS |
-				     XFEATURE_MASK_BNDCSR);
+				     XFEATURE_MASK_BNDCSR  |
+				     XFEATURE_MASK_APX);
 
 	if (tsc_scaling) {
 		if (!boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 84b2dcfcb007..266d7a02855b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -682,6 +682,10 @@ int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
 	    (!(xcr0 & XFEATURE_MASK_BNDCSR)))
 		return 1;
 
+	/* MPX and APX conflict in the non-compacted XSAVE format */
+	if (xcr0 & XFEATURE_MASK_BNDREGS && xcr0 & XFEATURE_MASK_APX)
+		return 1;
+
 	if (xcr0 & XFEATURE_MASK_AVX512) {
 		if (!(xcr0 & XFEATURE_MASK_YMM))
 			return 1;
-- 
2.53.0