Re: [PATCH v5 16/20] KVM: x86: Add APX in supported XCR0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Enabling APX pushes the default uncompacted FPU uABI size over 4096 bytes, which triggers a WARN_ON_ONCE on every vCPU creation and breaks the legacy KVM_GET_XSAVE API.
--

--- Patch [16]: [PATCH v5 16/20] KVM: x86: Add APX in supported XCR0 ---
commit 0df85d22c18b5d5d318f03dea201f8b5d3746f25
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Add APX in supported XCR0

This commit enables APX support in KVM by setting the APX bit in
kvm_caps.supported_xcr0 when the host has APX enabled and CONFIG_KVM_APX
is configured.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 266d7a02855bb..48f8a2d699879 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -7082,6 +7082,8 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>  	if (boot_cpu_has(X86_FEATURE_XSAVE)) {
>  		kvm_host.xcr0 = xgetbv(XCR_XFEATURE_ENABLED_MASK);
>  		kvm_caps.supported_xcr0 = kvm_host.xcr0 & KVM_SUPPORTED_XCR0;
> +		if (IS_ENABLED(CONFIG_KVM_APX))
> +			kvm_caps.supported_xcr0 |= kvm_host.xcr0 & XFEATURE_MASK_APX;

[Severity: High]
This is a pre-existing issue, but does enabling APX here push the default
uncompacted FPU uABI size over 4096 bytes?

Because the uncompacted XSAVE layout fixed by CPUID places APX after AMX
(which is 8KB), the offset for APX appears to be over 10.7KB. Since APX is
not an XFD feature, it would be included in the default size calculation.

If fpu_user_cfg.default_size exceeds 4096 bytes (sizeof(struct kvm_xsave)),
it looks like fpu_alloc_guest_fpstate() will trigger a WARN_ON_ONCE on every
vCPU creation, potentially causing a local denial of service if panic_on_warn
is set:

arch/x86/kernel/fpu/core.c:fpu_alloc_guest_fpstate() {
...
	gfpu->uabi_size		= sizeof(struct kvm_xsave);
	if (WARN_ON_ONCE(fpu_user_cfg.default_size > gfpu->uabi_size))
		gfpu->uabi_size = fpu_user_cfg.default_size;
...
}

Could this also break the legacy KVM_GET_XSAVE API for userspace?
Once uabi_size exceeds sizeof(struct kvm_xsave), KVM_GET_XSAVE seems to
unconditionally fail:

arch/x86/kvm/x86.c:kvm_arch_vcpu_ioctl() {
...
	case KVM_GET_XSAVE: {
		r = -EINVAL;
		if (vcpu->arch.guest_fpu.uabi_size > sizeof(struct kvm_xsave))
			break;
...
}

>  	}
>  
>  	if (boot_cpu_has(X86_FEATURE_XSAVES)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720171949.498680-1-chang.seok.bae@intel.com?part=16