Re: [PATCH v6 02/20] KVM: VMX: Save guest EGPRs in VCPU cache

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Live migration of APX-enabled guests results in silent guest state corruption (loss of EGPRs) due to a conflict between manual VCPU register caching and XSAVE state management.
--

--- Patch [2]: [PATCH v6 02/20] KVM: VMX: Save guest EGPRs in VCPU cache ---
commit 8d65deb78b6fe07e8687f8aa1c29bd4e028cfac7
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: VMX: Save guest EGPRs in VCPU cache
    
This patch saves and restores the guest EGPRs on VM exit/entry if the system
supports Advanced Performance Extensions (APX). It saves the EGPR state into
vcpu->arch.regs and clears the hardware registers on exit.

Link: https://lore.kernel.org/adPRA4ZhnvbaXSn0@google.com

> diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
> index 00d807505fc88..702d86ade6b1d 100644
> --- a/arch/x86/kvm/vmx/vmenter.S
> +++ b/arch/x86/kvm/vmx/vmenter.S

[ ... ]

> @@ -193,8 +204,24 @@ SYM_INNER_LABEL_ALIGN(vmx_vmexit, SYM_L_GLOBAL)
>  	mov %_ASM_BX, %_ASM_AX
>  
>  	/* Pop our saved arguments from the stack */
> -	pop %_ASM_BX
> -	pop %_ASM_BX
> +	pop %_ASM_BX	/* @flags */
> +	pop %_ASM_DI	/* @vmx */
> +
> +#ifdef CONFIG_KVM_APX
> +	ALTERNATIVE "jmp .Lclear_egprs_done", "", X86_FEATURE_APX
> +	test	$KVM_ENTER_EGPR_SWITCH, %_ASM_BX
> +	jz	.Lclear_egprs_done
> +	/*
> +	 * Unlike legacy GPRs, saving could be conditional here on VM-Fail,
> +	 * which however isn't in fastpath. Instead, simply saving EGPRs always.
> +	 */
> +	STORE_REGS %_ASM_DI, VMX_vcpu_arch_regs, \
> +		   %r16, %r17, %r18, %r19, %r20, %r21, %r22, %r23, \
> +		   %r24, %r25, %r26, %r27, %r28, %r29, %r30, %r31
> +	CLEAR_REGS %r16d, %r17d, %r18d, %r19d, %r20d, %r21d, %r22d, %r23d, \
> +		   %r24d, %r25d, %r26d, %r27d, %r28d, %r29d, %r30d, %r31d

[Severity: High]
Does clearing the hardware EGPRs here cause state loss during live migration?

When KVM later unloads the vCPU and calls kvm_put_guest_fpu(), it uses the
hardware XSAVES instruction to capture the guest's FPU/extended state into
vcpu->arch.guest_fpu. Because the hardware EGPRs were zeroed here, XSAVES
populates the APX component of the XSAVE buffer with zeros.

When userspace subsequently calls KVM_GET_XSAVE2 to serialize the state for
migration, it exports the zeroed guest_fpu without synchronizing the true
register values from vcpu->arch.regs.

Additionally, userspace cannot fallback to KVM_GET_REGS because the UAPI
struct kvm_regs hasn't been updated to include R16-R31.

Could this lead to APX-enabled guests resuming with zeroed EGPRs after a
migration?

> +.Lclear_egprs_done:
> +#endif
>  
>  	/* ... and then the callee-save registers */
>  	pop %_ASM_BX

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729191656.598771-1-chang.seok.bae@intel.com?part=2