Re: [PATCH v7 16/20] KVM: x86: Add APX to supported XCR0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Adding APX host support inflates KVM's FPU uabi_size beyond 4096 bytes for all VMs, completely breaking the KVM_GET_XSAVE and KVM_SET_XSAVE UAPIs for legacy VMMs on APX-capable hosts.
--

commit f809671f7be8f3b21dbbd90937f8c5a3e917c643
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Add APX to supported XCR0

This commit sets kvm_caps.supported_xcr0 for APX when the host has enabled
the APX state and CONFIG_KVM_APX is configured. This allows KVM to expose
APX features to guests.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 76f70d2631f67..8c6365122efb8 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c

[ ... ]

> @@ -7132,6 +7132,8 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>  	if (boot_cpu_has(X86_FEATURE_XSAVE)) {
>  		kvm_host.xcr0 = xgetbv(XCR_XFEATURE_ENABLED_MASK);
>  		kvm_caps.supported_xcr0 = kvm_host.xcr0 & KVM_SUPPORTED_XCR0;
> +		if (IS_ENABLED(CONFIG_KVM_APX))
> +			kvm_caps.supported_xcr0 |= kvm_host.xcr0 & XFEATURE_MASK_APX;

[Severity: High]
This is a pre-existing issue, but does enabling APX host support here
inadvertently break the KVM_GET_XSAVE and KVM_SET_XSAVE UAPIs for legacy
VMMs?

Because APX (component 19) is a static user feature, its inclusion in
fpu_user_cfg.default_features requires an uncompacted offset that
accommodates the 8KB AMX (component 18) hole. This results in an uncompacted
offset greater than 10KB, which inflates fpu_user_cfg.default_size.

When KVM initializes a vCPU, it sets the baseline uabi_size to this
inflated value:

arch/x86/kernel/fpu/core.c:fpu_alloc_guest_fpstate() {
    ...
    if (WARN_ON_ONCE(fpu_user_cfg.default_size > gfpu->uabi_size))
        gfpu->uabi_size = fpu_user_cfg.default_size;
    ...
}

Consequently, uabi_size grows beyond the standard 4096 bytes for all VMs.

For older VMMs attempting to use the standard 4096-byte buffers,
kvm_arch_vcpu_ioctl() handles the UAPI boundary by unconditionally failing
KVM_GET_XSAVE with -EINVAL:

arch/x86/kvm/x86.c:kvm_arch_vcpu_ioctl() {
    ...
    case KVM_GET_XSAVE: {
        r = -EINVAL;
        if (vcpu->arch.guest_fpu.uabi_size > sizeof(struct kvm_xsave))
            break;
    ...
}

Similarly, for KVM_SET_XSAVE, it reads out of bounds from the 4096-byte user
buffer, returning -EFAULT:

arch/x86/kvm/x86.c:kvm_arch_vcpu_ioctl() {
    ...
    case KVM_SET_XSAVE: {
        int size = vcpu->arch.guest_fpu.uabi_size;

        u.xsave = memdup_user(argp, size);
    ...
}

Could this deterministically break VM creation and live migration on
APX-capable hosts for legacy VMMs?

>  	}
>  
>  	if (boot_cpu_has(X86_FEATURE_XSAVES)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902021804.718676-1-chang.seok.bae@intel.com?part=16