Re: [PATCH v8 09/20] KVM: nVMX: Propagate extended instruction information

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: nvmx: missing eVMCS mapping for EXTENDED_INSTRUCTION_INFO causes host DoS
--

commit 50ba47ea51df9d3191678e833e5b9efb01e769c0
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: nVMX: Propagate extended instruction information

This commit defines the new extended_instruction_info field in struct vmcs12
and propagates it to nested VMX. The propagation is gated on the guest APX
enumeration.

Link: https://lore.kernel.org/aRvOSnaUt1E+%2FpkC@intel.com

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 7229934c38bb1..69302b806a98e 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -4773,6 +4773,12 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
>  		vmcs12->vm_exit_intr_info = exit_intr_info;
>  		vmcs12->vm_exit_instruction_len = exit_insn_len;
>  		vmcs12->vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
> +		/*
> +		 * The APX enumeration guarantees the presence of the extended
> +		 * fields. This CPUID bit alone is sufficient to rely on it.
> +		 */
> +		if (guest_cpu_cap_has(vcpu, X86_FEATURE_APX))
> +			vmcs12->extended_instruction_info = vmcs_read64(EXTENDED_INSTRUCTION_INFO);

[Severity: High]
Does this unconditional read cause an issue when KVM is running as an L1
hypervisor on top of Hyper-V?

When eVMCS is in use, vmcs_read64() transparently redirects to the eVMCS read
handler. If EXTENDED_INSTRUCTION_INFO is not mapped in vmcs_field_to_evmcs_1
for eVMCS v1, evmcs_field_offset() will return -ENOENT.

This missing mapping leads to a host-side warning in get_evmcs_offset()
firing on nested exits:

    WARN_ONCE(offset < 0, "accessing unsupported EVMCS field %lx\n", field);

Because an unprivileged L2 guest could easily trigger these exits, could this
be used as a host-side denial of service in environments where panic_on_warn=1
is enabled?

>  
>  		/*
>  		 * According to spec, there's no need to store the guest's

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930210750.1487547-1-chang.seok.bae@intel.com?part=9