Re: [PATCH v8 12/20] KVM: x86: Support REX2-prefixed opcode decode

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: x86: guest-triggerable host panic via REX2-prefixed vector instructions
--

commit a843761e784b5038177694143d4c70279320d66e
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Support REX2-prefixed opcode decode

This commit extends the KVM x86 instruction decoder to recognize and handle
the REX2 prefix, including validation of prefix sequences and correct opcode
table selection.

Link: https://lore.kernel.org/CABgObfYYGTvkYpeyqLSr9JgKMDA_STSff2hXBNchLZuKFU+MMA@mail.gmail.com

> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index a1a567fd03780..eba4e9b7cd5cf 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
[ ... ]
> @@ -4980,6 +5002,12 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len, int
>  	if (ctxt->rex_bits & REX_W)
>  		ctxt->op_bytes = 8;
>  
> +	/* REX2 opcode is one byte unless M-bit selects the two-byte map */
> +	if (ctxt->rex_bits & REX_M)
> +		goto decode_twobytes;

[Severity: Critical]
Could this jump to decode_twobytes allow a malicious guest to trigger a host
kernel panic?

If a guest constructs an SSE or vector instruction (such as MOVUPS in the
0x0F map) prefixed with a REX2 byte (0xD5) where the REX2 payload sets the
M-bit and an extended register bit like R4, this will jump to
decode_twobytes and look up the opcode in twobyte_table.

Because vector instructions in twobyte_table lack the NoRex2 flag, the
validation check for NoRex2 further down in x86_decode_insn() will pass
instead of raising #UD.

The payload bit R4 causes the register index to be >= 16. When evaluating
the Sse flag:

arch/x86/kvm/emulate.c:__decode_register_operand() {
...
	if (ctxt->d & (Avx|Sse)) {
		op->type = OP_XMM;
		op->bytes = 16;
		op->addr.xmm = reg;
		kvm_read_sse_reg(reg, &op->vec_val);
		return;
	}
...
}

It unconditionally calls kvm_read_sse_reg() with this extended index. The
index >= 16 falls into the default case in KVM's fpu handling:

arch/x86/kvm/fpu.h:_kvm_read_sse_reg() {
...
	case 15: asm("movdqa %%xmm15, %0" : "=m"(*data)); break;
#endif
	default: BUG();
}

Does the NoRex2 flag need to be added to vector instructions in twobyte_table
to prevent this BUG() from being reachable?

> +	else if (ctxt->rex_prefix == REX2_PREFIX)
> +		goto decode_onebyte;
> +
>  	/* Opcode byte(s). */
>  	if (ctxt->b == 0xc4 || ctxt->b == 0xc5) {
>  		/* VEX or LDS/LES */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930210750.1487547-1-chang.seok.bae@intel.com?part=12