Re: [PATCH v8 02/20] KVM: VMX: Save guest EGPRs in VCPU cache

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] x86/kvm: Host #UD if compiled with APX due to eager XCR0 switching
--

commit 5f3e2588771c8927cac932c31186a1b9a8aea80f
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: VMX: Save guest EGPRs in VCPU cache

This commit enables saving and restoring guest EGPRs on VM exit/entry if
the system supports APX. The patch switches EGPRs during the vmentry/vmexit
assembly path instead of lazily. This avoids conditional checks in register
read/write paths and allows for future usage of APX registers in the kernel.

Link: https://lore.kernel.org/adPRA4ZhnvbaXSn0@google.com

> diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
> index 00d807505fc88..02308fb36f0f5 100644
> --- a/arch/x86/kvm/vmx/vmenter.S
> +++ b/arch/x86/kvm/vmx/vmenter.S
[ ... ]
> @@ -46,6 +47,16 @@ SYM_FUNC_START(__vmx_vcpu_run)
>  	/* Reload @vmx, _ASM_ARG1 may be modified by vmx_update_host_rsp().  */
>  	mov WORD_SIZE(%_ASM_SP), %_ASM_DI
>  
> +#ifdef CONFIG_KVM_APX
> +	ALTERNATIVE "jmp .Lload_egprs_done", "", X86_FEATURE_APX
> +	testl	$KVM_ENTER_EGPR_SWITCH, (%_ASM_SP)
> +	jz	.Lload_egprs_done
> +	LOAD_REGS %_ASM_DI, VMX_vcpu_arch_regs, \
> +		  %r16, %r17, %r18, %r19, %r20, %r21, %r22, %r23, \
> +		  %r24, %r25, %r26, %r27, %r28, %r29, %r30, %r31
> +.Lload_egprs_done:
> +#endif

[Severity: Medium]
If the host kernel is compiled with APX instructions (which this patch
prepares for to allow future usage of APX registers in the kernel), could
this lead to a host #UD in host C code?

In arch/x86/kvm/x86.c:vcpu_enter_guest(), we eagerly set the hardware XCR0
to the guest's value, which disables the APX bit if the guest disabled it:

	kvm_load_xfeatures(vcpu, true);

Just above this new EGPR switch in __vmx_vcpu_run(), we call into host C
code:

	call vmx_update_host_rsp

Since the hardware XCR0 is still the guest's XCR0 at this point, if the
compiler emitted APX instructions in vmx_update_host_rsp() or any other
C code called before VM-Enter (or after VM-Exit), wouldn't the CPU raise
a #UD?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930210750.1487547-1-chang.seok.bae@intel.com?part=2