[PATCH] x86/hyper-v: Don't WARN on VM-Enter if eVMCS sees VMFUNC[63:32] != 0

From: Manuel Andreas

Date: Tue Oct 20 2026 - 15:35:20 EST


With the necessary Hyper-V extensions for eVMCS enabled, an L1 guest can
trivially fire a WARN_ON_ONCE in nested_evmcs_check_controls.
While vmcs12->vm_function_control is technically already sanity checked in
nested.c, that check is only performed if VMFUNC functionality is at all enabled
in the secondary processor controls of vmcs12.

vmcs12->vm_function_control seems to only be utilized in the handling
of a VMFUNC initiated from L2, but here a function other than 0 will
just end up in a failure case either way, regardless of whether or not
it is permissive in vmcs12->vm_function_control.
Therefore, the check has no reason to trigger a warning at all.

This patch simply removes the WARN_ON_ONCE and keeps the check.

Fixes: 3ff8a13d41b2 ("KVM: nVMX: WARN once and fail VM-Enter if eVMCS sees VMFUNC[63:32] != 0")
Signed-off-by: Manuel Andreas <manuel.andreas@xxxxxx>
---
arch/x86/kvm/vmx/hyperv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/hyperv.c b/arch/x86/kvm/vmx/hyperv.c
index fa41d036acd4..008a06924eb4 100644
--- a/arch/x86/kvm/vmx/hyperv.c
+++ b/arch/x86/kvm/vmx/hyperv.c
@@ -186,7 +186,7 @@ int nested_evmcs_check_controls(struct vmcs12 *vmcs12)
* controls in bits 63:32, i.e. dropping those bits on the consistency
* check is intentional.
*/
- if (WARN_ON_ONCE(vmcs12->vm_function_control >> 32))
+ if (vmcs12->vm_function_control >> 32)
return -EINVAL;

if (CC(!nested_evmcs_is_valid_controls(EVMCS_VMFUNC,
--
2.56.0