Re: [PATCH v2] KVM: VMX: Add array_index_nospec() to evmcs_field_offset()

[Paolo Bonzini]

On Sat, Oct 31, 2026 at 10:05 AM Amirmohammad Eftekhar
<amirmohammad.eftekhar@xxxxxxxx> wrote:
>
> evmcs_field_offset() bounds-checks the guest-supplied field index against
> nr_evmcs_1_fields and then indexes vmcs_field_to_evmcs_1[] without an
> array_index_nospec() clamp, unlike its vmcs12 counterpart
> get_vmcs12_field_offset().
>
> A regular VMREAD instruction is allowed while an enlightened VMCS is active
> since 6cbbaab60ff3 ("KVM: nVMX: Allow VMREAD when Enlightened VMCS is in
> use"), and it reaches evmcs_field_offset() with a guest-supplied field
> encoding. Because the index is not clamped, the guest may be able to
> speculatively access past the bound check and read out of bounds of
> vmcs_field_to_evmcs_1[] (Spectre v1). The leaked value is only the u16
> 'offset', so the exposure is limited.
>
> The other callers of evmcs_field_offset() are not under direct guest
> control, but the array_index_nospec() clamp does not hurt them.
>
> Clamp the index with array_index_nospec(), mirroring
> get_vmcs12_field_offset().
>
> Fixes: 6cbbaab60ff3 ("KVM: nVMX: Allow VMREAD when Enlightened VMCS is in use")
> Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@xxxxxxxx>
> ---

Queued, thanks.

Paolo