Re: [PATCH v10 21/28] KVM: nVMX: Handle FRED VMCS fields in nested VMX context

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] L2 guest state corruption: FRED MSRs leak across VMRESUME when L1 configures LOAD_IA32_FRED=1 and SAVE_IA32_FRED=0.
- [Medium] Missing VM-entry consistency checks allow L1 to bypass guest FRED MSR validation and trigger hardware VM-entry failures.
--

commit 057f971773a8afea0241cab2d4cb47bca7dc2643
Author: Xin Li (Intel) <xin@zytor.com>
Subject: KVM: nVMX: Handle FRED VMCS fields in nested VMX context

Extend nested VMX context management to include FRED-related VMCS fields,
enabling proper handling of FRED state during nested virtualization.

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> index 6576935b9d43f..83e846fb3fc8c 100644
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c

[ ... ]

> @@ -2755,6 +2792,10 @@ static void prepare_vmcs02_rare(struct vcpu_vmx *vmx, struct vmcs12 *vmcs12)
>  				     vmcs12->guest_ssp, vmcs12->guest_ssp_tbl);
>  
>  	set_cr4_guest_host_mask(vmx);
> +
> +	if (guest_cpu_cap_has(&vmx->vcpu, X86_FEATURE_FRED) &&
> +	    nested_cpu_load_guest_fred_state(vmcs12))
> +		vmcs_write_fred_msrs(&vmcs12->guest_fred_msrs);
>  }

[Severity: High]
Can this lead to L2 guest state corruption?

When L1 sets VM_ENTRY_LOAD_IA32_FRED=1 but VM_EXIT_SAVE_IA32_FRED=0, it
expects L2's FRED MSRs to be reset to the values in vmcs12 on every VM-entry.

Because the vmcs02 update is placed here inside prepare_vmcs02_rare(), it is
skipped on a clean VMRESUME operation. Since FRED MSRs are passed through to
L2 (via the MSR bitmap), L2 can modify them directly without triggering a
VM-exit.

Hardware saves these modified values to vmcs02 on VM-exit, but KVM does not
sync them back to vmcs12 (because SAVE_IA32_FRED=0). On the next VMRESUME,
prepare_vmcs02_rare() is bypassed, leaving the stale, modified L2 values in
vmcs02. L2 will therefore inherit its previous modified state instead of the
clean baseline values configured by L1 in vmcs12.

[ ... ]

[Severity: Medium]
Could KVM miss a VM-entry consistency check during FRED MSR validation?

Looking at nested_vmx_check_guest_state() in arch/x86/kvm/vmx/nested.c,
the FRED MSR validation is nested under the ia32e condition:

	if (ia32e) {
		if (nested_cpu_load_guest_fred_state(vmcs12)) {
			if (CC(vmcs12->guest_ia32_fred_config & FRED_CONFIG_RESERVED) ||

If an L1 hypervisor sets VM_ENTRY_LOAD_IA32_FRED=1 but clears
VM_ENTRY_IA32E_MODE=0, these checks bypass the validation of
guest_ia32_fred_config and other FRED MSRs.

Additionally, KVM appears to lack the cross-control verification required
by the SDM where LOAD_IA32_FRED=1 requires IA32E_MODE=1. As a result, KVM
might attempt to VMLAUNCH vmcs02 with invalid state, which hardware rejects
with a VM-instruction error and triggers the warn_on_missed_cc path.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911213659.2025974-1-sohil.mehta@intel.com?part=21