Re: [RFC 4/4] KVM: selftests: Test VM-entry failure handling for nested VM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The test configures an architecturally invalid VMCS12 host CET state, causing physical hardware to reject KVM's L1 VM-Entry.
- [High] L1 configures `MSR_IA32_S_CET` without enabling `CR4.CET` and `CR0.WP`, causing physical hardware to reject KVM's L1 VM-Entry.
--

commit 0167d3a43f196a36484ad8300e0c72caf7470746
Author: Zhao Liu <zhao1.liu@intel.com>

KVM: selftests: Test VM-entry failure handling for nested VM
    
This commit adds a test for the CET state L1 sees after a nested VM-entry
fails. It tests all four combinations of the two VM-entry/exit load CET
state controls with two different failure points. It then checks L1's
S_CET and INT_SSP_TAB MSRs to verify the expected behavior.

> diff --git a/tools/testing/selftests/kvm/x86/vmx_nested_entry_fail_state_test.c b/tools/testing/selftests/kvm/x86/vmx_nested_entry_fail_state_test.c
> new file mode 100644
> index 0000000000000..ed0cb045ed53a
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/x86/vmx_nested_entry_fail_state_test.c
[ ... ]
> +static const struct test_state states[NR_STATE_SRCS] = {
> +	[STATE_SRC_L1] = {
> +		.cet = {
> +			.s_cet		= CET_SHSTK_EN,
> +			/*
> +			 * SSP is not an MSR; the L1 SSP must be configured
> +			 * using the KVM_SET_ONE_REG ioctl. To simplify the
> +			 * test logic, checking the other MSRs is enough to
> +			 * identify the state source, so that there's no need
> +			 * to configure different SSPs.
> +			 */
> +			.ssp		= 0x0000111111111000UL,
> +			.ssp_tbl	= 0x0000123456789000UL,
> +		}
> +	},
> +	[STATE_SRC_VMCS12_GUEST] = {
> +		.cet = {
> +			.s_cet		= CET_SHSTK_EN | CET_WRSS_EN,
> +			.ssp		= 0x0000111111111000UL,
> +			.ssp_tbl	= 0x00000abcabcab000UL,
> +		}
> +	},
> +	[STATE_SRC_VMCS12_HOST] = {
> +		.cet = {
> +			.s_cet		= CET_WRSS_EN,

[Severity: High]
Does the states array configure an architecturally invalid VMCS12 host CET
state?

According to the Intel SDM (Vol 3C, Section 26.2.3), if SHSTK_EN is 0,
WRSS_EN must also be 0. Here, it sets CET_WRSS_EN (WRSS_EN=1) while SHSTK_EN
is 0.

Because KVM currently does not validate this specific rule, it accepts the
invalid host state and loads it into L1's state during the nested VM-exit.

When KVM then performs a physical vmresume to enter L1, the physical CPU
enforces the rule, rejects the VM-Entry with EXIT_REASON_INVALID_STATE (33),
and causes KVM to inject a KVM_EXIT_INTERNAL_ERROR, crashing the selftest.

> +			.ssp		= 0x0000111111111000UL,
> +			.ssp_tbl	= 0x00007edcba987000UL,
> +		}
> +	},
> +};
[ ... ]
> +static void l1_load_own_state(void)
> +{
> +	if (has_shstk) {
> +		const struct cet_state *cet = &states[STATE_SRC_L1].cet;
> +
> +		wrmsr(MSR_IA32_S_CET, cet->s_cet);
> +		wrmsr(MSR_IA32_INT_SSP_TAB, cet->ssp_tbl);

[Severity: High]
Will this write to MSR_IA32_S_CET cause physical hardware to reject KVM's L1
VM-Entry?

In l1_load_own_state(), L1 writes CET_SHSTK_EN to MSR_IA32_S_CET, but the
test never enables X86_CR4_CET or X86_CR0_WP in L1's control registers.

KVM statically enables VM_ENTRY_LOAD_CET_STATE for L1 guests when CET is
supported, which means the physical CPU enforces guest state checks on L1
during vmlaunch or vmresume.

According to the Intel SDM (Vol 3C, Section 26.3.1.1), if
VM_ENTRY_LOAD_CET_STATE is 1 and IA32_S_CET.SHSTK_EN is 1, then CR4.CET and
CR0.WP must both be 1.

Because L1's guest state in vmcs01 has SHSTK_EN=1 but CR4.CET=0 and CR0.WP=0,
the physical hardware will reject the VM-Entry into L1 with
EXIT_REASON_INVALID_STATE (33).

This results in KVM intercepting the failure, injecting
KVM_EXIT_INTERNAL_ERROR, and crashing the selftest.

Should the test explicitly set X86_CR4_CET and X86_CR0_WP before configuring
CET?

> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904023105.1167376-1-zhao1.liu@intel.com?part=4