Re: [PATCH v10 13/28] KVM: VMX: Virtualize FRED nested exception tracking

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] KVM incorrectly flags an exception as nested when it replaces an un-injected, merely pending exception.
--

commit a3ba5314358330c25b6d179842584793ca6f0e34
Author: Xin Li (Intel) <xin@zytor.com>

KVM: VMX: Virtualize FRED nested exception tracking

This commit adds virtualization support for FRED nested exception tracking in
KVM by setting the VMX nested exception bit in the VM-entry interruption
information field. It also updates exception queueing to track and save the
nested flag across VM migrations.

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 01198aba27cf0..94d684210cf6c 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c

[ ... ]

> @@ -510,6 +516,9 @@ static void kvm_multiple_exception(struct kvm_vcpu *vcpu, unsigned int nr,
>  
>  		kvm_queue_exception_e(vcpu, DF_VECTOR, 0);
>  	} else {
> +		/* The new exception arrived while delivering the previous one. */
> +		is_nested = true;
> +

[Severity: High]
Is it correct to unconditionally set is_nested = true here even if the
previous exception was only pending and not yet injected?

If KVM queues an exception in software (vcpu->arch.exception.pending = true,
injected = false) and a second exception is queued before the next VM-entry
(e.g., a #PF during subsequent KVM request processing or emulation), this
path replaces the purely pending exception with the new one. 

Since an exception that hasn't commenced hardware delivery cannot cause a
nested exception, setting is_nested = true here will inject the new exception
with INTR_INFO_NESTED_EXCEPTION_MASK. Could this violate the FRED architecture
specification by causing the guest hardware to incorrectly interpret the event
as occurring during event delivery, pushing a FRED stack frame with the nested
bit set and potentially selecting an incorrect ring 0 stack level (such as
IA32_FRED_RSP1 instead of IA32_FRED_RSP0)?

>  		/* replace previous exception with a new one in a hope
>  		   that instruction re-execution will regenerate lost
>  		   exception */
> @@ -538,7 +547,8 @@ static void kvm_queue_exception_e_p(struct kvm_vcpu *vcpu, unsigned nr,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911213659.2025974-1-sohil.mehta@intel.com?part=13