Re: [PATCH v10 16/28] KVM: x86: Mark CR4.FRED as not reserved

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing architectural check for CR4.FRED when clearing CR0.PG leads to VM-entry failure and VM crash.
--

commit 8a690b67e3843377a671848b2a774dffef3545bc
Author: Xin Li (Intel) <xin@zytor.com>

KVM: x86: Mark CR4.FRED as not reserved

The CR4.FRED bit, i.e., CR4[32], is no longer a reserved bit when
guest cpu cap has FRED. Otherwise it is still a reserved bit.

> diff --git a/arch/x86/kvm/regs.c b/arch/x86/kvm/regs.c
> index 8f66438989e47..ba6c8856b4ffa 100644
> --- a/arch/x86/kvm/regs.c
> +++ b/arch/x86/kvm/regs.c
> @@ -429,6 +429,13 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
>  			return 1;
>  	}
>  
> +	/*
> +	 * FRED can not be enabled when EFER.LMA=0.  Note, MOV to CR4 outside
> +	 * 64-bit mode clears CR4[63:32] so only emulation can get here.
> +	 */
> +	if ((cr4 & X86_CR4_FRED) && !is_long_mode(vcpu))
> +		return 1;
> +

[Severity: High]
Does unreserving CR4.FRED also require an update to kvm_set_cr0() when
clearing CR0.PG?

If a guest operating in compatibility mode (CS.L=0) with CR4.FRED=1 executes
MOV CR0 to clear the CR0.PG bit, kvm_set_cr0() will allow the operation
because it only checks for is_64_bit_mode() and X86_CR4_PCIDE:

arch/x86/kvm/regs.c:kvm_set_cr0() {
	...
	if (!(cr0 & X86_CR0_PG) &&
	    (is_64_bit_mode(vcpu) || kvm_is_cr4_bit_set(vcpu, X86_CR4_PCIDE)))
		return 1;
	...
}

Because kvm_set_cr0() fails to check for X86_CR4_FRED, KVM allows the
operation, clears CR0.PG, and subsequently clears EFER.LMA and the
VM_ENTRY_IA32E_MODE control.

This results in a hardware VM-entry failure ("invalid guest state") because
the hardware checks require CR4.FRED to be 0 if the IA-32e mode guest control
is 0. This hardware failure leads to KVM_EXIT_FAIL_ENTRY and crashes the
hypervisor process hosting the VM, whereas KVM should have injected a #GP.

>  	if ((cr4 & X86_CR4_CET) && !kvm_is_cr0_bit_set(vcpu, X86_CR0_WP))
>  		return 1;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911213659.2025974-1-sohil.mehta@intel.com?part=16