Re: [PATCH v10 25/28] KVM: nVMX: Enable VMX FRED controls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] KVM unconditionally advertises nested VMX FRED controls to L1 guests without verifying host or guest FRED CPUID capabilities, leading to silent state drops during nested transitions.
--

commit 8c95c51cce41b2dd05048f8b79efa91ac6528519
Author: Xin Li (Intel) <xin@zytor.com>

KVM: nVMX: Enable VMX FRED controls

This patch permits the use of VMX FRED controls in nested VMX by updating the
entry and secondary exit controls, allowing FRED-related operations during
nested VM exits and entries.

> diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
> --- a/arch/x86/kvm/vmx/nested.c
> +++ b/arch/x86/kvm/vmx/nested.c
> @@ -7371,12 +7371,8 @@ static void nested_vmx_setup_exit_ctls(struct vmcs_config *vmcs_conf,
>  
>  	if (msrs->exit_ctls_high & VM_EXIT_ACTIVATE_SECONDARY_CONTROLS) {
>  		msrs->secondary_exit_ctls = vmcs_conf->vmexit_2nd_ctrl;
> -		/*
> -		 * As the secondary VM exit control is always loaded, do not
> -		 * advertise any feature in it to nVMX until its nVMX support
> -		 * is ready.
> -		 */
> -		msrs->secondary_exit_ctls &= 0;
> +		msrs->secondary_exit_ctls &= SECONDARY_VM_EXIT_SAVE_IA32_FRED |
> +					     SECONDARY_VM_EXIT_LOAD_IA32_FRED;

[Severity: High]
Does this unconditionally advertise nested VMX FRED controls to L1 guests
without verifying host or guest FRED CPUID capabilities?

If an L1 guest is configured without FRED CPUID capabilities, it is still
permitted by these MSRs to set the FRED controls in its vmcs12. KVM directly
copies this control bit to the hardware vmcs02 structure.

However, because KVM's nested entry routines explicitly check
guest_cpu_cap_has(vcpu, X86_FEATURE_FRED), KVM will skip initializing the
vmcs02 FRED MSR fields. When the physical CPU enters L2, it will load
uninitialized or stale FRED MSR fields from KVM's vmcs02 memory, which can
lead to unpredictable L2 behavior or silent state drops.

>  	}
>  }
>  
> @@ -7392,7 +7388,7 @@ static void nested_vmx_setup_entry_ctls(struct vmcs_config *vmcs_conf,
>  		VM_ENTRY_IA32E_MODE |
>  #endif
>  		VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS |
> -		VM_ENTRY_LOAD_CET_STATE;
> +		VM_ENTRY_LOAD_CET_STATE | VM_ENTRY_LOAD_IA32_FRED;

[Severity: High]
Similar to the exit controls above, does VM_ENTRY_LOAD_IA32_FRED need to be
dynamically masked from msrs->entry_ctls_high in nested_vmx_setup_entry_ctls()
when FRED is unsupported by KVM or the guest?

>  	msrs->entry_ctls_high |=
>  		(VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER |
>  		 VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911213659.2025974-1-sohil.mehta@intel.com?part=25