From: Chao Gao <chao.gao@intel.com>
To: "Xin Li (Intel)" <xin@zytor.com>
Cc: <linux-kernel@vger.kernel.org>, <kvm@vger.kernel.org>,
<linux-doc@vger.kernel.org>, <pbonzini@redhat.com>,
<seanjc@google.com>, <corbet@lwn.net>, <tglx@linutronix.de>,
<mingo@redhat.com>, <bp@alien8.de>, <dave.hansen@linux.intel.com>,
<x86@kernel.org>, <hpa@zytor.com>, <luto@kernel.org>,
<peterz@infradead.org>, <andrew.cooper3@citrix.com>,
<hch@infradead.org>, <sohil.mehta@intel.com>
Subject: Re: [PATCH v9 20/22] KVM: nVMX: Validate FRED-related VMCS fields
Date: Thu, 13 Nov 2025 11:00:09 +0800 [thread overview]
Message-ID: <aRVJucn5t5WjS2fe@intel.com> (raw)
In-Reply-To: <20251026201911.505204-21-xin@zytor.com>
On Sun, Oct 26, 2025 at 01:19:08PM -0700, Xin Li (Intel) wrote:
>From: Xin Li <xin3.li@intel.com>
>
>Extend nested VMX field validation to include FRED-specific VMCS fields,
>mirroring hardware behavior.
>
>This enables support for nested FRED by ensuring control and guest/host
>state fields are properly checked.
>
>Signed-off-by: Xin Li <xin3.li@intel.com>
>Signed-off-by: Xin Li (Intel) <xin@zytor.com>
>Tested-by: Shan Kang <shan.kang@intel.com>
>Tested-by: Xuelian Guo <xuelian.guo@intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
There are some minor issues below that may need to be fixed.
>---
>
>Change in v5:
>* Add TB from Xuelian Guo.
>---
> arch/x86/kvm/vmx/nested.c | 117 +++++++++++++++++++++++++++++++++-----
> 1 file changed, 104 insertions(+), 13 deletions(-)
>
>diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
>index 63cdfffba58b..8682709d8759 100644
>--- a/arch/x86/kvm/vmx/nested.c
>+++ b/arch/x86/kvm/vmx/nested.c
>@@ -3030,6 +3030,8 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
> struct vmcs12 *vmcs12)
> {
> struct vcpu_vmx *vmx = to_vmx(vcpu);
>+ bool fred_enabled = (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) &&
>+ (vmcs12->guest_cr4 & X86_CR4_FRED);
>
> if (CC(!vmx_control_verify(vmcs12->vm_entry_controls,
> vmx->nested.msrs.entry_ctls_low,
>@@ -3047,22 +3049,11 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
> u8 vector = intr_info & INTR_INFO_VECTOR_MASK;
> u32 intr_type = intr_info & INTR_INFO_INTR_TYPE_MASK;
> bool has_error_code = intr_info & INTR_INFO_DELIVER_CODE_MASK;
>+ bool has_nested_exception = vmx->nested.msrs.basic & VMX_BASIC_NESTED_EXCEPTION;
has_error_code reflects whether the to-be-injected event has an error code.
Using has_nested_exception for CPU capabilities here is a bit confusing.
> bool urg = nested_cpu_has2(vmcs12,
> SECONDARY_EXEC_UNRESTRICTED_GUEST);
> bool prot_mode = !urg || vmcs12->guest_cr0 & X86_CR0_PE;
>
>- /* VM-entry interruption-info field: interruption type */
>- if (CC(intr_type == INTR_TYPE_RESERVED) ||
>- CC(intr_type == INTR_TYPE_OTHER_EVENT &&
>- !nested_cpu_supports_monitor_trap_flag(vcpu)))
>- return -EINVAL;
>-
>- /* VM-entry interruption-info field: vector */
>- if (CC(intr_type == INTR_TYPE_NMI_INTR && vector != NMI_VECTOR) ||
>- CC(intr_type == INTR_TYPE_HARD_EXCEPTION && vector > 31) ||
>- CC(intr_type == INTR_TYPE_OTHER_EVENT && vector != 0))
>- return -EINVAL;
>-
> /*
> * Cannot deliver error code in real mode or if the interrupt
> * type is not hardware exception. For other cases, do the
>@@ -3086,8 +3077,28 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
> if (CC(intr_info & INTR_INFO_RESVD_BITS_MASK))
> return -EINVAL;
>
>- /* VM-entry instruction length */
>+ /*
>+ * When the CPU enumerates VMX nested-exception support, bit 13
>+ * (set to indicate a nested exception) of the intr info field
>+ * may have value 1. Otherwise bit 13 is reserved.
>+ */
>+ if (CC(!(has_nested_exception && intr_type == INTR_TYPE_HARD_EXCEPTION) &&
>+ intr_info & INTR_INFO_NESTED_EXCEPTION_MASK))
>+ return -EINVAL;
>+
> switch (intr_type) {
>+ case INTR_TYPE_EXT_INTR:
>+ break;
This can be dropped, as the "default" case will handle it.
>+ case INTR_TYPE_RESERVED:
>+ return -EINVAL;
I think we need to add a CC() statement to make it easier to correlate a
VM-entry failure with a specific consistency check.
>+ case INTR_TYPE_NMI_INTR:
>+ if (CC(vector != NMI_VECTOR))
>+ return -EINVAL;
>+ break;
>+ case INTR_TYPE_HARD_EXCEPTION:
>+ if (CC(vector > 31))
>+ return -EINVAL;
>+ break;
> case INTR_TYPE_SOFT_EXCEPTION:
> case INTR_TYPE_SOFT_INTR:
> case INTR_TYPE_PRIV_SW_EXCEPTION:
>@@ -3095,6 +3106,24 @@ static int nested_check_vm_entry_controls(struct kvm_vcpu *vcpu,
> CC(vmcs12->vm_entry_instruction_len == 0 &&
> CC(!nested_cpu_has_zero_length_injection(vcpu))))
> return -EINVAL;
>+ break;
>+ case INTR_TYPE_OTHER_EVENT:
>+ switch (vector) {
>+ case 0:
>+ if (CC(!nested_cpu_supports_monitor_trap_flag(vcpu)))
>+ return -EINVAL;
Does this nested_cpu_supports_monitor_trap_flag() check apply to case 1/2?
>+ break;
>+ case 1:
>+ case 2:
>+ if (CC(!fred_enabled))
>+ return -EINVAL;
>+ if (CC(vmcs12->vm_entry_instruction_len > X86_MAX_INSTRUCTION_LENGTH))
>+ return -EINVAL;
>+ break;
>+ default:
>+ return -EINVAL;
Again, I think -EINVAL should be accompanied by a CC() statement.
>+ }
>+ break;
> }
> }
>
>@@ -3213,9 +3242,29 @@ static int nested_vmx_check_host_state(struct kvm_vcpu *vcpu,
> if (ia32e) {
> if (CC(!(vmcs12->host_cr4 & X86_CR4_PAE)))
> return -EINVAL;
>+ if (vmcs12->vm_exit_controls & VM_EXIT_ACTIVATE_SECONDARY_CONTROLS &&
>+ vmcs12->secondary_vm_exit_controls & SECONDARY_VM_EXIT_LOAD_IA32_FRED) {
>+ if (CC(vmcs12->host_ia32_fred_config &
>+ (BIT_ULL(11) | GENMASK_ULL(5, 4) | BIT_ULL(2))) ||
>+ CC(vmcs12->host_ia32_fred_rsp1 & GENMASK_ULL(5, 0)) ||
>+ CC(vmcs12->host_ia32_fred_rsp2 & GENMASK_ULL(5, 0)) ||
>+ CC(vmcs12->host_ia32_fred_rsp3 & GENMASK_ULL(5, 0)) ||
>+ CC(vmcs12->host_ia32_fred_ssp1 & GENMASK_ULL(2, 0)) ||
>+ CC(vmcs12->host_ia32_fred_ssp2 & GENMASK_ULL(2, 0)) ||
>+ CC(vmcs12->host_ia32_fred_ssp3 & GENMASK_ULL(2, 0)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_config & PAGE_MASK, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_rsp1, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_rsp2, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_rsp3, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_ssp1, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_ssp2, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->host_ia32_fred_ssp3, vcpu)))
>+ return -EINVAL;
>+ }
> } else {
> if (CC(vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) ||
> CC(vmcs12->host_cr4 & X86_CR4_PCIDE) ||
>+ CC(vmcs12->host_cr4 & X86_CR4_FRED) ||
> CC((vmcs12->host_rip) >> 32))
> return -EINVAL;
> }
>@@ -3384,6 +3433,48 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu,
> CC((vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD))))
> return -EINVAL;
>
>+ if (ia32e) {
>+ if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_FRED) {
>+ if (CC(vmcs12->guest_ia32_fred_config &
>+ (BIT_ULL(11) | GENMASK_ULL(5, 4) | BIT_ULL(2))) ||
>+ CC(vmcs12->guest_ia32_fred_rsp1 & GENMASK_ULL(5, 0)) ||
>+ CC(vmcs12->guest_ia32_fred_rsp2 & GENMASK_ULL(5, 0)) ||
>+ CC(vmcs12->guest_ia32_fred_rsp3 & GENMASK_ULL(5, 0)) ||
>+ CC(vmcs12->guest_ia32_fred_ssp1 & GENMASK_ULL(2, 0)) ||
>+ CC(vmcs12->guest_ia32_fred_ssp2 & GENMASK_ULL(2, 0)) ||
>+ CC(vmcs12->guest_ia32_fred_ssp3 & GENMASK_ULL(2, 0)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_config & PAGE_MASK, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_rsp1, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_rsp2, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_rsp3, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_ssp1, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_ssp2, vcpu)) ||
>+ CC(is_noncanonical_msr_address(vmcs12->guest_ia32_fred_ssp3, vcpu)))
>+ return -EINVAL;
>+ }
>+ if (vmcs12->guest_cr4 & X86_CR4_FRED) {
>+ unsigned int ss_dpl = VMX_AR_DPL(vmcs12->guest_ss_ar_bytes);
>+ switch (ss_dpl) {
>+ case 0:
>+ if (CC(!(vmcs12->guest_cs_ar_bytes & VMX_AR_L_MASK)))
>+ return -EINVAL;
>+ break;
>+ case 1:
>+ case 2:
>+ return -EINVAL;
Ditto.
>+ case 3:
>+ if (CC(vmcs12->guest_rflags & X86_EFLAGS_IOPL))
>+ return -EINVAL;
>+ if (CC(vmcs12->guest_interruptibility_info & GUEST_INTR_STATE_STI))
>+ return -EINVAL;
>+ break;
>+ }
>+ }
>+ } else {
>+ if (CC(vmcs12->guest_cr4 & X86_CR4_FRED))
>+ return -EINVAL;
>+ }
>+
> if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_CET_STATE) {
> if (nested_vmx_check_cet_state_common(vcpu, vmcs12->guest_s_cet,
> vmcs12->guest_ssp,
>--
>2.51.0
>
>
next prev parent reply other threads:[~2025-11-13 3:00 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-26 20:18 [PATCH v9 00/22] Enable FRED with KVM VMX Xin Li (Intel)
2025-10-26 20:18 ` [PATCH v9 01/22] KVM: VMX: Enable support for secondary VM exit controls Xin Li (Intel)
2025-10-26 20:18 ` [PATCH v9 02/22] KVM: VMX: Initialize VM entry/exit FRED controls in vmcs_config Xin Li (Intel)
2025-10-26 20:18 ` [PATCH v9 03/22] KVM: VMX: Disable FRED if FRED consistency checks fail Xin Li (Intel)
2025-10-26 20:18 ` [PATCH v9 04/22] x86/cea: Prefix event stack names with ESTACK_ Xin Li (Intel)
2025-10-26 20:18 ` [PATCH v9 05/22] x86/cea: Use array indexing to simplify exception stack access Xin Li (Intel)
2025-10-27 15:49 ` Dave Hansen
2025-10-28 2:31 ` Xin Li
2025-10-26 20:18 ` [PATCH v9 06/22] x86/cea: Export __this_cpu_ist_top_va() to KVM Xin Li (Intel)
2025-10-27 15:50 ` Dave Hansen
2025-10-26 20:18 ` [PATCH v9 07/22] KVM: VMX: Initialize VMCS FRED fields Xin Li (Intel)
2025-11-19 2:44 ` Chao Gao
2025-10-26 20:18 ` [PATCH v9 08/22] KVM: VMX: Set FRED MSR intercepts Xin Li (Intel)
2025-11-12 5:49 ` Chao Gao
2025-10-26 20:18 ` [PATCH v9 09/22] KVM: VMX: Save/restore guest FRED RSP0 Xin Li (Intel)
2025-11-12 5:59 ` Chao Gao
2025-10-26 20:18 ` [PATCH v9 10/22] KVM: VMX: Add support for saving and restoring FRED MSRs Xin Li (Intel)
2025-11-12 6:16 ` Chao Gao
2025-12-01 6:20 ` Xin Li
2025-10-26 20:18 ` [PATCH v9 11/22] KVM: x86: Add a helper to detect if FRED is enabled for a vCPU Xin Li (Intel)
2025-11-12 6:19 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 12/22] KVM: VMX: Virtualize FRED event_data Xin Li (Intel)
2025-11-19 3:24 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 13/22] KVM: VMX: Virtualize FRED nested exception tracking Xin Li (Intel)
2025-11-19 6:54 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 14/22] KVM: x86: Save/restore the nested flag of an exception Xin Li (Intel)
2025-11-19 6:13 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 15/22] KVM: x86: Mark CR4.FRED as not reserved Xin Li (Intel)
2025-11-19 7:26 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 16/22] KVM: VMX: Dump FRED context in dump_vmcs() Xin Li (Intel)
2025-11-19 7:40 ` Chao Gao
2025-11-30 18:42 ` Xin Li
2025-10-26 20:19 ` [PATCH v9 17/22] KVM: x86: Advertise support for FRED Xin Li (Intel)
2025-11-12 7:30 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 18/22] KVM: nVMX: Enable support for secondary VM exit controls Xin Li (Intel)
2025-11-12 13:42 ` Chao Gao
2025-10-26 20:19 ` [PATCH v9 19/22] KVM: nVMX: Handle FRED VMCS fields in nested VMX context Xin Li (Intel)
2025-12-02 6:32 ` Chao Gao
2025-12-08 22:37 ` Sean Christopherson
2025-10-26 20:19 ` [PATCH v9 20/22] KVM: nVMX: Validate FRED-related VMCS fields Xin Li (Intel)
2025-11-13 3:00 ` Chao Gao [this message]
2025-10-26 20:19 ` [PATCH v9 21/22] KVM: nVMX: Guard SHADOW_FIELD_R[OW] macros with VMX feature checks Xin Li (Intel)
2025-12-02 6:35 ` Chao Gao
2025-12-08 22:49 ` Sean Christopherson
2025-10-26 20:19 ` [PATCH v9 22/22] KVM: nVMX: Enable VMX FRED controls Xin Li (Intel)
2025-11-13 3:20 ` Chao Gao
2025-11-06 17:35 ` [PATCH v9 00/22] Enable FRED with KVM VMX Xin Li
2025-11-13 22:20 ` Sean Christopherson
2025-12-08 22:51 ` Sean Christopherson
2025-12-09 17:08 ` Xin Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aRVJucn5t5WjS2fe@intel.com \
--to=chao.gao@intel.com \
--cc=andrew.cooper3@citrix.com \
--cc=bp@alien8.de \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=hch@infradead.org \
--cc=hpa@zytor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=seanjc@google.com \
--cc=sohil.mehta@intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=xin@zytor.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).