linux-kernel - Re: [PATCH v9 18/22] KVM: nVMX: Enable support for secondary VM exit controls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aRSOxriHgUP/CoLh@intel.com>
Date: Wed, 12 Nov 2025 21:42:30 +0800
From: Chao Gao <chao.gao@...el.com>
To: "Xin Li (Intel)" <xin@...or.com>
CC: <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>,
	<linux-doc@...r.kernel.org>, <pbonzini@...hat.com>, <seanjc@...gle.com>,
	<corbet@....net>, <tglx@...utronix.de>, <mingo@...hat.com>, <bp@...en8.de>,
	<dave.hansen@...ux.intel.com>, <x86@...nel.org>, <hpa@...or.com>,
	<luto@...nel.org>, <peterz@...radead.org>, <andrew.cooper3@...rix.com>,
	<hch@...radead.org>, <sohil.mehta@...el.com>
Subject: Re: [PATCH v9 18/22] KVM: nVMX: Enable support for secondary VM exit
 controls

On Sun, Oct 26, 2025 at 01:19:06PM -0700, Xin Li (Intel) wrote:
>From: Xin Li <xin3.li@...el.com>
>
>Add support for secondary VM exit controls in nested VMX to facilitate
>future FRED integration.
>
>Signed-off-by: Xin Li <xin3.li@...el.com>
>Signed-off-by: Xin Li (Intel) <xin@...or.com>
>Tested-by: Shan Kang <shan.kang@...el.com>
>Tested-by: Xuelian Guo <xuelian.guo@...el.com>
>---
>
>Changes in v8:
>* Relocate secondary_vm_exit_controls to the last u64 padding field.
>* Remove the change to Documentation/virt/kvm/x86/nested-vmx.rst.
>
>Changes in v5:
>* Allow writing MSR_IA32_VMX_EXIT_CTLS2 (Sean).
>* Add TB from Xuelian Guo.
>
>Change in v3:
>* Read secondary VM exit controls from vmcs_conf insteasd of the hardware
>  MSR MSR_IA32_VMX_EXIT_CTLS2 to avoid advertising features to L1 that KVM
>  itself doesn't support, e.g. because the expected entry+exit pairs aren't
>  supported. (Sean Christopherson)
>---
> arch/x86/kvm/vmx/capabilities.h |  1 +
> arch/x86/kvm/vmx/nested.c       | 26 +++++++++++++++++++++++++-
> arch/x86/kvm/vmx/vmcs12.c       |  1 +
> arch/x86/kvm/vmx/vmcs12.h       |  3 ++-
> arch/x86/kvm/x86.h              |  2 +-
> 5 files changed, 30 insertions(+), 3 deletions(-)
>
>diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilities.h
>index 651507627ef3..f390f9f883c3 100644
>--- a/arch/x86/kvm/vmx/capabilities.h
>+++ b/arch/x86/kvm/vmx/capabilities.h
>@@ -34,6 +34,7 @@ struct nested_vmx_msrs {
> 	u32 pinbased_ctls_high;
> 	u32 exit_ctls_low;
> 	u32 exit_ctls_high;
>+	u64 secondary_exit_ctls;
> 	u32 entry_ctls_low;
> 	u32 entry_ctls_high;
> 	u32 misc_low;
>diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
>index b0cd745518b4..cbb682424a5b 100644
>--- a/arch/x86/kvm/vmx/nested.c
>+++ b/arch/x86/kvm/vmx/nested.c
>@@ -1534,6 +1534,11 @@ int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
> 			return -EINVAL;
> 		vmx->nested.msrs.vmfunc_controls = data;
> 		return 0;
>+	case MSR_IA32_VMX_EXIT_CTLS2:
>+		if (data & ~vmcs_config.nested.secondary_exit_ctls)
>+			return -EINVAL;
>+		vmx->nested.msrs.secondary_exit_ctls = data;
>+		return 0;
> 	default:
> 		/*
> 		 * The rest of the VMX capability MSRs do not support restore.
>@@ -1573,6 +1578,9 @@ int vmx_get_vmx_msr(struct nested_vmx_msrs *msrs, u32 msr_index, u64 *pdata)
> 		if (msr_index == MSR_IA32_VMX_EXIT_CTLS)
> 			*pdata |= VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
> 		break;
>+	case MSR_IA32_VMX_EXIT_CTLS2:
>+		*pdata = msrs->secondary_exit_ctls;

MSR_IA32_VMX_EXIT_CTLS2 should be added to emulated_msrs_all[] for live migration.