From nobody Fri Dec 19 19:03:00 2025 Received: from mail.zytor.com (terminus.zytor.com [198.137.202.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B4B12F7459; Tue, 14 Oct 2025 01:11:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.137.202.136 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760404261; cv=none; b=R1Udcl0F4KKIGKugu8BAlMnZu+kwhGM4kDzteMnENZwYbhuoPvaQDJJCMuvHo3iRtvGmOYbCzRMe5Ot5LZoh420IHWowUmlpHchMxO71zAYP99qNnOjKB2lKo90SGAzXAm00Wr2qRSAcshHbbw31UlGdcWRW/UreTgFVI1vBYw8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760404261; c=relaxed/simple; bh=zd5p8dp2fTyWHB4F3G+uN8bPODyQDK6nKlJ0WjHZ3eU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dxrcBHhD5XiJvLltJrU0GxpJqmV2sC4jTGsotxiFUkEMpUIBLlNUPKVia+vbZgwZocLb+1eXwarc5rpxI4UGFMXw4nrMA6Tr1mt/4CvUDmhwrfe2N42H+CbQHdVHesXL8ZRGBxHazdNDc9RwVdKLucggcdMBlRdZljSgcDKRHF0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zytor.com; spf=pass smtp.mailfrom=zytor.com; dkim=pass (2048-bit key) header.d=zytor.com header.i=@zytor.com header.b=VYqgkpB9; arc=none smtp.client-ip=198.137.202.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zytor.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zytor.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=zytor.com header.i=@zytor.com header.b="VYqgkpB9" Received: from terminus.zytor.com (terminus.zytor.com [IPv6:2607:7c80:54:3:0:0:0:136]) (authenticated bits=0) by mail.zytor.com (8.18.1/8.17.1) with ESMTPSA id 59E19p1Q1568441 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Mon, 13 Oct 2025 18:09:57 -0700 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.zytor.com 59E19p1Q1568441 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zytor.com; s=2025092201; t=1760404198; bh=ftkWrL1fIrPpkbjKyzq3E4arwSx69DUmxcohcNHZKd8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VYqgkpB9wj5ESowAf3qHrnRUGx2PtvrAl6wC7eRpMvF9RtLCi04LDg1Dh9UfwByZJ KSv2VLeVGjNoH1xGH8ti6L6Ksm3/elQ7aTxSafczskJ8mEjkRgXBmvAub/E2EBlN7h clPjKR7HfOEnU61CksxgmxSOUt0QK/6+/Zqf/Mmk7zJyIENohOGjYON4sjv2IvW1dy hgBzypkLxmhYOQ1v/ReVm5o2xHKCP+tpaY6+X2rOougSZcEugH3UkrJCRclWcPJohD 6vZxZmLVDiv7a4QW92osI7pDCs6R90xOElmoBRzFlE+LyWeX7k6ltNO1p4oxFC/ky2 YqVD5oC8dVbqw== From: "Xin Li (Intel)" To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org Cc: pbonzini@redhat.com, seanjc@google.com, corbet@lwn.net, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, xin@zytor.com, luto@kernel.org, peterz@infradead.org, andrew.cooper3@citrix.com, chao.gao@intel.com, hch@infradead.org Subject: [PATCH v8 03/21] KVM: VMX: Disable FRED if FRED consistency checks fail Date: Mon, 13 Oct 2025 18:09:32 -0700 Message-ID: <20251014010950.1568389-4-xin@zytor.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251014010950.1568389-1-xin@zytor.com> References: <20251014010950.1568389-1-xin@zytor.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xin Li Do not virtualize FRED if FRED consistency checks fail. Either on broken hardware, or when run KVM on top of another hypervisor before the underlying hypervisor implements nested FRED correctly. Suggested-by: Chao Gao Signed-off-by: Xin Li Signed-off-by: Xin Li (Intel) Reviewed-by: Chao Gao Tested-by: Shan Kang Tested-by: Xuelian Guo --- Changes in v5: * Drop the cpu_feature_enabled() in cpu_has_vmx_fred() (Sean). * Add TB from Xuelian Guo. Change in v4: * Call out the reason why not check FRED VM-exit controls in cpu_has_vmx_fred() (Chao Gao). --- arch/x86/kvm/vmx/capabilities.h | 10 ++++++++++ arch/x86/kvm/vmx/vmx.c | 3 +++ 2 files changed, 13 insertions(+) diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilitie= s.h index 6bd67c40ca3b..651507627ef3 100644 --- a/arch/x86/kvm/vmx/capabilities.h +++ b/arch/x86/kvm/vmx/capabilities.h @@ -405,6 +405,16 @@ static inline bool vmx_pebs_supported(void) return boot_cpu_has(X86_FEATURE_PEBS) && kvm_pmu_cap.pebs_ept; } =20 +static inline bool cpu_has_vmx_fred(void) +{ + /* + * setup_vmcs_config() guarantees FRED VM-entry/exit controls + * are either all set or none. So, no need to check FRED VM-exit + * controls. + */ + return (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_FRED); +} + static inline bool cpu_has_notify_vmexit(void) { return vmcs_config.cpu_based_2nd_exec_ctrl & diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index d881f1c133fa..c6477cb36854 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -8001,6 +8001,9 @@ static __init void vmx_set_cpu_caps(void) kvm_cpu_cap_check_and_set(X86_FEATURE_DTES64); } =20 + if (!cpu_has_vmx_fred()) + kvm_cpu_cap_clear(X86_FEATURE_FRED); + if (!enable_pmu) kvm_cpu_cap_clear(X86_FEATURE_PDCM); kvm_caps.supported_perf_cap =3D vmx_get_perf_capabilities(); --=20 2.51.0