From: Sean Christopherson <seanjc@google.com>
To: Sean Christopherson <seanjc@google.com>,
Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Mathias Krause <minipli@grsecurity.net>,
John Allen <john.allen@amd.com>,
Rick Edgecombe <rick.p.edgecombe@intel.com>,
Chao Gao <chao.gao@intel.com>,
Binbin Wu <binbin.wu@linux.intel.com>,
Xiaoyao Li <xiaoyao.li@intel.com>,
Jim Mattson <jmattson@google.com>
Subject: Re: [PATCH v2 0/3] KVM: x86: CET vs. nVMX fix and hardening
Date: Tue, 3 Feb 2026 16:10:21 -0800 [thread overview]
Message-ID: <177016325730.569059.4869595783649901022.b4-ty@google.com> (raw)
In-Reply-To: <20260128014310.3255561-1-seanjc@google.com>
On Tue, 27 Jan 2026 17:43:07 -0800, Sean Christopherson wrote:
> Fix a bug where KVM will clear IBT and SHSTK bits after nested VMX MSRs
> have been configured, e.g. if the kernel is built with CONFIG_X86_CET=y
> but CONFIG_X86_KERNEL_IBT=n. The late clearing results in kvm-intel.ko
> refusing to load as the CPU compatible checks generate their VMCS configs
> with IBT=n and SHSTK=n, ultimately causing a mismatch on the CET entry
> and exit controls.
>
> [...]
This got a bit messy, as I want to get the immediate fix into 6.19 (hopefully
I wasn't too late), and at that point there was no reason to shove the VMCS
patch in with the kvm_cpu_caps hardening.
Applied patch 1 to "fixes", patch 2 to "misc", and patch 3 to "vmx.
[1/3] KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps()
https://github.com/kvm-x86/linux/commit/f8ade833b733
[2/3] KVM: x86: Harden against unexpected adjustments to kvm_cpu_caps
https://github.com/kvm-x86/linux/commit/3f2757dbf32a
[3/3] KVM: VMX: Print out "bad" offsets+value on VMCS config mismatch
https://github.com/kvm-x86/linux/commit/c0d6b8bbbced
--
https://github.com/kvm-x86/linux/tree/next
prev parent reply other threads:[~2026-02-04 0:10 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-28 1:43 Sean Christopherson
2026-01-28 1:43 ` [PATCH v2 1/3] KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps() Sean Christopherson
2026-01-29 2:55 ` Xiaoyao Li
2026-01-29 15:03 ` Sean Christopherson
2026-01-29 7:34 ` Binbin Wu
2026-01-30 3:23 ` Xiaoyao Li
2026-01-30 5:06 ` Binbin Wu
2026-01-30 8:56 ` Binbin Wu
2026-01-28 1:43 ` [PATCH v2 2/3] KVM: x86: Harden against unexpected adjustments to kvm_cpu_caps Sean Christopherson
2026-01-29 3:09 ` Xiaoyao Li
2026-01-29 15:12 ` Sean Christopherson
2026-01-30 3:01 ` Xiaoyao Li
2026-01-30 8:59 ` Binbin Wu
2026-01-28 1:43 ` [PATCH v2 3/3] KVM: VMX: Print out "bad" offsets+value on VMCS config mismatch Sean Christopherson
2026-01-29 3:16 ` Xiaoyao Li
2026-01-30 9:17 ` Binbin Wu
2026-02-04 0:10 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=177016325730.569059.4869595783649901022.b4-ty@google.com \
--to=seanjc@google.com \
--cc=binbin.wu@linux.intel.com \
--cc=chao.gao@intel.com \
--cc=jmattson@google.com \
--cc=john.allen@amd.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=minipli@grsecurity.net \
--cc=pbonzini@redhat.com \
--cc=rick.p.edgecombe@intel.com \
--cc=xiaoyao.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®