linux-kernel - Re: [PATCH 1/3] KVM: x86: Finalize kvm_cpu_caps setup from {svm,vmx}_set_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aXhseOthqSEQvjKp@intel.com>
Date: Tue, 27 Jan 2026 15:42:48 +0800
From: Chao Gao <chao.gao@...el.com>
To: Sean Christopherson <seanjc@...gle.com>
CC: Paolo Bonzini <pbonzini@...hat.com>, <kvm@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, Mathias Krause <minipli@...ecurity.net>,
	"John Allen" <john.allen@....com>, Rick Edgecombe
	<rick.p.edgecombe@...el.com>, Binbin Wu <binbin.wu@...ux.intel.com>, Xiaoyao
 Li <xiaoyao.li@...el.com>, "Jim Mattson" <jmattson@...gle.com>
Subject: Re: [PATCH 1/3] KVM: x86: Finalize kvm_cpu_caps setup from
 {svm,vmx}_set_cpu_caps()

On Fri, Jan 23, 2026 at 02:15:40PM -0800, Sean Christopherson wrote:
>Explicitly finalize kvm_cpu_caps as part of each vendor's setup flow to
>fix a bug where clearing SHSTK and IBT due to lack of CET XFEATURE support
>makes kvm-intel.ko unloadable when nested=1.  The late clearing results in
>nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE
>when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks,
>ultimately leading to a mismatched VMCS config due to the reference config
>having the CET bits set, but every CPU's "local" config having the bits
>cleared.
>
>Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by
>kvm_x86_vendor_init(), before calling into vendor code, and not referenced
>between ops->hardware_setup() and their current/old location.
>
>Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER")
>Cc: stable@...r.kernel.org
>Cc: Mathias Krause <minipli@...ecurity.net>
>Cc: John Allen <john.allen@....com>
>Cc: Rick Edgecombe <rick.p.edgecombe@...el.com>
>Cc: Chao Gao <chao.gao@...el.com>
>Cc: Binbin Wu <binbin.wu@...ux.intel.com>
>Cc: Xiaoyao Li <xiaoyao.li@...el.com>
>Signed-off-by: Sean Christopherson <seanjc@...gle.com>

Reviewed-by: Chao Gao <chao.gao@...el.com>