linux-kernel - Re: [PATCH v2 3/3] KVM: VMX: Print out "bad" offsets+value on VMCS config mismatch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19ecf8b2-6818-4272-b87f-290439355795@intel.com>
Date: Thu, 29 Jan 2026 11:16:22 +0800
From: Xiaoyao Li <xiaoyao.li@...el.com>
To: Sean Christopherson <seanjc@...gle.com>,
 Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Mathias Krause <minipli@...ecurity.net>, John Allen <john.allen@....com>,
 Rick Edgecombe <rick.p.edgecombe@...el.com>, Chao Gao <chao.gao@...el.com>,
 Binbin Wu <binbin.wu@...ux.intel.com>, Jim Mattson <jmattson@...gle.com>
Subject: Re: [PATCH v2 3/3] KVM: VMX: Print out "bad" offsets+value on VMCS
 config mismatch

On 1/28/2026 9:43 AM, Sean Christopherson wrote:
> When kvm-intel.ko refuses to load due to a mismatched VMCS config, print
> all mismatching offsets+values to make it easier to debug goofs during
> development, and it to make it at least feasible to triage failures that
                    ^
typo "it"?

> occur during production.  E.g. if a physical core is flaky or is running
> with the "wrong" microcode patch loaded, then a CPU can get a legitimate
> mismatch even without KVM bugs.
> 
> Print the mismatches as 32-bit values as a compromise between hand coding
> every field (to provide precise information) and printing individual bytes
> (requires more effort to deduce the mismatch bit(s)).  All fields in the
> VMCS config are either 32-bit or 64-bit values, i.e. in many cases,
> printing 32-bit values will be 100% precise, and in the others it's close
> enough, especially when considering that MSR values are split into EDX:EAX
> anyways.
> 
> E.g. on mismatch CET entry/exit controls, KVM will print:
> 
>    kvm_intel: VMCS config on CPU 0 doesn't match reference config:
>      Offset 76 REF = 0x107fffff, CPU0 = 0x007fffff, mismatch = 0x10000000
>      Offset 84 REF = 0x0010f3ff, CPU0 = 0x0000f3ff, mismatch = 0x00100000
> 
> Opportunistically tweak the wording on the initial error message to say
> "mismatch" instead of "inconsistent", as the VMCS config itself isn't
> inconsistent, and the wording conflates the cross-CPU compatibility check
> with the error_on_inconsistent_vmcs_config knob that treats inconsistent
> VMCS configurations as errors (e.g. if a CPU supports CET entry controls
> but no CET exit controls).
> 
> Cc: Jim Mattson <jmattson@...gle.com>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>

Reviewed-by: Xiaoyao Li <xiaoyao.li@...el.com>

> ---
>   arch/x86/kvm/vmx/vmx.c | 17 ++++++++++++++++-
>   1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 93ec1e6181e4..11bb4b933227 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -2962,8 +2962,23 @@ int vmx_check_processor_compat(void)
>   	}
>   	if (nested)
>   		nested_vmx_setup_ctls_msrs(&vmcs_conf, vmx_cap.ept);
> +
>   	if (memcmp(&vmcs_config, &vmcs_conf, sizeof(struct vmcs_config))) {
> -		pr_err("Inconsistent VMCS config on CPU %d\n", cpu);
> +		u32 *gold = (void *)&vmcs_config;
> +		u32 *mine = (void *)&vmcs_conf;
> +		int i;
> +
> +		BUILD_BUG_ON(sizeof(struct vmcs_config) % sizeof(u32));
> +
> +		pr_err("VMCS config on CPU %d doesn't match reference config:", cpu);
> +		for (i = 0; i < sizeof(struct vmcs_config) / sizeof(u32); i++) {
> +			if (gold[i] == mine[i])
> +				continue;
> +
> +			pr_cont("\n  Offset %u REF = 0x%08x, CPU%u = 0x%08x, mismatch = 0x%08x",
> +				i * (int)sizeof(u32), gold[i], cpu, mine[i], gold[i] ^ mine[i]);
> +		}
> +		pr_cont("\n");
>   		return -EIO;
>   	}
>   	return 0;