linux-kernel - Re: [PATCH v2 3/3] KVM: VMX: Print out "bad" offsets+value on VMCS config mismatch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <775f7a7b-b658-43cc-b1f6-e95bca3f0fc5@linux.intel.com>
Date: Fri, 30 Jan 2026 17:17:31 +0800
From: Binbin Wu <binbin.wu@...ux.intel.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
 linux-kernel@...r.kernel.org, Mathias Krause <minipli@...ecurity.net>,
 John Allen <john.allen@....com>, Rick Edgecombe
 <rick.p.edgecombe@...el.com>, Chao Gao <chao.gao@...el.com>,
 Xiaoyao Li <xiaoyao.li@...el.com>, Jim Mattson <jmattson@...gle.com>
Subject: Re: [PATCH v2 3/3] KVM: VMX: Print out "bad" offsets+value on VMCS
 config mismatch



On 1/28/2026 9:43 AM, Sean Christopherson wrote:
> When kvm-intel.ko refuses to load due to a mismatched VMCS config, print
> all mismatching offsets+values to make it easier to debug goofs during
> development, and it to make it at least feasible to triage failures that
> occur during production.  E.g. if a physical core is flaky or is running
> with the "wrong" microcode patch loaded, then a CPU can get a legitimate
> mismatch even without KVM bugs.
> 
> Print the mismatches as 32-bit values as a compromise between hand coding
> every field (to provide precise information) and printing individual bytes
> (requires more effort to deduce the mismatch bit(s)).  All fields in the
> VMCS config are either 32-bit or 64-bit values, i.e. in many cases,
> printing 32-bit values will be 100% precise, and in the others it's close
> enough, especially when considering that MSR values are split into EDX:EAX
> anyways.
> 
> E.g. on mismatch CET entry/exit controls, KVM will print:
> 
>   kvm_intel: VMCS config on CPU 0 doesn't match reference config:
>     Offset 76 REF = 0x107fffff, CPU0 = 0x007fffff, mismatch = 0x10000000
>     Offset 84 REF = 0x0010f3ff, CPU0 = 0x0000f3ff, mismatch = 0x00100000
> 
> Opportunistically tweak the wording on the initial error message to say
> "mismatch" instead of "inconsistent", as the VMCS config itself isn't
> inconsistent, and the wording conflates the cross-CPU compatibility check
> with the error_on_inconsistent_vmcs_config knob that treats inconsistent
> VMCS configurations as errors (e.g. if a CPU supports CET entry controls
> but no CET exit controls).
> 

Reviewed-by: Binbin Wu <binbin.wu@...ux.intel.com>