From: Mathias Krause <minipli@grsecurity.net>
To: Sean Christopherson <seanjc@google.com>
Cc: kvm@vger.kernel.org, Chao Gao <chao.gao@intel.com>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [kvm-unit-tests PATCH v4 18/18] x86: cet: Add testcases to verify KVM rejects emulation of CET instructions
Date: Mon, 17 Nov 2025 08:32:07 +0100 [thread overview]
Message-ID: <aa192757-f6be-49ca-a2fb-38b9784c255e@grsecurity.net> (raw)
In-Reply-To: <20251114205100.1873640-19-seanjc@google.com>
On 14.11.25 21:51, Sean Christopherson wrote:
> Add SHSTK and IBT testcases to verify that KVM rejects (forced) emulation
> of instructions that interact with SHSTK and/or IBT state, as KVM doesn't
> support emulating SHSTK or IBT (rejecting emulation is preferable to
> compromising guest security).
>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
> [...]
Successfully tested on v6.18-rc6:
Tested-by: Mathias Krause <minipli@grsecurity.net>
Thanks,
Mathias
next prev parent reply other threads:[~2025-11-17 7:32 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-14 20:50 [kvm-unit-tests PATCH v4 00/18] x86: Improve CET tests Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 01/18] x86: cet: Pass virtual addresses to invlpg Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 02/18] x86: cet: Remove unnecessary memory zeroing for shadow stack Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 03/18] x86: cet: Directly check for #CP exception in run_in_user() Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 04/18] x86: cet: Validate #CP error code Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 05/18] x86: cet: Use report_skip() Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 06/18] x86: cet: Drop unnecessary casting Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 07/18] x86: cet: Validate writing unaligned values to SSP MSR causes #GP Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 08/18] x86: cet: Validate CET states during VMX transitions Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 09/18] x86: cet: Make shadow stack less fragile Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 10/18] x86: cet: Simplify IBT test Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 11/18] x86: cet: Use symbolic values for the #CP error codes Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 12/18] x86: cet: Test far returns too Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 13/18] x86: Avoid top-most page for vmalloc on x86-64 Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 14/18] x86: cet: Run SHSTK and IBT tests as appropriate if either feature is supported Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 15/18] x86: cet: Drop the "intel_" prefix from the CET testcase Sean Christopherson
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 16/18] x86: cet: Enable NOTRACK handling for IBT tests Sean Christopherson
2025-11-15 5:30 ` Mathias Krause
2025-11-14 20:50 ` [kvm-unit-tests PATCH v4 17/18] x86: cet: Reset IBT tracker state on #CP violations Sean Christopherson
2025-11-15 5:40 ` Mathias Krause
2025-11-14 20:51 ` [kvm-unit-tests PATCH v4 18/18] x86: cet: Add testcases to verify KVM rejects emulation of CET instructions Sean Christopherson
2025-11-15 6:15 ` Mathias Krause
2025-11-17 7:32 ` Mathias Krause [this message]
2025-11-18 22:26 ` [kvm-unit-tests PATCH v4 00/18] x86: Improve CET tests Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aa192757-f6be-49ca-a2fb-38b9784c255e@grsecurity.net \
--to=minipli@grsecurity.net \
--cc=chao.gao@intel.com \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox