Re: [PATCH v12 23/24] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET

[Chao Gao]

On Tue, Aug 19, 2025 at 10:27:44AM -0700, Sean Christopherson wrote:
>On Mon, Aug 11, 2025, Chao Gao wrote:
>> Add consistency checks for CR4.CET and CR0.WP in guest-state or host-state
>> area in the VMCS12. This ensures that configurations with CR4.CET set and
>> CR0.WP not set result in VM-entry failure, aligning with architectural
>> behavior.
>
>The consistency check patches need to land before KVM lets L1 enable CET for L2.

ok. I will separate the hunk below from the previous patch and place it at the
end of this series.

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 51d69f368689..2c8ee37debb2 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -7123,7 +7123,7 @@ static void nested_vmx_setup_exit_ctls(struct vmcs_config *vmcs_conf,
		VM_EXIT_HOST_ADDR_SPACE_SIZE |
 #endif
		VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT |
-		VM_EXIT_CLEAR_BNDCFGS;
+		VM_EXIT_CLEAR_BNDCFGS | VM_EXIT_LOAD_CET_STATE;
	msrs->exit_ctls_high |=
		VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
		VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
@@ -7145,7 +7145,8 @@ static void nested_vmx_setup_entry_ctls(struct vmcs_config *vmcs_conf,
 #ifdef CONFIG_X86_64
		VM_ENTRY_IA32E_MODE |
 #endif
-		VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS;
+		VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS |
+		VM_ENTRY_LOAD_CET_STATE;
	msrs->entry_ctls_high |=
		(VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER |
		 VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL);