On Mon, May 06, 2024, Rick P Edgecombe wrote: > I don't immediately see what trouble will be in giving kernel IBT a disable > parameter that doesn't touch X86_FEATURE_IBT at some point in the future. Keeping X86_FEATURE_IBT set will result in "ibt" being reported in /proc/cpuinfo, i.e. will mislead userspace into thinking IBT is supported and fully enabled by the kernel. For a security feature, that's a pretty big issue. To fudge around that, we could add a synthetic feature flag to let the kernel tell KVM whether or not it's safe to virtualize IBT, but I don't see what value that adds over KVM checking raw host CPUID.
