Test guest CET access across KVM kernels by jsturtevant · Pull Request #2051 · hyperlight-dev/hyperlight

jsturtevant · 2026-11-11T20:12:00Z

Some KVM kernels permit host access to zero-valued IA32_S_CET even when guest CET is hidden. https://github.com/torvalds/linux/blob/v6.18/arch/x86/kvm/x86.c#L537-L544

The test accepts either the specific declaration error or a guest abort when enabling shadow stacks through an explicitly allowed MSR. Guest CPUID must hide shadow stacks.

I was getting this on my local machine though it isn't in CI due to a kernel version difference

cargo test --locked -p hyperlight-host --lib   sandbox::initialized::tests::msr_tests::kvm_does_not_expose_cet_to_guest   -- --exact
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.71s
     Running unittests src/lib.rs (target/debug/deps/hyperlight_host-7324eeb0fc679d34)

running 1 test
test sandbox::initialized::tests::msr_tests::kvm_does_not_expose_cet_to_guest ... FAILED

failures:

---- sandbox::initialized::tests::msr_tests::kvm_does_not_expose_cet_to_guest stdout ----

thread 'sandbox::initialized::tests::msr_tests::kvm_does_not_expose_cet_to_guest' (242458) panicked at src/hyperlight_host/src/sandbox/initialized.rs:5972:18:

ci uses kernel 6.8.0-1070-azure. Mine uses 6.18.58.1 WSL2.

Signed-off-by: James Sturtevant <jsturtevant@gmail.com>

Copilot

🟢 Approval recommended

No active review issues were identified for the CET isolation test compatibility change.

No open issues 🎉

What changed in this PR

Makes the CET isolation test compatible with KVM kernels that permit host access to zero-valued IA32_S_CET while hiding guest CET support.

Changes:

Accepts either the specific MSR declaration error or a guest abort when enabling shadow stacks through an explicitly allowed MSR.
Checks that an aborted sandbox is poisoned and retains the requirement that guest CPUID hide shadow stacks.

File	Description
`src/hyperlight_host/src/sandbox/initialized.rs`	Handles both valid KVM CET outcomes in the sandbox test.

_{Review effort: Balanced}

jsturtevant · 2026-11-11T20:19:56Z

fyi @ludfjig

ludfjig

lgtm, I had ai confirm in kernel source. Thanks

hyperlight-gh-bot · 2026-11-11T22:30:24Z

Benchmark Results

Measured commit: 4a87eed35bb6
Baseline commit: 90ca0f235813

kvm / amd (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`748.74 ns` (➖ 1.02x faster)
`vec_bytes`	`582.30 ns` (➖ 1.00x faster)
		`373.38 µs` (➖ 1.00x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`524.14 ns` (➖ 1.09x faster)
`65536`	`141.33 ns` (➖ 1.00x faster)

sandboxes

	`create_initialized_and_drop`
`medium`	`13.50 ms` (➖ 1.08x faster)

slot_pool

	`alloc_dealloc_128`	`alloc_dealloc_4096`	`alloc_dealloc_1500`
	`7.68 ns` (➖ 1.29x faster)	`7.69 ns` (➖ 1.01x faster)	`7.68 ns` (➖ 1.03x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`99.03 µs` (➖ 1.02x slower)

virtq_readonly

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`7.25 µs` (➖ 1.02x slower)	`7.25 µs` (➖ 1.02x slower)
`65536`	`1.91 µs` (➖ 1.10x faster)	`2.03 µs` (➖ 1.06x slower)

virtq_readwrite

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`26.79 µs` (➖ 1.10x faster)
`65536`	`6.72 µs` (➖ 1.05x faster)	`6.39 µs` (➖ 1.01x slower)
`8192`	`1.01 µs` (➖ 1.01x faster)	`1.02 µs` (➖ 1.01x faster)

kvm / intel (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`689.04 ns` (➖ 1.02x slower)
`vec_bytes`	`499.75 ns` (➖ 1.02x faster)
		`653.41 µs` (➖ 1.03x faster)

payload_allocation

	`slot_pool_segmented`
`262144`	`495.25 ns` (➖ 1.00x slower)
`65536`	`172.98 ns` (➖ 1.01x slower)

sandboxes

	`create_initialized_and_drop`
`medium`	`15.59 ms` (➖ 1.08x slower)

slot_pool

	`alloc_dealloc_128`	`alloc_dealloc_4096`	`alloc_dealloc_1500`
	`6.77 ns` (➖ 1.00x faster)	`6.77 ns` (➖ 1.00x slower)	`6.77 ns` (➖ 1.00x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`48.55 µs` (➖ 1.03x faster)

virtq_readonly

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`7.54 µs` (➖ 1.00x faster)	`7.47 µs` (➖ 1.00x slower)
`65536`	`2.10 µs` (➖ 1.00x faster)	`2.11 µs` (➖ 1.00x faster)

virtq_readwrite

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`29.53 µs` (➖ 1.01x faster)
`65536`	`7.05 µs` (➖ 1.02x faster)	`7.21 µs` (➖ 1.01x slower)
`8192`	`715.26 ns` (➖ 1.01x faster)	`715.88 ns` (➖ 1.02x faster)

mshv3 / amd (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`930.89 ns` (➖ 1.02x slower)
`vec_bytes`	`709.10 ns` (➖ 1.00x faster)
		`316.42 µs` (➖ 1.00x faster)

payload_allocation

	`slot_pool_segmented`
`262144`	`674.27 ns` (➖ 1.01x slower)
`65536`	`190.50 ns` (➖ 1.00x faster)

sandboxes

	`create_initialized_and_drop`
`medium`	`68.12 ms` (➖ 1.01x faster)

slot_pool

	`alloc_dealloc_128`	`alloc_dealloc_4096`	`alloc_dealloc_1500`
	`9.89 ns` (➖ 1.00x slower)	`9.94 ns` (➖ 1.01x slower)	`9.87 ns` (➖ 1.01x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`106.22 µs` (➖ 1.05x faster)

virtq_readonly

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`9.81 µs` (➖ 1.10x faster)	`10.32 µs` (➖ 1.04x slower)
`65536`	`2.47 µs` (➖ 1.01x slower)	`2.61 µs` (➖ 1.03x faster)

virtq_readwrite

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`34.61 µs` (➖ 1.07x faster)
`65536`	`8.01 µs` (➖ 1.01x faster)	`8.06 µs` (➖ 1.00x slower)
`8192`	`1.39 µs` (➖ 1.12x slower)	`1.29 µs` (➖ 1.00x faster)

mshv3 / intel (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`906.99 ns` (➖ 1.02x faster)
`vec_bytes`	`669.94 ns` (➖ 1.01x slower)
		`773.99 µs` (➖ 1.14x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`677.83 ns` (➖ 1.03x slower)
`65536`	`258.47 ns` (➖ 1.03x faster)

sandboxes

	`create_initialized_and_drop`
`medium`	`54.04 ms` (➖ 1.39x faster)

slot_pool

	`alloc_dealloc_128`	`alloc_dealloc_4096`	`alloc_dealloc_1500`
	`8.75 ns` (➖ 1.00x slower)	`9.58 ns` (➖ 1.10x slower)	`8.71 ns` (➖ 1.00x slower)

snapshot_files

	`load_snapshot_unverified`
`small`	`54.97 µs` (➖ 1.01x slower)

virtq_readonly

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`8.00 µs` (➖ 1.00x slower)	`7.96 µs` (➖ 1.00x slower)
`65536`	`2.32 µs` (➖ 1.03x slower)	`2.26 µs` (➖ 1.00x slower)

virtq_readwrite

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`41.90 µs` (➖ 1.08x slower)
`65536`	`7.48 µs` (➖ 1.05x faster)	`7.56 µs` (➖ 1.00x slower)
`8192`	`901.79 ns` (➖ 1.03x faster)	`911.77 ns` (➖ 1.02x faster)

hyperv-ws2025 / amd (Windows) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`1.20 µs` (➖ 1.01x faster)
`vec_bytes`	`792.86 ns` (➖ 1.02x slower)
		`1.94 ms` (➖ 1.03x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`811.37 ns` (➖ 1.00x faster)
`65536`	`231.02 ns` (➖ 1.27x faster)

sandboxes

	`create_initialized_and_drop`
`medium`	`11.56 ms` (➖ 1.14x faster)

slot_pool

	`alloc_dealloc_128`	`alloc_dealloc_4096`	`alloc_dealloc_1500`
	`10.44 ns` (➖ 1.03x slower)	`10.24 ns` (➖ 1.02x slower)	`10.44 ns` (➖ 1.05x slower)

snapshot_files

	`load_snapshot_unverified`
`small`	`901.32 µs` (➖ 1.15x slower)

virtq_readonly

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`8.98 µs` (➖ 1.07x faster)	`9.03 µs` (➖ 1.01x faster)
`65536`	`2.35 µs` (➖ 1.00x faster)	`2.33 µs` (➖ 1.03x faster)

virtq_readwrite

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`38.25 µs` (➖ 1.23x faster)
`65536`	`8.88 µs` (➖ 1.04x faster)	`8.80 µs` (➖ 1.01x slower)
`8192`	`1.26 µs` (➖ 1.09x faster)	`1.35 µs` (➖ 1.03x slower)

hyperv-ws2025 / intel (Windows) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`1.20 µs` (➖ 1.01x faster)
`vec_bytes`	`821.87 ns` (➖ 1.00x slower)
		`3.17 ms` (➖ 1.06x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`757.85 ns` (➖ 1.01x slower)
`65536`	`209.46 ns` (➖ 1.03x faster)

sandboxes

	`create_initialized_and_drop`
`medium`	`14.69 ms` (➖ 1.03x slower)

slot_pool

	`alloc_dealloc_128`	`alloc_dealloc_4096`	`alloc_dealloc_1500`
	`10.03 ns` (➖ 1.01x slower)	`10.26 ns` (➖ 1.01x faster)	`9.93 ns` (➖ 1.15x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`694.34 µs` (➖ 1.03x slower)

virtq_readonly

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`7.94 µs` (➖ 1.03x slower)	`7.70 µs` (➖ 1.02x faster)
`65536`	`2.38 µs` (➖ 1.03x slower)	`2.32 µs` (➖ 1.01x faster)

virtq_readwrite

	`slot_pool_segmented`	`slot_pool_segmented_fragmented`
`262144`	`41.25 µs` (➖ 1.02x faster)
`65536`	`8.40 µs` (➖ 1.02x faster)	`8.38 µs` (➖ 1.03x faster)
`8192`	`1.10 µs` (➖ 1.07x faster)	`1.16 µs` (➖ 1.06x slower)

_{Reported by cargo ci bench-report --candidate run:43094249139 --config-file bench_report.toml.}

test: check guest CET access across KVM kernels

4a87eed

Signed-off-by: James Sturtevant <jsturtevant@gmail.com>

jsturtevant requested a review from danbugs as a code owner November 11, 2026 20:12

jsturtevant added C-bug For PRs that fix bugs A-testing Related to tests or testing infrastructure labels Nov 11, 2026

jsturtevant requested a review from devigned as a code owner November 11, 2026 20:12

jsturtevant added the S-needs-review PR is ready for (re-)review label Nov 11, 2026

jsturtevant requested review from andreiltd, dblnz, jprendes, ludfjig, simongdavies, squillace and syntactically as code owners November 11, 2026 20:12

Copilot AI balanced review requested due to automatic review settings November 11, 2026 20:12

Copilot started reviewing on behalf of jsturtevant November 11, 2026 20:15

View session

Copilot AI reviewed Nov 11, 2026

View reviewed changes

ludfjig approved these changes Nov 11, 2026

View reviewed changes

jsturtevant merged commit 3b5c9fd into hyperlight-dev:main Nov 11, 2026
78 of 84 checks passed

github-actions Bot removed the S-needs-review PR is ready for (re-)review label Nov 11, 2026

Conversation

jsturtevant commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

jsturtevant commented Nov 11, 2026

Uh oh!

ludfjig left a comment

Choose a reason for hiding this comment

Uh oh!

hyperlight-gh-bot Bot commented Nov 11, 2026

Benchmark Results

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jsturtevant commented Nov 11, 2026 •

edited

Loading