Linux's KVM With CET Virtualization Is Causing Some Hosts To Hang

Introduced to the Linux kernel last year was Control-flow Enforcement Technology "CET" virtualization for modern AMD and Intel CPUs. This complements CET that has existed in Linux for quite some time but it's new now to the KVM virtualization world, but some yet to be diagnosed problems are causing some hosts to hang when making use of this virtualization security feature.

CET is a hardware-based security feature to prevent against common ROP and COP/JOP attacks. While Control-flow Enforcement Technology has been working out well for traditional usage outside of virtualized environments, it seems some bugs persist in the Linux KVM code with both Intel Xeon and AMD EPYC processors being impacted by hangs in select environments when using CET virtualization.

There was this bug report earlier in the week from a Proxmox engineer where host lock-ups and guest hangs were reported. With that issue and how to address it not yet being understood, merged to the mainline Linux kernel yesterday was a new option to allow easily disabling CET for KVM.

"There have been reports of host hangs caused by CET virtualization. Until these are analyzed further, introduce a module parameter that makes it possible to easily disable it."

With that patch merged to Git for Linux 7.1, there is now the kvm.enable_cet= module parameter to easily toggle whether to enable CET or not for KVM virtualization usage.