Re: [PATCH v15 18/41] KVM: x86: Don't emulate instructions affected by CET features

Chao Gao
2025-09-18T14:55:03Z

>> --- a/arch/x86/kvm/emulate.c
>> +++ b/arch/x86/kvm/emulate.c
>> @@ -4326,8 +4326,8 @@ static const struct opcode opcode_table[256] = {
>> X8(I(DstReg | SrcImm64 | Mov, em_mov)),
>> /* 0xC0 - 0xC7 */
>> G(ByteOp | Src2ImmByte, group2), G(Src2ImmByte, group2),
>> - I(ImplicitOps | NearBranch | SrcImmU16 | IsBranch, em_ret_near_imm),
>> - I(ImplicitOps | NearBranch | IsBranch, em_ret),
>> + I(ImplicitOps | NearBranch | SrcImmU16 | IsBranch | ShadowStack, em_ret_near_imm),
>> + I(ImplicitOps | NearBranch | IsBranch | ShadowStack, em_ret),
>
>Tangentially directly related to this bug, I think we should manual annotation
>where possible. I don't see an easy way to do that for ShadowStack, but for IBT
>we can use IsBranch, NearBranch and the SrcXXX operance to detect IBT-affected
>instructions. It's obviously more complex, but programmatically detecting
>indirect branches should be less error prone. I'll do so in the next version.
>
>> I(DstReg | SrcMemFAddr | ModRM | No64 | Src2ES, em_lseg),
>> I(DstReg | SrcMemFAddr | ModRM | No64 | Src2DS, em_lseg),
>> G(ByteOp, group11), G(0, group11),
>>
>>
>> And for reference, below are the changes I made to KUT's cet.c
>
>I now have a more comprehensive set of testcases, and it can be upstreamed
>(relies on KVM's default behavior of injecting #UD at CPL==3 on failed emulation).

IIUC, for KVM_FEP-prefixed instructions, the emulation type is set to
EMULTYPE_TRAP_UD_FORCED. Regardless of the CPL and
KVM_CAP_EXIT_ON_EMULATION_FAILURE, KVM will always inject #UD on failed
emulation.

r = x86_decode_emulated_instruction(vcpu, emulation_type,
insn, insn_len);
if (r != EMULATION_OK) {
if ((emulation_type & EMULTYPE_TRAP_UD) ||
(emulation_type & EMULTYPE_TRAP_UD_FORCED)) {
kvm_queue_exception(vcpu, UD_VECTOR);
return 1;
}