Re: [PATCH v15 18/41] KVM: x86: Don't emulate instructions affected by CET features

Chao Gao
2025-09-18T14:15:45Z

>>
>> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
>> index 542d3664afa3..e4be54a677b0 100644
>> --- a/arch/x86/kvm/emulate.c
>> +++ b/arch/x86/kvm/emulate.c
>> @@ -178,6 +178,8 @@
>> #define IncSP ((u64)1 << 54) /* SP is incremented before ModRM calc */
>> #define TwoMemOp ((u64)1 << 55) /* Instruction has two memory operand */
>> #define IsBranch ((u64)1 << 56) /* Instruction is considered a branch. */
>> +#define ShadowStack ((u64)1 << 57) /* Instruction protected by Shadow Stack. */
>> +#define IndirBrnTrk ((u64)1 << 58) /* Instruction protected by IBT. */
>> #define DstXacc (DstAccLo | SrcAccHi | SrcWrite)
>> @@ -4068,9 +4070,9 @@ static const struct opcode group4[] = {
>> static const struct opcode group5[] = {
>> F(DstMem | SrcNone | Lock, em_inc),
>> F(DstMem | SrcNone | Lock, em_dec),
>> - I(SrcMem | NearBranch | IsBranch, em_call_near_abs),
>> - I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far),
>> - I(SrcMem | NearBranch | IsBranch, em_jmp_abs),
>> + I(SrcMem | NearBranch | IsBranch | ShadowStack | IndirBrnTrk, em_call_near_abs),
>> + I(SrcMemFAddr | ImplicitOps | IsBranch | ShadowStack | IndirBrnTrk, em_call_far),
>> + I(SrcMem | NearBranch | IsBranch | IndirBrnTrk, em_jmp_abs),
>
>> I(SrcMemFAddr | ImplicitOps | IsBranch, em_jmp_far),
>
>It seems this entry for 'FF 05' (Jump far, absolute indirect) needs to set
>ShadowStack and IndirBrnTrk as well?

Yes. I just checked the pseudo code of the JMP instruction in SDM vol2. A far
jump to a CONFORMING-CODE-SEGMENT or NONCONFORMING-CODE-SEGMENT is affected by
both shadow stack and IBT, and a far jump to a call gate is affected by IBT.