Re: [PATCH v15 18/41] KVM: x86: Don't emulate instructions affected by CET features

Sean Christopherson
2025-09-18T18:02:10Z

On Thu, Sep 18, 2025, Chao Gao wrote:
> >> --- a/arch/x86/kvm/emulate.c
> >> +++ b/arch/x86/kvm/emulate.c
> >> @@ -4326,8 +4326,8 @@ static const struct opcode opcode_table[256] = {
> >> X8(I(DstReg | SrcImm64 | Mov, em_mov)),
> >> /* 0xC0 - 0xC7 */
> >> G(ByteOp | Src2ImmByte, group2), G(Src2ImmByte, group2),
> >> - I(ImplicitOps | NearBranch | SrcImmU16 | IsBranch, em_ret_near_imm),
> >> - I(ImplicitOps | NearBranch | IsBranch, em_ret),
> >> + I(ImplicitOps | NearBranch | SrcImmU16 | IsBranch | ShadowStack, em_ret_near_imm),
> >> + I(ImplicitOps | NearBranch | IsBranch | ShadowStack, em_ret),
> >
> >Tangentially directly related to this bug, I think we should manual annotation
> >where possible. I don't see an easy way to do that for ShadowStack, but for IBT
> >we can use IsBranch, NearBranch and the SrcXXX operance to detect IBT-affected
> >instructions. It's obviously more complex, but programmatically detecting
> >indirect branches should be less error prone. I'll do so in the next version.
> >
> >> I(DstReg | SrcMemFAddr | ModRM | No64 | Src2ES, em_lseg),
> >> I(DstReg | SrcMemFAddr | ModRM | No64 | Src2DS, em_lseg),
> >> G(ByteOp, group11), G(0, group11),
> >>
> >>
> >> And for reference, below are the changes I made to KUT's cet.c
> >
> >I now have a more comprehensive set of testcases, and it can be upstreamed
> >(relies on KVM's default behavior of injecting #UD at CPL==3 on failed emulation).
>
> IIUC, for KVM_FEP-prefixed instructions, the emulation type is set to
> EMULTYPE_TRAP_UD_FORCED. Regardless of the CPL and
> KVM_CAP_EXIT_ON_EMULATION_FAILURE, KVM will always inject #UD on failed
> emulation.
>
> r = x86_decode_emulated_instruction(vcpu, emulation_type,
> insn, insn_len);
> if (r != EMULATION_OK) {
> if ((emulation_type & EMULTYPE_TRAP_UD) ||
> (emulation_type & EMULTYPE_TRAP_UD_FORCED)) {
> kvm_queue_exception(vcpu, UD_VECTOR);
> return 1;
> }

Oh, right. Nice, that makes the KUT testcase much less hacky :-)