Re: [PATCH v15 18/41] KVM: x86: Don't emulate instructions affected by CET features

Sean Christopherson
2025-09-19T01:25:16Z

On Thu, Sep 18, 2025, Chao Gao wrote:
> >>
> >> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> >> index 542d3664afa3..e4be54a677b0 100644
> >> --- a/arch/x86/kvm/emulate.c
> >> +++ b/arch/x86/kvm/emulate.c
> >> @@ -178,6 +178,8 @@
> >> #define IncSP ((u64)1 << 54) /* SP is incremented before ModRM calc */
> >> #define TwoMemOp ((u64)1 << 55) /* Instruction has two memory operand */
> >> #define IsBranch ((u64)1 << 56) /* Instruction is considered a branch. */
> >> +#define ShadowStack ((u64)1 << 57) /* Instruction protected by Shadow Stack. */
> >> +#define IndirBrnTrk ((u64)1 << 58) /* Instruction protected by IBT. */
> >> #define DstXacc (DstAccLo | SrcAccHi | SrcWrite)
> >> @@ -4068,9 +4070,9 @@ static const struct opcode group4[] = {
> >> static const struct opcode group5[] = {
> >> F(DstMem | SrcNone | Lock, em_inc),
> >> F(DstMem | SrcNone | Lock, em_dec),
> >> - I(SrcMem | NearBranch | IsBranch, em_call_near_abs),
> >> - I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far),
> >> - I(SrcMem | NearBranch | IsBranch, em_jmp_abs),
> >> + I(SrcMem | NearBranch | IsBranch | ShadowStack | IndirBrnTrk, em_call_near_abs),
> >> + I(SrcMemFAddr | ImplicitOps | IsBranch | ShadowStack | IndirBrnTrk, em_call_far),
> >> + I(SrcMem | NearBranch | IsBranch | IndirBrnTrk, em_jmp_abs),
> >
> >> I(SrcMemFAddr | ImplicitOps | IsBranch, em_jmp_far),
> >
> >It seems this entry for 'FF 05' (Jump far, absolute indirect) needs to set
> >ShadowStack and IndirBrnTrk as well?
>
> Yes. I just checked the pseudo code of the JMP instruction in SDM vol2. A far
> jump to a CONFORMING-CODE-SEGMENT or NONCONFORMING-CODE-SEGMENT is affected by
> both shadow stack and IBT, and a far jump to a call gate is affected by IBT.

The SHSTK interaction is only a #GP condition though, and it's not _that_ awful
to emulation. While somewhat silly, I think it makes sense to reject FAR JMP if
its IBT, but implement the SHSTK check. Rejecting a JMP instruction for SHSTK
is weird/confusing (though definitely easier).