[kvm-unit-tests PATCH v3 17/17] x86/cet: Add testcases to verify KVM rejects emulation of CET instructions

Sean Christopherson
2025-11-14T00:13:30Z

Add SHSTK and IBT testcases to verify that KVM rejects (forced) emulation
of instructions that interact with SHSTK and/or IBT state, as KVM doesn't
support emulating SHSTK or IBT (rejecting emulation is preferable to
compromising guest security).

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
x86/cet.c | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 121 insertions(+), 2 deletions(-)

diff --git a/x86/cet.c b/x86/cet.c
index 26cd1c9b..34c78210 100644
--- a/x86/cet.c
+++ b/x86/cet.c
@@ -75,6 +75,113 @@ static uint64_t cet_ibt_func(void)
return 0;
}

+#define __CET_TEST_UNSUPPORTED_INSTRUCTION(insn) \
+({ \
+ struct far_pointer32 fp = { \
+ .offset = 0, \
+ .selector = USER_CS, \
+ }; \
+ \
+ asm volatile ("push %%rax\n" \
+ ASM_TRY_FEP("1f") insn "\n\t" \
+ "1:" \
+ "pop %%rax\n" \
+ : : "m" (fp), "a" (NONCANONICAL) : "memory"); \
+ \
+ exception_vector(); \
+})
+
+#define SHSTK_TEST_UNSUPPORTED_INSTRUCTION(insn) \
+do { \
+ uint8_t vector = __CET_TEST_UNSUPPORTED_INSTRUCTION(insn); \
+ \
+ report(vector == UD_VECTOR, "Wanted #UD on %s, got %s", \
+ insn, exception_mnemonic(vector)); \
+} while (0)
+
+/*
+ * Treat IRET as unsupported with IBT even though the minimal interactions with
+ * IBT _could_ be easily emulated by KVM, as KVM doesn't support emulating IRET
+ * outside of Real Mode.
+ */
+#define CET_TEST_UNSUPPORTED_INSTRUCTIONS(CET) \
+do { \
+ CET##_TEST_UNSUPPORTED_INSTRUCTION("callq *%%rax"); \
+ CET##_TEST_UNSUPPORTED_INSTRUCTION("lcall *%0"); \
+ CET##_TEST_UNSUPPORTED_INSTRUCTION("syscall"); \
+ CET##_TEST_UNSUPPORTED_INSTRUCTION("sysenter"); \
+ CET##_TEST_UNSUPPORTED_INSTRUCTION("iretq"); \
+} while (0)
+
+static uint64_t cet_shstk_emulation(void)
+{
+ CET_TEST_UNSUPPORTED_INSTRUCTIONS(SHSTK);
+
+ SHSTK_TEST_UNSUPPORTED_INSTRUCTION("call 1f");
+ SHSTK_TEST_UNSUPPORTED_INSTRUCTION("retq");
+ SHSTK_TEST_UNSUPPORTED_INSTRUCTION("retq $10");
+ SHSTK_TEST_UNSUPPORTED_INSTRUCTION("lretq");
+ SHSTK_TEST_UNSUPPORTED_INSTRUCTION("lretq $10");
+
+ /* Do a handful of JMPs to verify they aren't impacted by SHSTK. */
+ asm volatile(KVM_FEP "jmp 1f\n\t"
+ "1:\n\t"
+ KVM_FEP "lea 2f(%%rip), %%rax\n\t"
+ KVM_FEP "jmp *%%rax\n\t"
+ "2:\n\t"
+ KVM_FEP "push $" xstr(USER_CS) "\n\t"
+ KVM_FEP "lea 3f(%%rip), %%rax\n\t"
+ KVM_FEP "push %%rax\n\t"
+ /* Manually encode ljmpq, which gas doesn't recognize :-( */
+ KVM_FEP ".byte 0x48\n\t"
+ "ljmpl *(%%rsp)\n\t"
+ "3:\n\t"
+ KVM_FEP "pop %%rax\n\t"
+ KVM_FEP "pop %%rax\n\t"
+ ::: "eax");
+
+ return 0;
+}
+
+/*
+ * Don't invoke printf() or report() in the IBT testcase, as it will likely
+ * generate an indirect branch without an endbr64 annotation and thus #CP.
+ * Return the line number of the macro invocation to signal failure.
+ */
+#define IBT_TEST_UNSUPPORTED_INSTRUCTION(insn) \
+do { \
+ uint8_t vector = __CET_TEST_UNSUPPORTED_INSTRUCTION(insn); \
+ \
+ if (vector != UD_VECTOR) \
+ return __LINE__; \
+} while (0)
+
+static uint64_t cet_ibt_emulation(void)
+{
+ CET_TEST_UNSUPPORTED_INSTRUCTIONS(IBT);
+
+ IBT_TEST_UNSUPPORTED_INSTRUCTION("jmp *%%rax");
+ IBT_TEST_UNSUPPORTED_INSTRUCTION("ljmp *%0");
+
+ /* Verify direct CALLs and JMPs, and all RETs aren't impacted by IBT. */
+ asm volatile(KVM_FEP "jmp 2f\n\t"
+ "1: " KVM_FEP " ret\n\t"
+ "2: " KVM_FEP " call 1b\n\t"
+ KVM_FEP "push $" xstr(USER_CS) "\n\t"
+ KVM_FEP "lea 3f(%%rip), %%rax\n\t"
+ KVM_FEP "push %%rax\n\t"
+ KVM_FEP "lretq\n\t"
+ "3:\n\t"
+ KVM_FEP "push $0x55555555\n\t"
+ KVM_FEP "push $" xstr(USER_CS) "\n\t"
+ KVM_FEP "lea 4f(%%rip), %%rax\n\t"
+ KVM_FEP "push %%rax\n\t"
+ KVM_FEP "lretq $8\n\t"
+ "4:\n\t"
+ ::: "eax");
+ return 0;
+}
+
#define CP_ERR_NEAR_RET 0x0001
#define CP_ERR_FAR_RET 0x0002
#define CP_ERR_ENDBR 0x0003
@@ -117,15 +224,20 @@ static void test_shstk(void)
/* Store shadow-stack pointer. */
wrmsr(MSR_IA32_PL3_SSP, (u64)(shstk_virt + 0x1000));

- printf("Unit tests for CET user mode...\n");
+ printf("Running user mode Shadow Stack tests\n");
run_in_user(cet_shstk_func, CP_VECTOR, 0, 0, 0, 0, &rvc);
report(rvc && exception_error_code() == CP_ERR_NEAR_RET,
"NEAR RET shadow-stack protection test");
-
run_in_user(cet_shstk_far_ret, CP_VECTOR, 0, 0, 0, 0, &rvc);
report(rvc && exception_error_code() == CP_ERR_FAR_RET,
"FAR RET shadow-stack protection test");

+ if (is_fep_available &&
+ (run_in_user(cet_shstk_emulation, CP_VECTOR, 0, 0, 0, 0, &rvc) || rvc))
+ report_fail("Forced emulation with SHSTK generated %s(%u)",
+ exception_mnemonic(exception_vector()),
+ exception_error_code());
+
/* SSP should be 4-Byte aligned */
vector = wrmsr_safe(MSR_IA32_PL3_SSP, 0x1);
report(vector == GP_VECTOR, "MSR_IA32_PL3_SSP alignment test.");
@@ -133,6 +245,7 @@ static void test_shstk(void)

static void test_ibt(void)
{
+ uint64_t l;
bool rvc;

if (!this_cpu_has(X86_FEATURE_IBT)) {
@@ -146,6 +259,12 @@ static void test_ibt(void)
run_in_user(cet_ibt_func, CP_VECTOR, 0, 0, 0, 0, &rvc);
report(rvc && exception_error_code() == CP_ERR_ENDBR,
"Indirect-branch tracking test");
+
+ if (is_fep_available &&
+ ((l = run_in_user(cet_ibt_emulation, CP_VECTOR, 0, 0, 0, 0, &rvc)) || rvc))
+ report_fail("Forced emulation with IBT generated %s(%u) at line %lu",
+ exception_mnemonic(exception_vector()),
+ exception_error_code(), l);
}

int main(int ac, char **av)
--
2.52.0.rc1.455.g30608eb744-goog