Re: [PATCH v16 18/51] KVM: x86: Don't emulate instructions affected by CET features

Sean Christopherson
2025-09-23T16:15:26Z

On Tue, Sep 23, 2025, Xiaoyao Li wrote:
> On 9/23/2025 4:04 AM, Sean Christopherson wrote:
> Two nits besides,
> > Link:https://lore.kernel.org/r/20250919223258.1604852-19-seanjc@google.com
> > Signed-off-by: Sean Christopherson<seanjc@google.com>
> > ---
> > arch/x86/kvm/emulate.c | 117 ++++++++++++++++++++++++++++++++++++-----
> > 1 file changed, 103 insertions(+), 14 deletions(-)
> >
> > diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> > index 23929151a5b8..a7683dc18405 100644
> > --- a/arch/x86/kvm/emulate.c
> > +++ b/arch/x86/kvm/emulate.c
> > @@ -178,6 +178,7 @@
> > #define IncSP ((u64)1 << 54) /* SP is incremented before ModRM calc */
> > #define TwoMemOp ((u64)1 << 55) /* Instruction has two memory operand */
> > #define IsBranch ((u64)1 << 56) /* Instruction is considered a branch. */
> > +#define ShadowStack ((u64)1 << 57) /* Instruction affects Shadow Stacks. */
> > #define DstXacc (DstAccLo | SrcAccHi | SrcWrite)
> > @@ -4068,9 +4069,9 @@ static const struct opcode group4[] = {
> > static const struct opcode group5[] = {
> > F(DstMem | SrcNone | Lock, em_inc),
> > F(DstMem | SrcNone | Lock, em_dec),
> > - I(SrcMem | NearBranch | IsBranch, em_call_near_abs),
> > - I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far),
> > - I(SrcMem | NearBranch | IsBranch, em_jmp_abs),
> > + I(SrcMem | NearBranch | IsBranch | ShadowStack, em_call_near_abs),
> > + I(SrcMemFAddr | ImplicitOps | IsBranch | ShadowStack, em_call_far),
> > + I(SrcMem | NearBranch | IsBranch, em_jmp_abs),
>
> The change of this line is unexpected, since it only changes the indentation
> of 'em_jmp_abs'
> > static unsigned imm_size(struct x86_emulate_ctxt *ctxt)
> > {
> > unsigned size;
> > @@ -4943,6 +4998,40 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len, int
> > ctxt->execute = opcode.u.execute;
> > + /*
> > + * Reject emulation if KVM might need to emulate shadow stack updates
> > + * and/or indirect branch tracking enforcement, which the emulator
> > + * doesn't support.
> > + */
> > + if ((is_ibt_instruction(ctxt) || is_shstk_instruction(ctxt)) &&
> > + ctxt->ops->get_cr(ctxt, 4) & X86_CR4_CET) {
> > + u64 u_cet = 0, s_cet = 0;
> > +
> > + /*
> > + * Check both User and Supervisor on far transfers as inter-
> > + * privilege level transfers are impacted by CET at the target
> > + * privilege level, and that is not known at this time. The
> > + * the expectation is that the guest will not require emulation
>
> Dobule 'the'

Squashed fixes for both, thanks!