On Fri, Jan 05, 2024, Weijiang Yang wrote: > On 1/5/2024 8:54 AM, Sean Christopherson wrote: > > On Fri, Jan 05, 2024, Rick P Edgecombe wrote: > > > > For CALL/RET (and presumably any branch instructions with IBT?) other > > > > instructions that are directly affected by CET, the simplest thing would > > > > probably be to disable those in KVM's emulator if shadow stacks and/or IBT > > > > are enabled, and let KVM's failure paths take it from there. > > > Right, that is what I was wondering might be the normal solution for > > > situations like this. > > If KVM can't emulate something, it either retries the instruction (with some > > decent logic to guard against infinite retries) or punts to userspace. > > What kind of error is proper if KVM has to punt to userspace? KVM_INTERNAL_ERROR_EMULATION. See prepare_emulation_failure_exit(). > Or just inject #UD into guest on detecting this case? No, do not inject #UD or do anything else that deviates from architecturally defined behavior.
