[PATCH v3 1/2] KVM: x86: Fix sign-extension of the INT n vector in the emulator

From: Kayra Cizmeci

Date: Sun Aug 02 2026 - 09:45:16 EST


Currently the INT n operand use SrcImmByte which translates vectors
above 127 to negative numbers. And this negative numbers gets to
(vector << 2) and from there vector are handed and without any
warnings.

Use SrcImmUByte so the vector never translates to negative.

Signed-off-by: Kayra Cizmeci <kayracizmeci@xxxxxxxxx>
---
v1: adds IDT limit check to __emulate_int_real(), link:
https://lore.kernel.org/kvm/20260608123503.23298-1-kayracizmeci@xxxxxxxxx/
v2: fixes the sign-extension of INT n, link:
https://lore.kernel.org/kvm/20260608134642.25849-1-kayracizmeci@xxxxxxxxx/
v3: rewrote commit messages, split 1 commit into 2 commits and rebased
onto current mainline.

arch/x86/kvm/emulate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index b566ab5c7515..ec3138801bb7 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4314,7 +4314,7 @@ static const struct opcode opcode_table[256] = {
I(Stack, em_leave),
I(ImplicitOps | SrcImmU16 | IsBranch | ShadowStack, em_ret_far_imm),
I(ImplicitOps | IsBranch | ShadowStack, em_ret_far),
- D(ImplicitOps | IsBranch), DI(SrcImmByte | IsBranch | ShadowStack, intn),
+ D(ImplicitOps | IsBranch), DI(SrcImmUByte | IsBranch | ShadowStack, intn),
D(ImplicitOps | No64 | IsBranch),
II(ImplicitOps | IsBranch | ShadowStack, em_iret, iret),
/* 0xD0 - 0xD7 */
--
2.53.0