Re: [PATCH v8 11/20] KVM: x86: Handle EGPR index and REX2-incompatible opcodes

[Jim Mattson]

On Thu, Nov 5, 2026 at 8:34 PM Jim Mattson <jmattson@xxxxxxxxxx> wrote:
>
> On Wed, Sep 30, 2026 at 4:38 PM Chang S. Bae <chang.seok.bae@xxxxxxxxx> wrote:
> >
[ ... ]
> > @@ -4385,12 +4396,12 @@ static const struct opcode twobyte_table[256] = {
> >         N, GP(ModRM | DstMem | SrcReg | Mov | Sse | Avx, &pfx_0f_2b),
> >         N, N, N, N,
> >         /* 0x30 - 0x3F */
> > -       II(ImplicitOps | Priv, em_wrmsr, wrmsr),
> > -       IIP(ImplicitOps, em_rdtsc, rdtsc, check_rdtsc),
> > -       II(ImplicitOps | Priv, em_rdmsr, rdmsr),
> > -       IIP(ImplicitOps, em_rdpmc, rdpmc, check_rdpmc),
> > -       I(ImplicitOps | EmulateOnUD | IsBranch | ShadowStack, em_sysenter),
> > -       I(ImplicitOps | Priv | EmulateOnUD | IsBranch | ShadowStack, em_sysexit),
> > +       II(ImplicitOps | Priv | NoRex2, em_wrmsr, wrmsr),
> > +       IIP(ImplicitOps | NoRex2, em_rdtsc, rdtsc, check_rdtsc),
> > +       II(ImplicitOps | Priv | NoRex2, em_rdmsr, rdmsr),
> > +       IIP(ImplicitOps | NoRex2, em_rdpmc, rdpmc, check_rdpmc),
> > +       I(ImplicitOps | EmulateOnUD | IsBranch | ShadowStack | NoRex2, em_sysenter),
> > +       I(ImplicitOps | Priv | EmulateOnUD | IsBranch | ShadowStack | NoRex2, em_sysexit),
> >         N, N,
> >         N, N, N, N, N, N, N, N,
>
> Per Section 3.1.2.1 of the Intel APX specification, all opcodes in row 0x3*
> of legacy map 1 trigger #UD when prefixed with REX2. Leaving 0x36..0x3F as
> N (NotImpl) causes KVM to return EMULATION_FAILED to userspace instead of
> raising #UD when they are prefixed with REX2.

Of course, this is utter nonsense. On EMULATION_FAILED,
x86_emulate_instruction() will raise #UD, as it always has for N
(NotImpl), with or without REX2.