Re: [PATCH v15 18/41] KVM: x86: Don't emulate instructions affected by CET features

[Chao Gao]

>> --- a/arch/x86/kvm/emulate.c
>> +++ b/arch/x86/kvm/emulate.c
>> @@ -4326,8 +4326,8 @@ static const struct opcode opcode_table[256] = {
>> 	X8(I(DstReg | SrcImm64 | Mov, em_mov)),
>> 	/* 0xC0 - 0xC7 */
>> 	G(ByteOp | Src2ImmByte, group2), G(Src2ImmByte, group2),
>> -	I(ImplicitOps | NearBranch | SrcImmU16 | IsBranch, em_ret_near_imm),
>> -	I(ImplicitOps | NearBranch | IsBranch, em_ret),
>> +	I(ImplicitOps | NearBranch | SrcImmU16 | IsBranch | ShadowStack, em_ret_near_imm),
>> +	I(ImplicitOps | NearBranch | IsBranch | ShadowStack, em_ret),
>
>Tangentially directly related to this bug, I think we should manual annotation
>where possible.  I don't see an easy way to do that for ShadowStack, but for IBT
>we can use IsBranch, NearBranch and the SrcXXX operance to detect IBT-affected
>instructions.  It's obviously more complex, but programmatically detecting
>indirect branches should be less error prone.  I'll do so in the next version.
>
>> 	I(DstReg | SrcMemFAddr | ModRM | No64 | Src2ES, em_lseg),
>> 	I(DstReg | SrcMemFAddr | ModRM | No64 | Src2DS, em_lseg),
>> 	G(ByteOp, group11), G(0, group11),
>> 
>> 
>> And for reference, below are the changes I made to KUT's cet.c
>
>I now have a more comprehensive set of testcases, and it can be upstreamed
>(relies on KVM's default behavior of injecting #UD at CPL==3 on failed emulation).

IIUC, for KVM_FEP-prefixed instructions, the emulation type is set to
EMULTYPE_TRAP_UD_FORCED. Regardless of the CPL and
KVM_CAP_EXIT_ON_EMULATION_FAILURE, KVM will always inject #UD on failed
emulation.

		r = x86_decode_emulated_instruction(vcpu, emulation_type,
						    insn, insn_len);
		if (r != EMULATION_OK)  {
			if ((emulation_type & EMULTYPE_TRAP_UD) ||
			    (emulation_type & EMULTYPE_TRAP_UD_FORCED)) {
				kvm_queue_exception(vcpu, UD_VECTOR);
				return 1;
			}