Re: [PATCH v9 27/27] KVM: x86: Stop emulating for CET protected branch instructions

[Chao Gao]

On Tue, Jan 23, 2024 at 06:42:00PM -0800, Yang Weijiang wrote:
>Don't emulate the branch instructions, e.g., CALL/RET/JMP etc., when CET
>is active in guest, return KVM_INTERNAL_ERROR_EMULATION to userspace to
>handle it.
>
>KVM doesn't emulate CPU behaviors to check CET protected stuffs while
>emulating guest instructions, instead it stops emulation on detecting
>the instructions in process are CET protected. By doing so, it can avoid
>generating bogus #CP in guest and preventing CET protected execution flow
>subversion from guest side.
>
>Suggested-by: Chao Gao <chao.gao@xxxxxxxxx>
>Signed-off-by: Yang Weijiang <weijiang.yang@xxxxxxxxx>
>---
> arch/x86/kvm/emulate.c | 27 ++++++++++++++++-----------
> 1 file changed, 16 insertions(+), 11 deletions(-)
>
>diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
>index e223043ef5b2..ad15ce055a1d 100644
>--- a/arch/x86/kvm/emulate.c
>+++ b/arch/x86/kvm/emulate.c
>@@ -178,6 +178,7 @@
> #define IncSP       ((u64)1 << 54)  /* SP is incremented before ModRM calc */
> #define TwoMemOp    ((u64)1 << 55)  /* Instruction has two memory operand */
> #define IsBranch    ((u64)1 << 56)  /* Instruction is considered a branch. */
>+#define IsProtected ((u64)1 << 57)  /* Instruction is protected by CET. */

the name IsProtected doesn't seem clear to me. Its meaning isn't obvious from
the name and may be confused with protected mode. Maybe we can add two flags:
"IndirectBranch" and "ShadowStack".

> 
> #define DstXacc     (DstAccLo | SrcAccHi | SrcWrite)
> 
>@@ -4098,9 +4099,9 @@ static const struct opcode group4[] = {
> static const struct opcode group5[] = {
> 	F(DstMem | SrcNone | Lock,		em_inc),
> 	F(DstMem | SrcNone | Lock,		em_dec),
>-	I(SrcMem | NearBranch | IsBranch,       em_call_near_abs),
>-	I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far),
>-	I(SrcMem | NearBranch | IsBranch,       em_jmp_abs),
>+	I(SrcMem | NearBranch | IsBranch | IsProtected, em_call_near_abs),
>+	I(SrcMemFAddr | ImplicitOps | IsBranch | IsProtected, em_call_far),
>+	I(SrcMem | NearBranch | IsBranch | IsProtected, em_jmp_abs),

In SDM, I don't see a list of instructions that are affected by CET. how do you
get the list.