Re: [PATCH v9 27/27] KVM: x86: Stop emulating for CET protected branch instructions

[Yang, Weijiang]

On 1/26/2024 4:53 PM, Chao Gao wrote:
> On Tue, Jan 23, 2024 at 06:42:00PM -0800, Yang Weijiang wrote:
> > Don't emulate the branch instructions, e.g., CALL/RET/JMP etc., when CET
> > is active in guest, return KVM_INTERNAL_ERROR_EMULATION to userspace to
> > handle it.
> >
> > KVM doesn't emulate CPU behaviors to check CET protected stuffs while
> > emulating guest instructions, instead it stops emulation on detecting
> > the instructions in process are CET protected. By doing so, it can avoid
> > generating bogus #CP in guest and preventing CET protected execution flow
> > subversion from guest side.
> >
> > Suggested-by: Chao Gao <chao.gao@xxxxxxxxx>
> > Signed-off-by: Yang Weijiang <weijiang.yang@xxxxxxxxx>
> > ---
> > arch/x86/kvm/emulate.c | 27 ++++++++++++++++-----------
> > 1 file changed, 16 insertions(+), 11 deletions(-)
> >
> > diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> > index e223043ef5b2..ad15ce055a1d 100644
> > --- a/arch/x86/kvm/emulate.c
> > +++ b/arch/x86/kvm/emulate.c
> > @@ -178,6 +178,7 @@
> > #define IncSP       ((u64)1 << 54)  /* SP is incremented before ModRM calc */
> > #define TwoMemOp    ((u64)1 << 55)  /* Instruction has two memory operand */
> > #define IsBranch    ((u64)1 << 56)  /* Instruction is considered a branch. */
> > +#define IsProtected ((u64)1 << 57)  /* Instruction is protected by CET. */
> the name IsProtected doesn't seem clear to me. Its meaning isn't obvious from
> the name and may be confused with protected mode. Maybe we can add two flags:
> "IndirectBranch" and "ShadowStack".

Hmm, maybe it's worth to distinguish specific instruction protection type against current CET
enabling status. Let me double check.

> > #define DstXacc     (DstAccLo | SrcAccHi | SrcWrite)
> >
> > @@ -4098,9 +4099,9 @@ static const struct opcode group4[] = {
> > static const struct opcode group5[] = {
> > 	F(DstMem | SrcNone | Lock,		em_inc),
> > 	F(DstMem | SrcNone | Lock,		em_dec),
> > -	I(SrcMem | NearBranch | IsBranch,       em_call_near_abs),
> > -	I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far),
> > -	I(SrcMem | NearBranch | IsBranch,       em_jmp_abs),
> > +	I(SrcMem | NearBranch | IsBranch | IsProtected, em_call_near_abs),
> > +	I(SrcMemFAddr | ImplicitOps | IsBranch | IsProtected, em_call_far),
> > +	I(SrcMem | NearBranch | IsBranch | IsProtected, em_jmp_abs),
> In SDM, I don't see a list of instructions that are affected by CET. how do you
> get the list.

In SDM Vol. 1/17.2 and 17.3, and Vol.2 instruction references on branch instructions.