Received-SPF: pass (google.com: domain of linux-kernel+bounces-40107-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <8fa9d499-dd5a-401f-9f69-60c456604c5b@intel.com>
Date: Fri, 26 Jan 2024 20:56:10 +0800
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v9 27/27] KVM: x86: Stop emulating for CET protected
 branch instructions
Content-Language: en-US
To: Chao Gao <chao.gao@intel.com>
CC: <seanjc@google.com>, <pbonzini@redhat.com>, <dave.hansen@intel.com>,
	<kvm@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <x86@kernel.org>,
	<yuan.yao@linux.intel.com>, <peterz@infradead.org>,
	<rick.p.edgecombe@intel.com>, <mlevitsk@redhat.com>, <john.allen@amd.com>
References: <20240124024200.102792-1-weijiang.yang@intel.com>
 <20240124024200.102792-28-weijiang.yang@intel.com>
 <ZbNy7TVq62JurQRc@chao-email>
From: "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <ZbNy7TVq62JurQRc@chao-email>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WWNVZXdKZVg5UHI4ZTQyaGl2Z3NSTXNPaHhsV0E1aHMyV1hQTFNjZ0RMaVBt?=
 =?utf-8?B?Sm9BSnBvcDkxRzFuWitldUJNREQweHlQZ1daWWRCVDFwSndXQnVNUzFuOXR4?=
 =?utf-8?B?K28wWTFJeTd3d2JKVkVsUDltVEF5aXZTWkNVdnRqR2kyNmZ3UGJHRGRnTHdT?=
 =?utf-8?B?bHp1KzBEc3Q5VlR3STJrT0hQVVRZNGZ0cmttOSt4TzdXQVJzdWFDeTE5NW83?=
 =?utf-8?B?TDVNSmoyYlFWSlVOczdrQzlJVzBlQm5yNGJweXluVEFHMDdNVEQ3VWZEcUZL?=
 =?utf-8?B?V3IvUG1jNUVGZ3Q1L3RUN1JWNzdOVlpqV0xTOXNDV1MwMHdVRE51ZmlvcUNr?=
 =?utf-8?B?bFJRRUZFVmszMlc0VkRIK1BQTGxxZzI0cTRjQ2dLS0t1TUZkeWFqbVBhVkov?=
 =?utf-8?B?L3JLSjBoUXVraHRJUW9QYjVpYjd1L0NOc2Z4VExlQmcwbmhDZWR1UlA2bDdr?=
 =?utf-8?B?VUwyVlIwSHgxYkRsZC9Za3NHQWo1LzJRWjBNblNwVXdpVXl2ejFKVGEvNzVt?=
 =?utf-8?B?VEFhSGNJUzl5WDJPYUlpb29Ic2FBbzZycllWc1V0VUJYV1BEcUoyQUo4dDZj?=
 =?utf-8?B?WmQ5L2w3VW0xMXZLTGpJdEhyai9tdGg5SE9BWGl4bnY1cnFvSmpkOW1KMlZQ?=
 =?utf-8?B?TVZjQUh1cEs5MEdaWDJjMFlOeWpQeDdNSUxLSHFuRW1CMnE0WDdiaXJYZTdL?=
 =?utf-8?B?U0NRZGk4eHM1NXAxLzJvTXRkcWJoNEQ5TElHUm5iWXpXLzZEcHNIZmZTYVds?=
 =?utf-8?B?aDJTS3NZMm1yTHRDUGIzS29JTzRuV3VoZzBCNmpiZHRRK1pIK2VCSnBXTEtW?=
 =?utf-8?B?VUJ1WkV2bm4ySnIyRExWVXpFbGxUMGVPOFpEVzA4aVRDTXdmRU95VG0vMkFa?=
 =?utf-8?B?WEFZenNTYURhQ1k0bjJQbzFFU1I4dTZPNHRvRFJad28yQm1vRDE1c2ZvRThw?=
 =?utf-8?B?ZWE2ZEZ5OWVVQndlaFYwaHJVSWx5bnVkdDVHck5weFZESWRGQWtLNW9jTkN0?=
 =?utf-8?B?TkpBSFBLZXNhaEtBUW81RjZKejYyUXJ1UnFhYU8rZHl2REtNUTV5eEdCRFN3?=
 =?utf-8?B?WDJ6WHNVeGNOL2p5N3Nlc1NlZ3dTQVU1b0VQN3pqNDhNa0ltWUV5TzRhbXhi?=
 =?utf-8?B?ZGZaRXBTQmFlWU1aRzJDcWdQSHYrY3l2MGpUUHlIakZ3TENrM1p1YWZrR0NI?=
 =?utf-8?B?WDVUdDVtalBidjNWTjRhcVN0MWErQUhnUEJuRy9CVHJQS3IyM2RCOE1Tdmsz?=
 =?utf-8?B?cWtPWk9yRUpVMHNCc1p0aHBuVlVJSkpXQlFGbGVDY25uVHJIazIybVFnQktX?=
 =?utf-8?B?K01FT3p6Wmw2SVpOYjZ1ZzNsNGh6L3RjWDN5b1BhV0cwVlRseVh1bEpvWmVX?=
 =?utf-8?B?M2JVSnhnZ2dFOEJna0dFSEJvczJkZ2dSN3BzbmhvdTFZK1p5SzQ2M0FZdXd2?=
 =?utf-8?B?TVdCQVAvWmI3eXdYRVdWY1ZYVFVubUh4L0NHcnFIYlVJbjAvMUljbkFCaEgy?=
 =?utf-8?B?bk9DRGpJVUZjYXVxV0ZkaHV5WGxNUUVtWmtTWUhQUGgvWmprTHVRZVFQMlRT?=
 =?utf-8?B?R0tlWHI1WEhsNEJlaTJDSEVmSTVyUVc3Q0gzZ2ZXWERGdU1DNWFYRkxjMmV0?=
 =?utf-8?B?cHd1TmpIbnUzKzhOZm9NejF4K2JoSUNjbTZmTmcxaTdpRjUzTTM1QnlJdURR?=
 =?utf-8?B?dU5GQlFCMDV3QTB4SSs3RGJST2xTdGJZNk1iVmFpWXQ2TWNIZzBpdzByZTNL?=
 =?utf-8?B?RlBxbGd0VXRpbGtEcTUwRzY0QWNsUmlFN0I3bG9tK2dWZTVoc3QvTDVVRUZ0?=
 =?utf-8?B?Nm9aMUw5ZE1QQkNaemVUNTgzdFlsNXVIQzBYdTFVcVhaRTYxR2lIOG5FU1Zu?=
 =?utf-8?B?TXJsSG80cDB0dDhxR0xUY1BPbmNkRTRGNjF0Tm5pcS8rRHJJdzZsU3lmSkxY?=
 =?utf-8?B?ZlFoUStjcWJrN2VVZEVLbVJ4TWpnYkwzNkRUL2VCME1JSG9vYVNtT0xsdCt6?=
 =?utf-8?B?dzhhNFRRRTdRUytseDdmQkZyTmV0REZ4V09JSzZsQUlobUI2VEtiSWVFd2VJ?=
 =?utf-8?B?a3VSSG9ucDI2eFc1OUtSeW9NWmtJeWV6M1FUbnFhWnhJWVdZTE9HczdmWHdJ?=
 =?utf-8?B?cWNiM3BuRGVrN2VIRndUcG5aT1JSQkxHNjZnR2RWT2xSczZ3ellwb0xldE9P?=
 =?utf-8?B?Y1E9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: a650ec35-3e80-4238-d7f6-08dc1e6e2f95
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2024 12:56:17.6287
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: MuZApplB8GigN1KAM9gQGadMvr61Au9U5xPj2MdeygrTznvoOjIlKpry141m40RlDGumOKIior8HX0twucsLKw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB5376
X-OriginatorOrg: intel.com

On 1/26/2024 4:53 PM, Chao Gao wrote:
> On Tue, Jan 23, 2024 at 06:42:00PM -0800, Yang Weijiang wrote:
>> Don't emulate the branch instructions, e.g., CALL/RET/JMP etc., when CET
>> is active in guest, return KVM_INTERNAL_ERROR_EMULATION to userspace to
>> handle it.
>>
>> KVM doesn't emulate CPU behaviors to check CET protected stuffs while
>> emulating guest instructions, instead it stops emulation on detecting
>> the instructions in process are CET protected. By doing so, it can avoid
>> generating bogus #CP in guest and preventing CET protected execution flow
>> subversion from guest side.
>>
>> Suggested-by: Chao Gao <chao.gao@intel.com>
>> Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
>> ---
>> arch/x86/kvm/emulate.c | 27 ++++++++++++++++-----------
>> 1 file changed, 16 insertions(+), 11 deletions(-)
>>
>> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
>> index e223043ef5b2..ad15ce055a1d 100644
>> --- a/arch/x86/kvm/emulate.c
>> +++ b/arch/x86/kvm/emulate.c
>> @@ -178,6 +178,7 @@
>> #define IncSP       ((u64)1 << 54)  /* SP is incremented before ModRM calc */
>> #define TwoMemOp    ((u64)1 << 55)  /* Instruction has two memory operand */
>> #define IsBranch    ((u64)1 << 56)  /* Instruction is considered a branch. */
>> +#define IsProtected ((u64)1 << 57)  /* Instruction is protected by CET. */
> the name IsProtected doesn't seem clear to me. Its meaning isn't obvious from
> the name and may be confused with protected mode. Maybe we can add two flags:
> "IndirectBranch" and "ShadowStack".

Hmm, maybe it's worth to distinguish specific instruction protection type against current CET
enabling status. Let me double check.

>> #define DstXacc     (DstAccLo | SrcAccHi | SrcWrite)
>>
>> @@ -4098,9 +4099,9 @@ static const struct opcode group4[] = {
>> static const struct opcode group5[] = {
>> 	F(DstMem | SrcNone | Lock,		em_inc),
>> 	F(DstMem | SrcNone | Lock,		em_dec),
>> -	I(SrcMem | NearBranch | IsBranch,       em_call_near_abs),
>> -	I(SrcMemFAddr | ImplicitOps | IsBranch, em_call_far),
>> -	I(SrcMem | NearBranch | IsBranch,       em_jmp_abs),
>> +	I(SrcMem | NearBranch | IsBranch | IsProtected, em_call_near_abs),
>> +	I(SrcMemFAddr | ImplicitOps | IsBranch | IsProtected, em_call_far),
>> +	I(SrcMem | NearBranch | IsBranch | IsProtected, em_jmp_abs),
> In SDM, I don't see a list of instructions that are affected by CET. how do you
> get the list.

In SDM Vol. 1/17.2 and 17.3, and Vol.2 instruction references on branch instructions.