On Mon, May 18, 2020 at 07:37:08PM +0200, Paolo Bonzini wrote: > On 18/05/20 18:07, Sean Christopherson wrote: > > On Fri, May 15, 2020 at 12:19:19PM -0400, Paolo Bonzini wrote: > >> Instructions starting with 0f18 up to 0f1f are reserved nops, except those > >> that were assigned to MPX. > > Well, they're probably reserved NOPs again :-D. > > So are you suggesting adding them back to the list as well? Doesn't KVM still support MPX? > >> These include the endbr markers used by CET. > > And RDSPP. Wouldn't it make sense to treat RDSPP as a #UD even though it's > > a NOP if CET is disabled? The logic being that a sane guest will execute > > RDSSP iff CET is enabled, and in that case it'd be better to inject a #UD > > than to silently break the guest. > > We cannot assume that guests will bother checking CPUID before invoking > RDSPP. This is especially true userspace, which needs to check if CET > is enable for itself and can only use RDSPP to do so. Ugh, yeah, just read through the CET enabling thread that showed code snippets that do exactly this. I assume it would be best to make SHSTK dependent on unrestricted guest? Emulating RDSPP by reading vmcs.GUEST_SSP seems pointless as it will become statle apart on the first emulated CALL/RET.
