linux-kernel - Re: [PATCH v2 10/21] KVM:x86: Add #CP support in guest exception classification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 May 2023 13:36:13 +0800
From:   Binbin Wu <binbin.wu@...ux.intel.com>
To:     "Yang, Weijiang" <weijiang.yang@...el.com>
Cc:     rick.p.edgecombe@...el.com, seanjc@...gle.com, pbonzini@...hat.com,
        peterz@...radead.org, john.allen@....com, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 10/21] KVM:x86: Add #CP support in guest exception
 classification



On 5/4/2023 11:41 AM, Yang, Weijiang wrote:
>
> On 4/28/2023 2:09 PM, Binbin Wu wrote:
>>
>>
>> On 4/21/2023 9:46 PM, Yang Weijiang wrote:
>>> Add handling for Control Protection (#CP) exceptions(vector 21).
>>> The new vector is introduced for Intel's Control-Flow Enforcement
>>> Technology (CET) relevant violation cases.
>>> See Intel's SDM for details.
>>>
> [...]
>>>   -static int exception_class(int vector)
>>> +static int exception_class(struct kvm_vcpu *vcpu, int vector)
>>>   {
>>>       switch (vector) {
>>>       case PF_VECTOR:
>>>           return EXCPT_PF;
>>> +    case CP_VECTOR:
>>> +        if (vcpu->arch.cr4_guest_rsvd_bits & X86_CR4_CET)
>>> +            return EXCPT_BENIGN;
>>> +        return EXCPT_CONTRIBUTORY;
>> By definition, #CP is Contributory.
>> Can you explain more about this change here which treats #CP as 
>> EXCPT_BENIGN when CET is not enabled in guest?
>
> I check the history of this patch, found maintainer modified the patch 
> due to some unit test issue in L1. You can check the
>
> details here:
>
> Re: [PATCH v15 04/14] KVM: x86: Add #CP support in guest exception 
> dispatch - Sean Christopherson (kernel.org) 
> <https://lore.kernel.org/all/YBsZwvwhshw+s7yQ@google.com/>
>
OK, is it better to add the reason in changelog?

IIUC, a new contributory exception vector (if any) should be handled 
similarly (i.e., treated as contributory conditionally) in the future, 
right?


>
>>
>> In current KVM code, there is suppose no #CP triggered in guest if 
>> CET is not enalbed in guest, right?
>
> Yes.
>
>>>       case DE_VECTOR:
>>>       case TS_VECTOR:
>>>       case NP_VECTOR:
>
>
> [...]
>