linux-kernel - Re: [PATCH v10 2/9] KVM: x86: Add & use kvm_vcpu_is_legal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e84129b1-603b-a6c4-ade5-8cf529929675@linux.intel.com>
Date:   Fri, 21 Jul 2023 10:20:26 +0800
From:   Binbin Wu <binbin.wu@...ux.intel.com>
To:     Isaku Yamahata <isaku.yamahata@...il.com>
Cc:     kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        seanjc@...gle.com, pbonzini@...hat.com, chao.gao@...el.com,
        kai.huang@...el.com, David.Laight@...LAB.COM,
        robert.hu@...ux.intel.com, guang.zeng@...el.com
Subject: Re: [PATCH v10 2/9] KVM: x86: Add & use kvm_vcpu_is_legal_cr3() to
 check CR3's legality



On 7/21/2023 7:53 AM, Isaku Yamahata wrote:
> On Wed, Jul 19, 2023 at 10:41:24PM +0800,
> Binbin Wu <binbin.wu@...ux.intel.com> wrote:
>
>> Add and use kvm_vcpu_is_legal_cr3() to check CR3's legality to provide
>> a clear distinction b/t CR3 and GPA checks. So that kvm_vcpu_is_legal_cr3()
>> can be adjusted according to new feature(s).
>>
>> No functional change intended.
>>
>> Signed-off-by: Binbin Wu <binbin.wu@...ux.intel.com>
>> ---
>>   arch/x86/kvm/cpuid.h      | 5 +++++
>>   arch/x86/kvm/svm/nested.c | 4 ++--
>>   arch/x86/kvm/vmx/nested.c | 4 ++--
>>   arch/x86/kvm/x86.c        | 4 ++--
>>   4 files changed, 11 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
>> index f61a2106ba90..8b26d946f3e3 100644
>> --- a/arch/x86/kvm/cpuid.h
>> +++ b/arch/x86/kvm/cpuid.h
>> @@ -283,4 +283,9 @@ static __always_inline bool guest_can_use(struct kvm_vcpu *vcpu,
>>   	return vcpu->arch.governed_features.enabled & kvm_governed_feature_bit(x86_feature);
>>   }
>>   
>> +static inline bool kvm_vcpu_is_legal_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
>> +{
>> +	return kvm_vcpu_is_legal_gpa(vcpu, cr3);
>> +}
>> +
> The remaining user of kvm_vcpu_is_illegal_gpa() is one left.  Can we remove it
> by replacing !kvm_vcpu_is_legal_gpa()?

There are still two callsites of kvm_vcpu_is_illegal_gpa() left (basing 
on Linux 6.5-rc2), in handle_ept_violation() and nested_vmx_check_eptp().
But they could be replaced by !kvm_vcpu_is_legal_gpa() and then remove 
kvm_vcpu_is_illegal_gpa().
I am neutral to this.