linux-kernel - Re: [PATCH v5 2/7] x86/fpu: Drop @perm from guest pseudo FPU container

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aAL1+O1vKZSdbZji@intel.com>
Date: Sat, 19 Apr 2025 09:01:44 +0800
From: Chao Gao <chao.gao@...el.com>
To: "Chang S. Bae" <chang.seok.bae@...el.com>
CC: <x86@...nel.org>, <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>,
	<tglx@...utronix.de>, <dave.hansen@...el.com>, <seanjc@...gle.com>,
	<pbonzini@...hat.com>, <peterz@...radead.org>, <rick.p.edgecombe@...el.com>,
	<weijiang.yang@...el.com>, <john.allen@....com>, <bp@...en8.de>,
	<xin3.li@...el.com>, Maxim Levitsky <mlevitsk@...hat.com>, Ingo Molnar
	<mingo@...hat.com>, Dave Hansen <dave.hansen@...ux.intel.com>, "H. Peter
 Anvin" <hpa@...or.com>, Samuel Holland <samuel.holland@...ive.com>, "Mitchell
 Levy" <levymitchell0@...il.com>, Stanislav Spassov <stanspas@...zon.de>,
	"Eric Biggers" <ebiggers@...gle.com>
Subject: Re: [PATCH v5 2/7] x86/fpu: Drop @perm from guest pseudo FPU
 container

On Fri, Apr 18, 2025 at 01:51:02PM -0700, Chang S. Bae wrote:
>On 4/10/2025 12:24 AM, Chao Gao wrote:
>> Remove @perm from the guest pseudo FPU container. The field is
>> initialized during allocation and never used later.
>> 
>> Rename fpu_init_guest_permissions() to show that its sole purpose is to
>> lock down guest permissions.
>> 
>> Suggested-by: Maxim Levitsky <mlevitsk@...hat.com>
>
>This patch appears to be new in V3, as I can see from the diff here:
>
>https://github.com/ChangSeokBae/kernel/compare/xstate-scet-chao-v2...xstate-scet-chao-v3
>
>However, I don’t see any relevant comment from Maxim on your V2 series.
>Unlike patch 1, this one doesn’t include a URL referencing the suggestion
>either -- so I suspect the Suggested-by tag might be incorrect.

v3 was the version where I truly began refining the patches based on my
understanding, the historical discussion, and feedback on v2 [*]. While
reviewing the historical discussion, I found Maxim's suggestion to be
valuable:

https://lore.kernel.org/kvm/af972fe5981b9e7101b64de43c7be0a8cc165323.camel@redhat.com/

So, I implemented it in v3, but I should have included the link.

[*] v2 was simply a resend of v1
    https://lore.kernel.org/kvm/20241126101710.62492-1-chao.gao@intel.com/

>> @@ -255,7 +252,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)
>>   	if (WARN_ON_ONCE(fpu_user_cfg.default_size > gfpu->uabi_size))
>>   		gfpu->uabi_size = fpu_user_cfg.default_size;
>> -	fpu_init_guest_permissions(gfpu);
>> +	fpu_lock_guest_permissions();
>
>As a future improvement, you might consider updating this to:
>
>    if (xstate_get_guest_group_perm() & FPU_GUEST_PERM_LOCKED)
>        fpu_lock_guest_permissions();
>
>Or, embed the check inside fpu_lock_guest_permissions():
>
>    if (xstate_get_guest_group_perm() & FPU_GUEST_PERM_LOCKED)
>        return;
>
>But for this patch itself, the change looks good to me. Please feel free to
>add my tag:
>
>    Reviewed-by: Chang S. Bae <chang.seok.bae@...el.com>

Thanks a lot.