linux-kernel - Re: [PATCH v4 14/19] KVM: VMX: Dump FRED context in dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4459df49-7c02-4fa8-ae69-279d2b64fb2d@zytor.com>
Date: Wed, 25 Jun 2025 10:38:13 -0700
From: Xin Li <xin@...or.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: pbonzini@...hat.com, kvm@...r.kernel.org, linux-doc@...r.kernel.org,
        linux-kernel@...r.kernel.org, corbet@....net, tglx@...utronix.de,
        mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com,
        x86@...nel.org, hpa@...or.com, andrew.cooper3@...rix.com,
        luto@...nel.org, peterz@...radead.org, chao.gao@...el.com,
        xin3.li@...el.com
Subject: Re: [PATCH v4 14/19] KVM: VMX: Dump FRED context in dump_vmcs()

On 6/24/2025 9:32 AM, Sean Christopherson wrote:
>> @@ -6519,6 +6521,16 @@ void dump_vmcs(struct kvm_vcpu *vcpu)
>>   	vmx_dump_sel("LDTR:", GUEST_LDTR_SELECTOR);
>>   	vmx_dump_dtsel("IDTR:", GUEST_IDTR_LIMIT);
>>   	vmx_dump_sel("TR:  ", GUEST_TR_SELECTOR);
>> +	if (vmentry_ctl & VM_ENTRY_LOAD_IA32_FRED)
>> +		pr_err("FRED guest: config=0x%016llx, stack_levels=0x%016llx\n"
>> +		       "RSP0=0x%016llx, RSP1=0x%016llx\n"
>> +		       "RSP2=0x%016llx, RSP3=0x%016llx\n",
>> +		       vmcs_read64(GUEST_IA32_FRED_CONFIG),
>> +		       vmcs_read64(GUEST_IA32_FRED_STKLVLS),
>> +		       __rdmsr(MSR_IA32_FRED_RSP0),
> 
> There is no guarantee the vCPU's FRED_RSP is loaded in hardware at this point.
> I think you need to use vmx_read_guest_fred_rsp0().

Good catch.

> 
>> +		       vmcs_read64(GUEST_IA32_FRED_RSP1),
>> +		       vmcs_read64(GUEST_IA32_FRED_RSP2),
>> +		       vmcs_read64(GUEST_IA32_FRED_RSP3));
>>   	efer_slot = vmx_find_loadstore_msr_slot(&vmx->msr_autoload.guest, MSR_EFER);
>>   	if (vmentry_ctl & VM_ENTRY_LOAD_IA32_EFER)
>>   		pr_err("EFER= 0x%016llx\n", vmcs_read64(GUEST_IA32_EFER));
>> @@ -6566,6 +6578,16 @@ void dump_vmcs(struct kvm_vcpu *vcpu)
>>   	       vmcs_readl(HOST_TR_BASE));
>>   	pr_err("GDTBase=%016lx IDTBase=%016lx\n",
>>   	       vmcs_readl(HOST_GDTR_BASE), vmcs_readl(HOST_IDTR_BASE));
>> +	if (vmexit_ctl & SECONDARY_VM_EXIT_LOAD_IA32_FRED)
>> +		pr_err("FRED host: config=0x%016llx, stack_levels=0x%016llx\n"
>> +		       "RSP0=0x%016lx, RSP1=0x%016llx\n"
>> +		       "RSP2=0x%016llx, RSP3=0x%016llx\n",
>> +		       vmcs_read64(HOST_IA32_FRED_CONFIG),
>> +		       vmcs_read64(HOST_IA32_FRED_STKLVLS),
>> +		       (unsigned long)task_stack_page(current) + THREAD_SIZE,
> 
> Maybe add a helper in arch/x86/include/asm/fred.h to generate the desired RSP0?
> Not sure it's worth doing that just for this code.

It's not just one usage.  I checked with:

     git grep -w task_stack_page | grep THREAD_SIZE | wc -l

And get 25.

However it is used in other architectures, so I'll work it in parallel.
I.e., likely I won't change it in the next iteration.

Thanks!
     Xin