Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Duan, Zhenzhong" <zhenzhong.duan@intel.com>
To:     Sean Christopherson <seanjc@google.com>
CC:     "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "vkuznets@redhat.com" <vkuznets@redhat.com>,
        "wanpengli@tencent.com" <wanpengli@tencent.com>,
        "jmattson@google.com" <jmattson@google.com>,
        "joro@8bytes.org" <joro@8bytes.org>
Subject: RE: [PATCH] KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue
Thread-Topic: [PATCH] KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue
Thread-Index: AQHXosCKZyngCX9ZDkW4FcXraUV7iauZRY8AgBxkG9A=
Date:   Sun, 26 Sep 2021 01:43:33 +0000
Message-ID: <DM8PR11MB56709E73A02D416A99AD706692A69@DM8PR11MB5670.namprd11.prod.outlook.com>
References: <20210906014323.170235-1-zhenzhong.duan@intel.com>
 <YTf+ygFFLWdHXHX3@google.com>
In-Reply-To: <YTf+ygFFLWdHXHX3@google.com>
Accept-Language: en-US
Content-Language: en-US
dlp-product: dlpe-windows
dlp-version: 11.6.200.16
dlp-reaction: no-action
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?GoilWgiFGztPvlzhlzd47X4iUZvppClig8znFJTS6XbkwyPQoJIZE43dFfUO?=
 =?us-ascii?Q?eFrPcXrdk0+ImTpv3JSntpAJFvaqO5AvcoHysppX34l27boXvfaQOusG7PDz?=
 =?us-ascii?Q?yXWZyrutHnntI5igxuDMlndnjCz3WDn+91ExXPHiWsLfTg/VKBLTlJDPv8Zj?=
 =?us-ascii?Q?mQxGE66pADYSwuC5gmGGL4+bwjIHoLH/7R7RTSPg/AhT6/+ono3ULpDqqEui?=
 =?us-ascii?Q?3K5eHlfonHMGnIIdD3P/it5Fxf699ORWCL14u13/cqgY2ZnMhU402Ha5e5uc?=
 =?us-ascii?Q?x/NaIAFiSdr5aYD37LKdMaDBINAA03WzxEfOYNE7lKovDnmZymfX0HuyXD20?=
 =?us-ascii?Q?9sX6iuQh96WPGkyWCD6l1hvZOtBTKiUvNiXHn8FpYPGIVL6Gp5zjB1EHrbu7?=
 =?us-ascii?Q?nvFD2vnOzbKrvrg0qPfMglYxoPoUg0j6VURwoPq4+cB5iZaChkWfVs3Dpc6w?=
 =?us-ascii?Q?DrxkA7G6GN33jLmIo6CYokOuuy3qONShZdw1TlnYyMDQp5qTZZD341lGdefa?=
 =?us-ascii?Q?X9dVY0yREe82GQ9u2I7XChtSP6saPS15hzfaQd396+4mTvgiWrJRj+jb7Gpl?=
 =?us-ascii?Q?UsqfPe/5/b09xanipcRWdNTk3Wu5K67a760YR1AFliy6Wc3KdRWQtbA02AM6?=
 =?us-ascii?Q?qedavL32ijx34VaJ2h3bfQ+PqNv0mjJgFTG3esKcdCsLVHsRDjR36th8pFV/?=
 =?us-ascii?Q?UVag5g6AHpDPu5VD5n5pY4cWrYrMraX2D6TxjYBMLA5GeW9wt8O+yzqTFDb4?=
 =?us-ascii?Q?Say3rt+6M4GbaEA9ALZ8TQgYrikbcYXILQ1ykYtvB2SX7N/6SkPMUmFawa0e?=
 =?us-ascii?Q?kxs3AhoCdDdq4bAio+4mnDBjZjrwLwOH1bDiM9YQf2lofg22LUPDyqxnyGZy?=
 =?us-ascii?Q?ZPgND7QK6nMY7IwhZOVpqj1Gh7h6mmfso76oIsUq97ir5oS7adA8os5SWaws?=
 =?us-ascii?Q?CVecl3mY6147jA4V78Gia7obX3enxpPF4+vgw9yqfBuFHWCk44FLYuuZRcqd?=
 =?us-ascii?Q?ONlo2CkwSfOG0bZsUwSrITAS0F4HyXglP+zxP9ppx63Gdan6V46tSvW3uL+z?=
 =?us-ascii?Q?MSjP7rPyTC1tU3ODv7SyMiWY4/T4M3YThQ4mJGExyupvH0yN9XN0iVfymaLs?=
 =?us-ascii?Q?GKyTQJX+FEWdxekVrHutoCotsGCbPjE30/4JE9eSF9JFGfs+0iF6j/PwcDmC?=
 =?us-ascii?Q?Ucm0nM8c5ptWpvwzqW4Dn8ebcDhQgZlgekeam+MxMw9UQUMARt77povtF4yv?=
 =?us-ascii?Q?LUv3XW4vU6yyUXzYLWh7HvmX7nEkUTMRgDrL8kVraUmkrHHS7xRbTaEKhFQX?=
 =?us-ascii?Q?Itg=3D?=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM8PR11MB5670.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a764a80e-b91a-4489-41e6-08d9808f0d19
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Sep 2021 01:43:33.6520
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gG271sVQg9U27ItpLF1PlC8Y0P0mKA9DWCT8hvTBIwvX77VLIV80TVhYFSjl9I8NytLkaX2NtdxY3mSsYhVdhBCKZIfQlxd7ghbYS1KFfyE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM8PR11MB5573
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

>-----Original Message-----
>From: Sean Christopherson <seanjc@google.com>
>Sent: Wednesday, September 8, 2021 8:08 AM
>To: Duan, Zhenzhong <zhenzhong.duan@intel.com>
>Cc: kvm@vger.kernel.org; linux-kernel@vger.kernel.org;
>pbonzini@redhat.com; vkuznets@redhat.com; wanpengli@tencent.com;
>jmattson@google.com; joro@8bytes.org
>Subject: Re: [PATCH] KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask
>issue
>
>On Mon, Sep 06, 2021, Zhenzhong Duan wrote:
>> Host value of TSX_CTRL_CPUID_CLEAR field should be unchangable by
>> guest, but the mask for this purpose is set to a wrong value. So it
>> doesn't take effect.
>
>It would be helpful to provide a bit more info as to just how bad/bonehead=
ed
>this bug is.  E.g.
>
>  When updating the host's mask for its MSR_IA32_TSX_CTRL user return entr=
y,
>  clear the mask in the found uret MSR instead of vmx->guest_uret_msrs[i].
>  Modifying guest_uret_msrs directly is completely broken as 'i' does not
>  point at the MSR_IA32_TSX_CTRL entry.  In fact, it's guaranteed to be an
>  out-of-bounds accesses as is always set to kvm_nr_uret_msrs in a prior
>  loop.  By sheer dumb luck, the fallout is limited to "only" failing to
>  preserve the host's TSX_CTRL_CPUID_CLEAR.  The out-of-bounds access is
>  benign as it's guaranteed to clear a bit in a guest MSR value, which are
>  always zero at vCPU creation on both x86-64 and i386.
Sorry for late response, I missed this mail by a wrong mail rule.
Your comment is more clear, I'll use it in v2.

Thanks
Zhenzhong