linux-kernel - Re: [PATCH v13 08/12] KVM: x86: Add Intel PT context switch for each vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 31 Oct 2018 13:07:41 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Luwei Kang <luwei.kang@...el.com>, kvm@...r.kernel.org,
        x86@...nel.org
Cc:     tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, hpa@...or.com,
        rkrcmar@...hat.com, joro@...tes.org, songliubraving@...com,
        peterz@...radead.org, kstewart@...uxfoundation.org,
        gregkh@...uxfoundation.org, thomas.lendacky@....com,
        konrad.wilk@...cle.com, mattst88@...il.com,
        Janakarajan.Natarajan@....com, dwmw@...zon.co.uk,
        jpoimboe@...hat.com, marcorr@...gle.com, ubizjak@...il.com,
        sean.j.christopherson@...el.com, jmattson@...gle.com,
        linux-kernel@...r.kernel.org,
        Chao Peng <chao.p.peng@...ux.intel.com>
Subject: Re: [PATCH v13 08/12] KVM: x86: Add Intel PT context switch for each
 vcpu

On 31/10/2018 12:38, Alexander Shishkin wrote:
>> There is no standard way to tell the guest that the host overrode its
>> choice to use PT.  However, the host will get a PGD/PGE packet around
>> vmentry and vmexit, so there _will_ be an indication that the guest
>> owned the MSRs for that period of time.
> 
> Not if they are not tracing the kernel.

If they are not tracing the kernel why should they be tracing the guest
at all?  If you only choose to trace userspace, anything that happens
between syscall entry and syscall exit is hidden and ioctl(KVM_RUN) _is_
a syscall.

>> If PT context switching is enabled with the module parameter, we could
>> also reject creation of events with the attribute set.  However that
>> won't help if the event is created before KVM is even loaded.
> 
> In that case, modprobe kvm should fail.

Does that mean that an unprivileged user can effectively DoS
virtualization for everyone on the machine?  (Honest question).

I am aware that guest-side tracing blocks host-side guest tracing, but
that's exactly why it is entirely opt-in.  Only root can enable it by
switching the module parameter.  I don't see any way to change that,
other than rejecting this feature completely.

Paolo