linux-kernel - Re: [PATCH v6 0/7] Allow user space to restrict and augment MSR emulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <a4700ac2-fd92-44b4-70c5-4a3690c02269@amazon.com>
Date:   Wed, 2 Sep 2020 15:01:27 +0200
From:   Alexander Graf <graf@...zon.com>
To:     Aaron Lewis <aaronlewis@...gle.com>
CC:     Paolo Bonzini <pbonzini@...hat.com>,
        Jonathan Corbet <corbet@....net>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>,
        KarimAllah Raslan <karahmed@...zon.de>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        kvm list <kvm@...r.kernel.org>, <linux-doc@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v6 0/7] Allow user space to restrict and augment MSR
 emulation



On 02.09.20 00:32, Aaron Lewis wrote:
> 
> On Tue, Sep 1, 2020 at 1:15 PM Alexander Graf <graf@...zon.com> wrote:
>>
>> While tying to add support for the MSR_CORE_THREAD_COUNT MSR in KVM,
>> I realized that we were still in a world where user space has no control
>> over what happens with MSR emulation in KVM.
>>
>> That is bad for multiple reasons. In my case, I wanted to emulate the
>> MSR in user space, because it's a CPU specific register that does not
>> exist on older CPUs and that really only contains informational data that
>> is on the package level, so it's a natural fit for user space to provide
>> it.
>>
>> However, it is also bad on a platform compatibility level. Currrently,
>> KVM has no way to expose different MSRs based on the selected target CPU
>> type.
>>
>> This patch set introduces a way for user space to indicate to KVM which
>> MSRs should be handled in kernel space. With that, we can solve part of
>> the platform compatibility story. Or at least we can not handle AMD specific
>> MSRs on an Intel platform and vice versa.
>>
>> In addition, it introduces a way for user space to get into the loop
>> when an MSR access would generate a #GP fault, such as when KVM finds an
>> MSR that is not handled by the in-kernel MSR emulation or when the guest
>> is trying to access reserved registers.
>>
>> In combination with filtering, user space trapping allows us to emulate
>> arbitrary MSRs in user space, paving the way for target CPU specific MSR
>> implementations from user space.
>>
>> v1 -> v2:
>>
>>    - s/ETRAP_TO_USER_SPACE/ENOENT/g
>>    - deflect all #GP injection events to user space, not just unknown MSRs.
>>      That was we can also deflect allowlist errors later
>>    - fix emulator case
>>    - new patch: KVM: x86: Introduce allow list for MSR emulation
>>    - new patch: KVM: selftests: Add test for user space MSR handling
>>
>> v2 -> v3:
>>
>>    - return r if r == X86EMUL_IO_NEEDED
>>    - s/KVM_EXIT_RDMSR/KVM_EXIT_X86_RDMSR/g
>>    - s/KVM_EXIT_WRMSR/KVM_EXIT_X86_WRMSR/g
>>    - Use complete_userspace_io logic instead of reply field
>>    - Simplify trapping code
>>    - document flags for KVM_X86_ADD_MSR_ALLOWLIST
>>    - generalize exit path, always unlock when returning
>>    - s/KVM_CAP_ADD_MSR_ALLOWLIST/KVM_CAP_X86_MSR_ALLOWLIST/g
>>    - Add KVM_X86_CLEAR_MSR_ALLOWLIST
>>    - Add test to clear whitelist
>>    - Adjust to reply-less API
>>    - Fix asserts
>>    - Actually trap on MSR_IA32_POWER_CTL writes
>>
>> v3 -> v4:
>>
>>    - Mention exit reasons in re-enter mandatory section of API documentation
>>    - Clear padding bytes
>>    - Generalize get/set deflect functions
>>    - Remove redundant pending_user_msr field
>>    - lock allow check and clearing
>>    - free bitmaps on clear
>>
>> v4 -> v5:
>>
>>    - use srcu
>>
>> v5 -> v6:
>>
>>    - Switch from allow list to filtering API with explicit fallback option
>>    - Support and test passthrough MSR filtering
>>    - Check for filter exit reason
>>    - Add .gitignore
>>    - send filter change notification
>>    - change to atomic set_msr_filter ioctl with fallback flag
>>    - use EPERM for filter blocks
>>    - add bit for MSR user space deflection
>>    - check for overflow of BITS_TO_LONGS (thanks Dan Carpenter!)
>>    - s/int i;/u32 i;/
>>    - remove overlap check
>>    - Introduce exit reason mask to allow for future expansion and filtering
>>    - s/emul_to_vcpu(ctxt)/vcpu/
>>    - imported patch: KVM: x86: Prepare MSR bitmaps for userspace tracked MSRs
>>    - new patch: KVM: x86: Add infrastructure for MSR filtering
>>    - new patch: KVM: x86: SVM: Prevent MSR passthrough when MSR access is denied
>>    - new patch: KVM: x86: VMX: Prevent MSR passthrough when MSR access is denied
>>
>> Aaron Lewis (1):
>>    KVM: x86: Prepare MSR bitmaps for userspace tracked MSRs
>>
>> Alexander Graf (6):
>>    KVM: x86: Deflect unknown MSR accesses to user space
>>    KVM: x86: Add infrastructure for MSR filtering
>>    KVM: x86: SVM: Prevent MSR passthrough when MSR access is denied
>>    KVM: x86: VMX: Prevent MSR passthrough when MSR access is denied
>>    KVM: x86: Introduce MSR filtering
>>    KVM: selftests: Add test for user space MSR handling
>>
>>   Documentation/virt/kvm/api.rst                | 176 +++++++++-
>>   arch/x86/include/asm/kvm_host.h               |  18 ++
>>   arch/x86/include/uapi/asm/kvm.h               |  19 ++
>>   arch/x86/kvm/emulate.c                        |  18 +-
>>   arch/x86/kvm/svm/svm.c                        | 122 +++++--
>>   arch/x86/kvm/svm/svm.h                        |   7 +
>>   arch/x86/kvm/vmx/nested.c                     |   2 +-
>>   arch/x86/kvm/vmx/vmx.c                        | 303 ++++++++++++------
>>   arch/x86/kvm/vmx/vmx.h                        |   9 +-
>>   arch/x86/kvm/x86.c                            | 267 ++++++++++++++-
>>   arch/x86/kvm/x86.h                            |   1 +
>>   include/trace/events/kvm.h                    |   2 +-
>>   include/uapi/linux/kvm.h                      |  17 +
>>   tools/testing/selftests/kvm/.gitignore        |   1 +
>>   tools/testing/selftests/kvm/Makefile          |   1 +
>>   .../selftests/kvm/x86_64/user_msr_test.c      | 224 +++++++++++++
>>   16 files changed, 1055 insertions(+), 132 deletions(-)
>>   create mode 100644 tools/testing/selftests/kvm/x86_64/user_msr_test.c
>>
>> --
>> 2.17.1
>>
>>
>>
>>
>> Amazon Development Center Germany GmbH
>> Krausenstr. 38
>> 10117 Berlin
>> Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
>> Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
>> Sitz: Berlin
>> Ust-ID: DE 289 237 879
>>
>>
>>
> 
> Hi Alex,
> 
> I'm only seeing 4 commits.  Are you planning on sending the remaining 3?

Hmm, looks like a combination of bad email server and buggy git broke my 
neck here. I found a small bug in the series, so I've just sent the full 
set out again, hopefully completely this time :).


Alex



Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879