linux-kernel - Re: Writable module parameters in KVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YK5s5SUQh69a19/F@google.com>
Date:   Wed, 26 May 2021 15:44:37 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Maxim Levitsky <mlevitsk@...hat.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Ben Gardon <bgardon@...gle.com>,
        Jim Mattson <jmattson@...gle.com>,
        Junaid Shahid <junaids@...gle.com>,
        Peter Xu <peterx@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>, kvm <kvm@...r.kernel.org>
Subject: Re: Writable module parameters in KVM

On Wed, May 26, 2021, Maxim Levitsky wrote:
> On Wed, 2021-05-26 at 12:49 +0200, Paolo Bonzini wrote:
> > On 26/05/21 01:45, Ben Gardon wrote:
> > > At Google we have an informal practice of adding sysctls to control some 
> > > KVM features. Usually these just act as simple "chicken bits" which 
> > > allow us to turn off a feature without having to stall a kernel rollout 
> > > if some feature causes problems. (Sysctls were used for reasons specific 
> > > to Google infrastructure, not because they're necessarily better.)
> > > 
> > > We'd like to get rid of this divergence with upstream by converting the 
> > > sysctls to writable module parameters, but I'm not sure what the general 
> > > guidance is on writable module parameters. Looking through KVM, it seems 
> > > like we have several writable parameters, but they're mostly read-only.
> > 
> > Sure, making them writable is okay.  Most KVM parameters are read-only 
> > because it's much simpler (the usecase for introducing them was simply 
> > "test what would happen on old processors").  What are these features 
> > that you'd like to control?

My $0.02 is that most parameters should remain read-only, and making a param
writable (new or existing) must come with strong justification for taking on the
extra complexity.

I absolutely agree that making select params writable adds a ton of value, e.g.
being able to switch to/from the TDP MMU without reloading KVM saves a lot of
time when testing, toggling forced flush/sync on PGD reuse is extremely valuable
for triage and/or mitigation, etc...  But writable params should either bring a
lot of value and/or add near-zero complexity.

> > > I also don't see central documentation of the module parameters. They're 
> > > mentioned in the documentation for other features, but don't have their 
> > > own section / file. Should they?
> > 
> > They probably should, yes.
> > 
> > Paolo
> > 
> I vote (because I have fun with my win98 once in a while), to make 'npt'
> writable, since that is the only way to make it run on KVM on AMD.

For posterity, "that" refers to disabling NPT, not making 'npt' writable :-)

Making 'npt' writable is probably feasible ('ept' would be beyond messy), but I
strongly prefer to keep it read-only.  The direct impacts on the MMU and SVM
aren't too bad, but NPT is required for SEV and VLS, affects kvm_cpu_caps, etc...
And, no offense to win98, there's isn't a strong use case because outside of
personal usage, the host admin/VMM doesn't know that the guest will be running a
broken kernel.

> My personal itch only though!
> 
> Best regards,
> 	Maxim Levitsky
>