| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <Z8Z/3dxtpbjpCJPI@yzhao56-desk.sh.intel.com>
Date: Tue, 4 Mar 2025 12:21:49 +0800
From: Yan Zhao <yan.y.zhao@...el.com>
To: Paolo Bonzini <pbonzini@...hat.com>
CC: <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>, <seanjc@...gle.com>
Subject: Re: [PATCH 2/4] KVM: x86: Introduce supported_quirks to block
disabling quirks
On Mon, Mar 03, 2025 at 05:11:31PM +0100, Paolo Bonzini wrote:
> On 3/3/25 02:23, Yan Zhao wrote:
> > On Sat, Mar 01, 2025 at 02:34:26AM -0500, Paolo Bonzini wrote:
> > > From: Yan Zhao <yan.y.zhao@...el.com>
> > >
> > > Introduce supported_quirks in kvm_caps to store platform-specific force-enabled
> > > quirks. Any quirk removed from kvm_caps.supported_quirks will never be
> > > included in kvm->arch.disabled_quirks, and will cause the ioctl to fail if
> > > passed to KVM_ENABLE_CAP(KVM_CAP_DISABLE_QUIRKS2).
> > >
> > > Signed-off-by: Yan Zhao <yan.y.zhao@...el.com>
> > > Message-ID: <20250224070832.31394-1-yan.y.zhao@...el.com>
> > > Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> > > ---
> > > arch/x86/kvm/x86.c | 7 ++++---
> > > arch/x86/kvm/x86.h | 2 ++
> > > 2 files changed, 6 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > > index fd0a44e59314..a97e58916b6a 100644
> > > --- a/arch/x86/kvm/x86.c
> > > +++ b/arch/x86/kvm/x86.c
> > > @@ -4782,7 +4782,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
> > > r = enable_pmu ? KVM_CAP_PMU_VALID_MASK : 0;
> > > break;
> > > case KVM_CAP_DISABLE_QUIRKS2:
> > > - r = KVM_X86_VALID_QUIRKS;
> > > + r = kvm_caps.supported_quirks;
> >
> > As the concern raised in [1], it's confusing for
> > KVM_X86_QUIRK_EPT_IGNORE_GUEST_PAT to be present on AMD's platforms while not
> > present on Intel's non-self-snoop platforms.
>
> To make it less confusing, let's rename it to
> KVM_X86_QUIRK_IGNORE_GUEST_PAT. So if userspace wants to say "I don't want
Hmm, it looks that quirk IGNORE_GUEST_PAT is effectively always enabled on Intel
platforms without enabling EPT.
And kvm_mmu_may_ignore_guest_pat() does not care quirk IGNORE_GUEST_PAT on AMD
or on Intel when enable_ept is 0.
bool kvm_mmu_may_ignore_guest_pat(struct kvm *kvm)
{
return shadow_memtype_mask &&
kvm_check_has_quirk(kvm, KVM_X86_QUIRK_EPT_IGNORE_GUEST_PAT);
}
After renaming the quirk, should we also hide quirk IGNORE_GUEST_PAT from being
exposed in KVM_CAP_DISABLE_QUIRKS2 when enable_ept is 0?
However, doing so will complicate kvm_noncoherent_dma_assignment_start_or_stop().
> KVM to ignore guest's PAT!", it can do so easily:
>
> - it can check unconditionally that the quirk is included in
> KVM_CAP_DISABLE_QUIRKS2, and it will pass on both Intel with self-snoop with
> AMD;
So, when userspace finds the quirk IGNORE_GUEST_PAT is exposed in
KVM_CAP_DISABLE_QUIRKS2, it cannot treat this as an implication that KVM is
currently ignoring guest PAT, but it only means that this is a new KVM with
quirk IGNORE_GUEST_PAT taken into account.
> - it can pass it unconditionally to KVM_X86_QUIRK_IGNORE_GUEST_PAT, knowing
> that PAT will be honored.
For AMD, since userspace does not explicitly disable quirk IGNORE_GUEST_PAT, you
introduced kvm_caps.inapplicable_quirks to allow IGNORE_GUEST_PAT to be listed
in KVM_CAP_DISABLED_QUIRKS.
>From KVM_CAP_DISABLED_QUIRKS, the userspace knows that honing guest PAT is
performed on AMD.
Is this understanding correct?
> But KVM_CHECK_EXTENSION(KVM_CAP_DISABLE_QUIRKS2) will *not* include the
> quirk on Intel without self-snoop, which lets userspace detect the condition
> and raise an error. This is better than introducing a new case in the API
> "the bit is returned by KVM_CHECK_EXTENSION, but rejected by
> KVM_ENABLE_CAP". Such a new case would inevitably lead to
> KVM_CAP_DISABLE_QUIRKS3. :)
Agreed. Thanks for the explanation:)
>
> > Or what about introduce kvm_caps.force_enabled_quirk?
> >
> > if (!static_cpu_has(X86_FEATURE_SELFSNOOP))
> > kvm_caps.force_enabled_quirks |= KVM_X86_QUIRK_EPT_IGNORE_GUEST_PAT;
>
> That would also make it harder for userspace to understand what's going on.
Right.
> > [1] https://lore.kernel.org/all/Z8UBpC76CyxCIRiU@yzhao56-desk.sh.intel.com/
> > > break;
> > > case KVM_CAP_X86_NOTIFY_VMEXIT:
> > > r = kvm_caps.has_notify_vmexit;
> > > @@ -6521,11 +6521,11 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
> > > switch (cap->cap) {
> > > case KVM_CAP_DISABLE_QUIRKS2:
> > > r = -EINVAL;
> > > - if (cap->args[0] & ~KVM_X86_VALID_QUIRKS)
> > > + if (cap->args[0] & ~kvm_caps.supported_quirks)
> > > break;
> > > fallthrough;
> > > case KVM_CAP_DISABLE_QUIRKS:
> > > - kvm->arch.disabled_quirks = cap->args[0];
> > > + kvm->arch.disabled_quirks = cap->args[0] & kvm_caps.supported_quirks;
> >
> > Will this break the uapi of KVM_CAP_DISABLE_QUIRKS?
> > My understanding is that only KVM_CAP_DISABLE_QUIRKS2 filters out invalid
> > quirks.
>
> The difference between KVM_CAP_DISABLE_QUIRKS and KVM_CAP_DISABLE_QUIRKS2 is
> only that invalid values do not cause an error; but userspace cannot know
> what is in kvm->arch.disabled_quirks, so KVM can change the value that is
> stored there.
Ah, it makes sense.
Thanks
Yan
>
> > > r = 0;
> > > break;
> > > case KVM_CAP_SPLIT_IRQCHIP: {
> > > @@ -9775,6 +9775,7 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
> > > kvm_host.xcr0 = xgetbv(XCR_XFEATURE_ENABLED_MASK);
> > > kvm_caps.supported_xcr0 = kvm_host.xcr0 & KVM_SUPPORTED_XCR0;
> > > }
> > > + kvm_caps.supported_quirks = KVM_X86_VALID_QUIRKS;
> > > kvm_caps.inapplicable_quirks = 0;
> > > rdmsrl_safe(MSR_EFER, &kvm_host.efer);
> > > diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
> > > index 9af199c8e5c8..f2672b14388c 100644
> > > --- a/arch/x86/kvm/x86.h
> > > +++ b/arch/x86/kvm/x86.h
> > > @@ -34,6 +34,8 @@ struct kvm_caps {
> > > u64 supported_xcr0;
> > > u64 supported_xss;
> > > u64 supported_perf_cap;
> > > +
> > > + u64 supported_quirks;
> > > u64 inapplicable_quirks;
> > > };
> > > --
> > > 2.43.5
> > >
> > >
> >
>
Powered by blists - more mailing lists