Received: by 2002:ac0:98c7:0:0:0:0:0 with SMTP id g7-v6csp5976760imd; Wed, 31 Oct 2018 05:08:51 -0700 (PDT) X-Google-Smtp-Source: AJdET5eHSGNt5d3DqA8oeuEMVuCSYFdKk8yQA34UOInz+oPsTrNmpDWEszej9iUURRo5CoKR/2Tm X-Received: by 2002:a17:902:7c0b:: with SMTP id x11-v6mr3125791pll.60.1540987731127; Wed, 31 Oct 2018 05:08:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540987731; cv=none; d=google.com; s=arc-20160816; b=RGkMmqWi3GhZ0rim7a2FNu/6ipWfbfMWjh06iNFofZJwN3gYHvJ8ai9XZRZgzzstYv 6uXOKu/MNZEflxL3UmC6fB8jxZuSwboUIMi7j8dp004obgOANQr7itnn4L3+TF7ufA1Y DiQ7kKRBEm+13NfPwq0HyFb9WwhXTG1L+CN9ylyLZeArTmbKWdN+7IQ45BAy5EczOoRB cdXapgNs4IN7E6TaAbIjRogiZI/zEnuYzhFE5ZmeR2kmyurjYlnpCbVM77YWmVcNklq9 EkeYrfQzjIqxJpbTLkSjfCOcFAiaYwMSPz7g2s1uHBYkMYjOMBJ7Dq8eXTqWj0qyVQ4m 6+GQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:autocrypt:openpgp:from:references:cc:to:subject; bh=Xkji0TKHSHv2rSEmJ3WUMpn9FskQQSHYpBGmfI1hAGA=; b=WvSaO9sBuadOdlG/QC61UOWPAOs3Y7nXtaemY146jLZXryCywOzNO7uvylzfPq5zDB fWr5FbtAYxwrcMkZ4r1UmPYWg1uxccR/TFcxZ9pjSBHb1HCwBBNMkT/nOjOlNr8OuPtu nvjDq9seAMFpZ0mx7sRuDYfFnofpc0YKrccy6hP9/02RLeAUWuE5kouD6+LBp7EX4wDP 3tXFAA6b3GooWkI1Kp6CPDxfUsKp2SeN5TYa04oYukGAwNFL4YSNX2eHUbCRxWtQWJPa 5EyTQdOpFA/kDhJlCseugY1viuMD7RxRm3mG2C29yUW3f8vlZqM9EPww/idzgPaY/+RY a/Yg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p11-v6si28765380pll.42.2018.10.31.05.08.31; Wed, 31 Oct 2018 05:08:50 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728698AbeJaVFh (ORCPT + 99 others); Wed, 31 Oct 2018 17:05:37 -0400 Received: from mx1.redhat.com ([209.132.183.28]:5288 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725897AbeJaVFg (ORCPT ); Wed, 31 Oct 2018 17:05:36 -0400 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D940429A5C; Wed, 31 Oct 2018 12:07:50 +0000 (UTC) Received: from [10.36.112.62] (ovpn-112-62.ams2.redhat.com [10.36.112.62]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D284110018FB; Wed, 31 Oct 2018 12:07:43 +0000 (UTC) Subject: Re: [PATCH v13 08/12] KVM: x86: Add Intel PT context switch for each vcpu To: Alexander Shishkin , Luwei Kang , kvm@vger.kernel.org, x86@kernel.org Cc: tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, hpa@zytor.com, rkrcmar@redhat.com, joro@8bytes.org, songliubraving@fb.com, peterz@infradead.org, kstewart@linuxfoundation.org, gregkh@linuxfoundation.org, thomas.lendacky@amd.com, konrad.wilk@oracle.com, mattst88@gmail.com, Janakarajan.Natarajan@amd.com, dwmw@amazon.co.uk, jpoimboe@redhat.com, marcorr@google.com, ubizjak@gmail.com, sean.j.christopherson@intel.com, jmattson@google.com, linux-kernel@vger.kernel.org, Chao Peng References: <1540368316-12998-1-git-send-email-luwei.kang@intel.com> <1540368316-12998-9-git-send-email-luwei.kang@intel.com> <87a7n37iuf.fsf@ashishki-desk.ger.corp.intel.com> <87y3af65fi.fsf@ashishki-desk.ger.corp.intel.com> <87r2g65osg.fsf@ashishki-desk.ger.corp.intel.com> From: Paolo Bonzini Openpgp: preference=signencrypt Autocrypt: addr=pbonzini@redhat.com; prefer-encrypt=mutual; keydata= xsEhBFRCcBIBDqDGsz4K0zZun3jh+U6Z9wNGLKQ0kSFyjN38gMqU1SfP+TUNQepFHb/Gc0E2 CxXPkIBTvYY+ZPkoTh5xF9oS1jqI8iRLzouzF8yXs3QjQIZ2SfuCxSVwlV65jotcjD2FTN04 hVopm9llFijNZpVIOGUTqzM4U55sdsCcZUluWM6x4HSOdw5F5Utxfp1wOjD/v92Lrax0hjiX DResHSt48q+8FrZzY+AUbkUS+Jm34qjswdrgsC5uxeVcLkBgWLmov2kMaMROT0YmFY6A3m1S P/kXmHDXxhe23gKb3dgwxUTpENDBGcfEzrzilWueOeUWiOcWuFOed/C3SyijBx3Av/lbCsHU Vx6pMycNTdzU1BuAroB+Y3mNEuW56Yd44jlInzG2UOwt9XjjdKkJZ1g0P9dwptwLEgTEd3Fo UdhAQyRXGYO8oROiuh+RZ1lXp6AQ4ZjoyH8WLfTLf5g1EKCTc4C1sy1vQSdzIRu3rBIjAvnC tGZADei1IExLqB3uzXKzZ1BZ+Z8hnt2og9hb7H0y8diYfEk2w3R7wEr+Ehk5NQsT2MPI2QBd wEv1/Aj1DgUHZAHzG1QN9S8wNWQ6K9DqHZTBnI1hUlkp22zCSHK/6FwUCuYp1zcAEQEAAc0f UGFvbG8gQm9uemluaSA8Ym9uemluaUBnbnUub3JnPsLBTQQTAQIAIwUCVEJ7AwIbAwcLCQgH AwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEH4VEAzNNmmxNcwOniaZVLsuy1lW/ntYCA0Caz0i sHpmecK8aWlvL9wpQCk4GlOX9L1emyYXZPmzIYB0IRqmSzAlZxi+A2qm9XOxs5gJ2xqMEXX5 FMtUH3kpkWWJeLqe7z0EoQdUI4EG988uv/tdZyqjUn2XJE+K01x7r3MkUSFz/HZKZiCvYuze VlS0NTYdUt5jBXualvAwNKfxEkrxeHjxgdFHjYWhjflahY7TNRmuqPM/Lx7wAuyoDjlYNE40 Z+Kun4/KjMbjgpcF4Nf3PJQR8qXI6p3so2qsSn91tY7DFSJO6v2HwFJkC2jU95wxfNmTEUZc znXahYbVOwCDJRuPrE5GKFd/XJU9u5hNtr/uYipHij01WXal2cce1S5mn1/HuM1yo1u8xdHy IupCd57EWI948e8BlhpujUCU2tzOb2iYS0kpmJ9/oLVZrOcSZCcCl2P0AaCAsj59z2kwQS9D du0WxUs8waso0Qq6tDEHo8yLCOJDzSz4oojTtWe4zsulVnWV+wu70AioemAT8S6JOtlu60C5 dHgQUD1Tp+ReXpDKXmjbASJx4otvW0qah3o6JaqO79tbDqIvncu3tewwp6c85uZd48JnIOh3 utBAu684nJakbbvZUGikJfxd887ATQRUQnHuAQgAx4dxXO6/Zun0eVYOnr5GRl76+2UrAAem Vv9Yfn2PbDIbxXqLff7oyVJIkw4WdhQIIvvtu5zH24iYjmdfbg8iWpP7NqxUQRUZJEWbx2CR wkMHtOmzQiQ2tSLjKh/cHeyFH68xjeLcinR7jXMrHQK+UCEw6jqi1oeZzGvfmxarUmS0uRuf fAb589AJW50kkQK9VD/9QC2FJISSUDnRC0PawGSZDXhmvITJMdD4TjYrePYhSY4uuIV02v02 8TVAaYbIhxvDY0hUQE4r8ZbGRLn52bEzaIPgl1p/adKfeOUeMReg/CkyzQpmyB1TSk8lDMxQ zCYHXAzwnGi8WU9iuE1P0wARAQABwsEzBBgBAgAJBQJUQnHuAhsMAAoJEH4VEAzNNmmxp1EO oJy0uZggJm7gZKeJ7iUpeX4eqUtqelUw6gU2daz2hE/jsxsTbC/w5piHmk1H1VWDKEM4bQBT uiJ0bfo55SWsUNN+c9hhIX+Y8LEe22izK3w7mRpvGcg+/ZRG4DEMHLP6JVsv5GMpoYwYOmHn plOzCXHvmdlW0i6SrMsBDl9rw4AtIa6bRwWLim1lQ6EM3PWifPrWSUPrPcw4OLSwFk0CPqC4 HYv/7ZnASVkR5EERFF3+6iaaVi5OgBd81F1TCvCX2BEyIDRZLJNvX3TOd5FEN+lIrl26xecz 876SvcOb5SL5SKg9/rCBufdPSjojkGFWGziHiFaYhbuI2E+NfWLJtd+ZvWAAV+O0d8vFFSvr iy9enJ8kxJwhC0ECbSKFY+W1eTIhMD3aeAKY90drozWEyHhENf4l/V+Ja5vOnW+gCDQkGt2Y 1lJAPPSIqZKvHzGShdh8DduC0U3xYkfbGAUvbxeepjgzp0uEnBXfPTy09JGpgWbg0w91GyfT /ujKaGd4vxG2Ei+MMNDmS1SMx7wu0evvQ5kT9NPzyq8R2GIhVSiAd2jioGuTjX6AZCFv3ToO 53DliFMkVTecLptsXaesuUHgL9dKIfvpm+rNXRn9wAwGjk0X/A== Message-ID: <2cb38ceb-9c86-4174-0b2b-9f070eb0df48@redhat.com> Date: Wed, 31 Oct 2018 13:07:41 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.0 MIME-Version: 1.0 In-Reply-To: <87r2g65osg.fsf@ashishki-desk.ger.corp.intel.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Wed, 31 Oct 2018 12:07:51 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 31/10/2018 12:38, Alexander Shishkin wrote: >> There is no standard way to tell the guest that the host overrode its >> choice to use PT. However, the host will get a PGD/PGE packet around >> vmentry and vmexit, so there _will_ be an indication that the guest >> owned the MSRs for that period of time. > > Not if they are not tracing the kernel. If they are not tracing the kernel why should they be tracing the guest at all? If you only choose to trace userspace, anything that happens between syscall entry and syscall exit is hidden and ioctl(KVM_RUN) _is_ a syscall. >> If PT context switching is enabled with the module parameter, we could >> also reject creation of events with the attribute set. However that >> won't help if the event is created before KVM is even loaded. > > In that case, modprobe kvm should fail. Does that mean that an unprivileged user can effectively DoS virtualization for everyone on the machine? (Honest question). I am aware that guest-side tracing blocks host-side guest tracing, but that's exactly why it is entirely opt-in. Only root can enable it by switching the module parameter. I don't see any way to change that, other than rejecting this feature completely. Paolo