Received: by 2002:a25:ab43:0:0:0:0:0 with SMTP id u61csp4449251ybi; Mon, 27 May 2019 18:58:19 -0700 (PDT) X-Google-Smtp-Source: APXvYqyBW3qZHRFBr0foa1bM4JCK/K4OqdONxkQIeepAlcA29/Ifu/FGClo+mv7E5zGOfAUNC6LG X-Received: by 2002:a17:902:24b:: with SMTP id 69mr41435568plc.255.1559008699345; Mon, 27 May 2019 18:58:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1559008699; cv=none; d=google.com; s=arc-20160816; b=GSrjv36ayZMqvY/S2NtzVJoK1tg/NUIvhkskNjuSlwAU7oAeShEnBcwiZc5sWnCu+E zT/+NTUpgDhqZLRhPWOcUVHuREd+7NQ2FBySdbHEWk4WTP1U3DYNMowFithfPlr1zVub HyrRF83QThVCLm4PBdnoQPb1mc7ZHCl3fg7Y8WufP3m3vR6ywR00ZgvmSaNmgQgln5op Ozu0ATIb3CgAPjuI50tkqpn0ZMFULglF4NiShZZFFmK8ANDvbMLSMXvljCLCKa0VIzet s7IYvSTxhI/btHA9Yr8Kd394cc5jqWVxuO1lfA044Rxt5W+8uEI1dI6M/522f6UGYOEz p0xQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:in-reply-to :references:subject:cc:to:mime-version:user-agent:from:date :message-id; bh=QGISytmnk7Yy/JhujGDdanwm9afDOmDOZRqRuSGbdzw=; b=MGM8QG8sLnUFQYpPYr15WyYCQZQDpkRcGbYYAGOOXFdsAmCDJpGc7TGfo0lEOh4Uoy kwVC0eLpvnJNm77uv3kF0KtetfcTSZ1XItDLv5zgxH9CKIfiASrLYsZNlHsxNDrz3Thh vQnEzgS4w+Mxi2zywdesrdnDz26Y4LDlN9jNuLFoEW9a8jF+3xchb2Jka1Ax0v/F8g3p Ko4r/o0p3he9flhGivlWxMKk6lH9yGGfmrIVaZncjTSXfuM/VsvTT9ZILjmaaFr+Rs9U d54O7i4mij3mFBUZY0q0dqQpiFOHrZJRSZxacMcJbNpgEAYmOF7BFwSgGgCxIBq2Elm0 U95g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d3si17172195pgg.378.2019.05.27.18.58.04; Mon, 27 May 2019 18:58:19 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727911AbfE1B4I (ORCPT + 99 others); Mon, 27 May 2019 21:56:08 -0400 Received: from mga09.intel.com ([134.134.136.24]:1564 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727654AbfE1B4I (ORCPT ); Mon, 27 May 2019 21:56:08 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 May 2019 18:56:07 -0700 X-ExtLoop1: 1 Received: from unknown (HELO [10.239.13.7]) ([10.239.13.7]) by orsmga002.jf.intel.com with ESMTP; 27 May 2019 18:56:06 -0700 Message-ID: <5CEC9667.30100@intel.com> Date: Tue, 28 May 2019 10:01:11 +0800 From: Wei Wang User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Eric Hankland , pbonzini@redhat.com, rkrcmar@redhat.com CC: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Subject: Re: [PATCH v1] KVM: x86: PMU Whitelist References: In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 05/23/2019 06:23 AM, Eric Hankland wrote: > - Add a VCPU ioctl that can control which events the guest can monitor. > > Signed-off-by: ehankland > --- > Some events can provide a guest with information about other guests or the > host (e.g. L3 cache stats); providing the capability to restrict access > to a "safe" set of events would limit the potential for the PMU to be used > in any side channel attacks. This change introduces a new vcpu ioctl that > sets an event whitelist. If the guest attempts to program a counter for > any unwhitelisted event, the kernel counter won't be created, so any > RDPMC/RDMSR will show 0 instances of that event. The general idea sounds good to me :) For the implementation, I would have the following suggestions: 1) Instead of using a whitelist, it would be better to use a blacklist to forbid the guest from counting any core level information. So by default, kvm maintains a list of those core level events, which are not supported to the guest. The userspace ioctl removes the related events from the blacklist to make them usable by the guest. 2) Use vm ioctl, instead of vcpu ioctl. The blacklist-ed events can be VM wide (unnecessary to make each CPU to maintain the same copy). Accordingly, put the pmu event blacklist into kvm->arch. 3) Returning 1 when the guest tries to set the evetlsel msr to count an event which is on the blacklist. Best, Wei