Received-SPF: pass (google.com: domain of linux-kernel+bounces-154450-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: "Wang, Wei W" <wei.w.wang@intel.com>
To: Sean Christopherson <seanjc@google.com>
CC: "pbonzini@redhat.com" <pbonzini@redhat.com>, "kvm@vger.kernel.org"
	<kvm@vger.kernel.org>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>
Subject: RE: [PATCH v1] KVM: x86: Validate values set to guest's
 MSR_IA32_ARCH_CAPABILITIES
Thread-Topic: [PATCH v1] KVM: x86: Validate values set to guest's
 MSR_IA32_ARCH_CAPABILITIES
Thread-Index: AQHalLXdNoJVo5noxUmOBw5weW5kSbF0sUgAgABP5tA=
Date: Tue, 23 Apr 2024 03:20:17 +0000
Message-ID: <DS0PR11MB6373118F72C9013C96718660DC112@DS0PR11MB6373.namprd11.prod.outlook.com>
References: <20240422130558.86965-1-wei.w.wang@intel.com>
 <Zia94vbLD-DF1GEw@google.com>
In-Reply-To: <Zia94vbLD-DF1GEw@google.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?u6KuUea92JuTpFXY9wVE3/jajFwswRE3/nXAkmOFXm3U+FcfruVYdR4A50x5?=
 =?us-ascii?Q?e1eAmNXmAS5dKo0lw4woKVC6vj8f+VZd5YE1EAprNjmOVONgYHPqcZg7ASHn?=
 =?us-ascii?Q?jdrJ34Y9sIWYCbq+aq+D+x9jPeUATBY3UheP+SBFJMtm7vLmeg1H+JfnJPAC?=
 =?us-ascii?Q?YZsfqJrcH/xA5Oenh/o2FIFiaEa0TRp0bJWnxF1sr7BkQBuppw/Uv63E1oln?=
 =?us-ascii?Q?Ky/WbER/ejz8NGokKXwS2wWmPSafpk9FyO5JYFRb0IJl/960dr0SiOlnjead?=
 =?us-ascii?Q?q6f87DcykKlXuhTgtsFMSFhrc4mO4w0K25B6d4VOwWOiM9tmHTXMiviRbcch?=
 =?us-ascii?Q?BqKWVSgSVxTv1BlQboD1I4LjJF4yfOBXLxfrpyRo/MVmjtkm+ig6axn90EZE?=
 =?us-ascii?Q?AMRCeQpZyMK0giW2NEMGyq4prcTn8ueaeFR/jnOMdD3st8gDKC1yXeZWuQAO?=
 =?us-ascii?Q?dCUc0Y1flwM+YWP/Fwb0VpKMvNBdbZXiXIgOzbGyKXG12qvVctPIW33QOFp5?=
 =?us-ascii?Q?TmGimZtZo2gFCKd2V+RupMpb1otrBaPAfOHZ7DUHdROeaZmbIHMPVXrJjdak?=
 =?us-ascii?Q?Uzbo+UyBATuNo5NnyKFzrtTCyIuakrgJCUUt7BSkz3ca5akKrf+ALKKsV92D?=
 =?us-ascii?Q?3Y7SdFcz+bwiSp0jPhXkuHOkIaaMVoBkwJfR2NDnk/5L3iKBxQhvjuMVLQSr?=
 =?us-ascii?Q?OuXXd5K3yfKXJ2ooIPLi1vqjdTQJllg6+auYMpc5eNDXhw1eAqCwzvyhTfcy?=
 =?us-ascii?Q?BGZzW8/OXFmFk+s+79mdv+nz+QIAe/kHnDFzSrLyyPI6uRWjJPv+Aud3MPmK?=
 =?us-ascii?Q?U/HTQ/b6idm9Qh4yKhKb5iUy6hiCg5AUzdB7mmEZPEwONGCFU/FAcd+RdzuU?=
 =?us-ascii?Q?yBYNor3SQnPekYMnA6Hw6/ppfjN0dyQKSR15uQdsBEM3VX3vg5ttUcEb6CwH?=
 =?us-ascii?Q?8z0USaQ6KrrZbwqpp+ah5uyjhVIgqfNVtudyl8pUcLFzwsoGMv75MiQQ2BWa?=
 =?us-ascii?Q?r5SiJ4BT02dlXd077uRy0nTERYNS6v6eUQC4s+1bmJ/Or/hd4xuwsitZmMxz?=
 =?us-ascii?Q?j/HFODEosQkd+6h00zlvai4cbtIaHWThOfi0dqiyjd1pa7qiVI2TuZApvYtH?=
 =?us-ascii?Q?9qHy8AzkOMmw41gXRiZ8ZQ0+bfBS6moY5n+ZRoVuq/UDigbi4xT+64uRv0s/?=
 =?us-ascii?Q?Jgi6rv6wPayrfDXotWWFLmxWLRgpiU3chS2vYnKJIR7ZrxNuS3Kqv96vjc8D?=
 =?us-ascii?Q?BFjJ8mZTkrwlCqyxzj+y+NyoA4UkWoV7UvboCbyxnHB5E/Yki4+7o1Xj/EwF?=
 =?us-ascii?Q?D5KuegVVxq+kP76xJx1FRukKz/mPCOdQptLGBcvhhD0CzVRPVN+rqd9oT7HV?=
 =?us-ascii?Q?fHCqL0XNhd+aVwktl8NBNaTylNgM9lEiKcQWSY2R/RUXG70zbGVeYlVXAUjS?=
 =?us-ascii?Q?sh8NkYoq+h8Nt2O118aXS7sQBiMwNgPw4bPh2ifLb4lPa/L7WWolmwXtWX/k?=
 =?us-ascii?Q?tQDF/a5fYfjHpKYvHRwOAlc3YlXUknaMCrKxZj3Dv3DZGfYsReV/Of9V+iJ3?=
 =?us-ascii?Q?xPHOcGgf/NrZzCi+52ShSWd82ZSNTvrTWscZrsIl?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DS0PR11MB6373.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cef51de4-18d0-4838-43f6-08dc63444cfa
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Apr 2024 03:20:17.9641
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: IPK06lRvsAv5w5GoR7cLB3Finf59zltyiKN7DwbtHlwDaekzyrYPcumDOVPJIcd9385Kji8PsJisz1vHcYzBmA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR11MB6467
X-OriginatorOrg: intel.com

On Tuesday, April 23, 2024 3:44 AM, Sean Christopherson wrote:
> On Mon, Apr 22, 2024, Wei Wang wrote:
> > If the bits set by userspace to the guest's MSR_IA32_ARCH_CAPABILITIES
> > are not supported by KVM, fails the write. This safeguards against the
> > launch of a guest with a feature set, enumerated via
> > MSR_IA32_ARCH_CAPABILITIES, that surpasses the capabilities supported
> > by KVM.
>=20
> I'm not entirely certain KVM cares.  Similar to guest CPUID, advertising =
features
> to the guest that are unbeknownst may actually make sense in some scenari=
os,
> e.g.
> if userspace learns of yet another "NO" bit that says a CPU isn't vulnera=
ble to
> some flaw.

I think it might be more appropriate for the guest to see the "NO" bit only=
 when
the host, such as the hardware (i.e., host_arch_capabilities), already supp=
orts it.
Otherwise, the guest could be misled by a false "NO" bit. For instance, the=
 guest
might assume it's not vulnerable to a certain flaw as it sees the "NO" bit =
from the
MSR, even though the enhancement feature isn't actually supported by the ho=
st,
and thus bypass a workaround (to the vulnerability) it should have used. Th=
is could
arise with a faulty or compromised userspace.
Another scenario pertains to guest live migration: the source platform phys=
ically
supports the "NO" bit, but the destination platform does not. If KVM fails =
the MSR
write here, it could prevent such a live migration from proceeding.

So I think it might be prudent for KVM to perform this check. This is simil=
ar to the
MSR_IA32_PERF_CAPABILITIES case that we have implemented.

>=20
> ARCH_CAPABILITIES is read-only, i.e. KVM _can't_ shove it into hardware. =
 So
> as long as KVM treats the value as "untrusted", like KVM does for guest C=
PUID,
> I think the current behavior is actually ok.

Yes, the value coming from userspace could be considered "untrusted", but s=
hould
KVM ensure to expose a trusted/reliable value to the guest?


>=20
> > Fixes: 0cf9135b773b ("KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on
> > AMD hosts")
>=20
> This goes all the way back to:
>=20
>   28c1c9fabf48 ("KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES")
>=20
> the above just moved the logic from vmx.c to x86.c.

OK.