On 31/10/2018 12:38, Alexander Shishkin wrote: >> There is no standard way to tell the guest that the host overrode its >> choice to use PT. However, the host will get a PGD/PGE packet around >> vmentry and vmexit, so there _will_ be an indication that the guest >> owned the MSRs for that period of time. > > Not if they are not tracing the kernel. If they are not tracing the kernel why should they be tracing the guest at all? If you only choose to trace userspace, anything that happens between syscall entry and syscall exit is hidden and ioctl(KVM_RUN) _is_ a syscall. >> If PT context switching is enabled with the module parameter, we could >> also reject creation of events with the attribute set. However that >> won't help if the event is created before KVM is even loaded. > > In that case, modprobe kvm should fail. Does that mean that an unprivileged user can effectively DoS virtualization for everyone on the machine? (Honest question). I am aware that guest-side tracing blocks host-side guest tracing, but that's exactly why it is entirely opt-in. Only root can enable it by switching the module parameter. I don't see any way to change that, other than rejecting this feature completely. Paolo
