On Fri, Aug 09, 2019 at 07:00:10PM +0300, Adalbert Lazăr wrote:
> From: Mihai Donțu <mdontu@xxxxxxxxxxxxxxx>
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index 22f08f2732cc..91cd43a7a7bf 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -1013,6 +1013,8 @@ struct kvm_x86_ops {
> bool (*has_emulated_msr)(int index);
> void (*cpuid_update)(struct kvm_vcpu *vcpu);
>
> + void (*msr_intercept)(struct kvm_vcpu *vcpu, unsigned int msr,
> + bool enable);
This should be toggle_wrmsr_intercept(), or toggle_msr_intercept() with
a paramter to control RDMSR vs. WRMSR.
> void (*cr3_write_exiting)(struct kvm_vcpu *vcpu, bool enable);
> bool (*nested_pagefault)(struct kvm_vcpu *vcpu);
> bool (*spt_fault)(struct kvm_vcpu *vcpu);
> @@ -1621,6 +1623,8 @@ static inline int kvm_cpu_get_apicid(int mps_cpu)
> #define put_smstate(type, buf, offset, val) \
> *(type *)((buf) + (offset) - 0x7e00) = val
>
> +void kvm_arch_msr_intercept(struct kvm_vcpu *vcpu, unsigned int msr,
> + bool enable);
> bool kvm_mmu_nested_pagefault(struct kvm_vcpu *vcpu);
> bool kvm_spt_fault(struct kvm_vcpu *vcpu);
> void kvm_control_cr3_write_exiting(struct kvm_vcpu *vcpu, bool enable);
> diff --git a/arch/x86/include/asm/kvmi_host.h b/arch/x86/include/asm/kvmi_host.h
> index 83a098dc8939..8285d1eb0db6 100644
...
> diff --git a/arch/x86/kvm/kvmi.c b/arch/x86/kvm/kvmi.c
> index b3cab0db6a70..5dba4f87afef 100644
> --- a/arch/x86/kvm/kvmi.c
> +++ b/arch/x86/kvm/kvmi.c
> @@ -9,6 +9,133 @@
> #include <asm/vmx.h>
> #include "../../../virt/kvm/kvmi_int.h"
>
> +static unsigned long *msr_mask(struct kvm_vcpu *vcpu, unsigned int *msr)
> +{
> + switch (*msr) {
> + case 0 ... 0x1fff:
> + return IVCPU(vcpu)->msr_mask.low;
> + case 0xc0000000 ... 0xc0001fff:
> + *msr &= 0x1fff;
> + return IVCPU(vcpu)->msr_mask.high;
> + }
> +
> + return NULL;
> +}
...
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 6450c8c44771..0306c7ef3158 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -7784,6 +7784,15 @@ static __exit void hardware_unsetup(void)
> free_kvm_area();
> }
>
> +static void vmx_msr_intercept(struct kvm_vcpu *vcpu, unsigned int msr,
> + bool enable)
> +{
> + struct vcpu_vmx *vmx = to_vmx(vcpu);
> + unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
> +
> + vmx_set_intercept_for_msr(msr_bitmap, msr, MSR_TYPE_W, enable);
> +}
Unless I overlooked a check, this will allow userspace to disable WRMSR
interception for any MSR in the above range, i.e. userspace can use KVM
to gain full write access to pretty much all the interesting MSRs. This
needs to only disable interception if KVM had interception disabled before
introspection started modifying state.
