Re: [PATCH] KVM: SVM: don't apply host security mitigations to the guest

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 9/12/22 06:58, Fares Mehanna wrote:
Support of virtual SPEC_CTRL caused a new behavior in KVM which made host
security mitigations applying by default to the guests.

Maybe expand on this to say that the effective mitigation is the host SPEC_CTRL value or'd with guest SPEC_CTRL value.


We noticed a regression after applying the patch, primarily because of the
enablement of SSBD on AMD Milan.

This patch keeps the new behavior of applying host security mitigations to
the guests, but adds an option to disable it so the guests are free to pick
their own security mitigations.

Fixes: d00b99c514b3 ("KVM: SVM: Add support for Virtual SPEC_CTRL")
Signed-off-by: Fares Mehanna <faresx@xxxxxxxxx>
Reviewed-by: Benjamin Serebrin <serebrin@xxxxxxxxxx>
Reviewed-by: Filippo Sironi <sironi@xxxxxxxxx>
---
  arch/x86/kvm/svm/svm.c | 12 +++++++++++-
  1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index f3813dbacb9f..c6ea24685301 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -225,6 +225,10 @@ module_param(avic, bool, 0444);
  bool __read_mostly dump_invalid_vmcb;
  module_param(dump_invalid_vmcb, bool, 0644);
+/* enable/disable applying host security mitigations on the guest */
+static bool host_mitigations_on_guest = true;
+module_param(host_mitigations_on_guest, bool, 0444);
+
bool intercept_smi = true;
  module_param(intercept_smi, bool, 0444);
@@ -4000,6 +4004,12 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu)
  	 */
  	if (!static_cpu_has(X86_FEATURE_V_SPEC_CTRL))
  		x86_spec_ctrl_set_guest(svm->spec_ctrl, svm->virt_spec_ctrl);
+	else if (!host_mitigations_on_guest)
+		/*
+		 * Clear the host MSR before vm-enter to avoid applying host
+		 * security mitigations to the guest.
+		 */
+		x86_spec_ctrl_set_guest(0, 0);

If X86_FEATURE_V_SPEC_CTRL is active, won't svm->spec_ctrl and svm->virt_spec_ctrl always be zero, in which case you can do the if statement similar to the below one? Maybe just add a comment that those values will be zero in the case of X86_FEATURE_V_SPEC_CTRL, thus eliminating the host security mitigation effect.

Thanks,
Tom

svm_vcpu_enter_exit(vcpu); @@ -4025,7 +4035,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu)
  	if (!sev_es_guest(vcpu->kvm))
  		reload_tss(vcpu);
- if (!static_cpu_has(X86_FEATURE_V_SPEC_CTRL))
+	if (!static_cpu_has(X86_FEATURE_V_SPEC_CTRL) || !host_mitigations_on_guest)
  		x86_spec_ctrl_restore_host(svm->spec_ctrl, svm->virt_spec_ctrl);
if (!sev_es_guest(vcpu->kvm)) {



[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux