Re: [PATCH v13 08/12] KVM: x86: Add Intel PT context switch for each vcpu

[Paolo Bonzini]

On 31/10/2018 12:38, Alexander Shishkin wrote:
>> There is no standard way to tell the guest that the host overrode its
>> choice to use PT.  However, the host will get a PGD/PGE packet around
>> vmentry and vmexit, so there _will_ be an indication that the guest
>> owned the MSRs for that period of time.
> 
> Not if they are not tracing the kernel.

If they are not tracing the kernel why should they be tracing the guest
at all?  If you only choose to trace userspace, anything that happens
between syscall entry and syscall exit is hidden and ioctl(KVM_RUN) _is_
a syscall.

>> If PT context switching is enabled with the module parameter, we could
>> also reject creation of events with the attribute set.  However that
>> won't help if the event is created before KVM is even loaded.
> 
> In that case, modprobe kvm should fail.

Does that mean that an unprivileged user can effectively DoS
virtualization for everyone on the machine?  (Honest question).

I am aware that guest-side tracing blocks host-side guest tracing, but
that's exactly why it is entirely opt-in.  Only root can enable it by
switching the module parameter.  I don't see any way to change that,
other than rejecting this feature completely.

Paolo