Disallow MSR read/writes#991
Draft
ludfjig wants to merge 5 commits into
Draft
Conversation
ludfjig
force-pushed
the
reset2
branch
7 times, most recently
from
aeca04d to
968f2f4
Compare
ludfjig
added
the
kind/enhancement
ludfjig
force-pushed
the
reset2
branch
3 times, most recently
from
e859ff9 to
e793129
Compare
ludfjig
changed the title
ludfjig
force-pushed
the
reset2
branch
5 times, most recently
from
8f55249 to
3bb2294
Compare
ludfjig
force-pushed
the
reset2
branch
2 times, most recently
from
032168d to
c0383dd
Compare
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Design doc for resetting guest-written MSRs across MultiUseSandbox::restore() with a per-MSR opt-in allow list, plus a KVM Phase 1 implementation handoff brief. Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Reset the guest-visible stateful MSRs on sandbox restore and gate the per-MSR allow list behind validation, so guest MSR writes cannot leak across restores. Adds host-index sweep, negative-leak, denied-MSR fault, and partial-set poison tests, plus documentation of the reset-set completeness argument and the dormant host_specific/TSC machinery. Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Handoff for the mshv agent: the pass-through completeness gap, the Hyper-V/mshv source facts (SVM pass-through MSR set, intercept behavior) the agent cannot see, and the reset-or-mask plan per MSR class. Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Widen the KVM-only MSR reset machinery to also cover the mshv backend, so guest MSR writes do not leak across a snapshot restore on Hyper-V. Implement capture_msrs/apply_msrs on MshvVm using batched get_msrs/set_msrs, detecting failure from the returned error (set_msrs reports no count) and poisoning on a partial apply. mshv has no per-MSR deny filter, so a guest can write architectural pass-through MSRs with no intercept, and completeness rests on reset. The reset set covers every stateful pass-through MSR the crate can map and restore: the core syscall, sysenter, and base MSRs, KERNEL_GS_BASE, SPEC_CTRL, and the CET MSRs where CET is active. mshv has no host-probed index list, so the reset set is resolved by probing each mappable index with a get at init, including only those that read back. That resets CET on hosts where it is exposed and skips it elsewhere without failing init. The allow list is validated at VM creation so a non-resettable or unmappable request is a hard error. The pass-through classes with no mapping (PMU, AMX/XFD, FRED, arch LBR) cannot be reset. Completeness holds because the minimal partition enables none of them, so a guest access faults. A test asserts this on the host. Add mshv tests: a pass-through MSR write is reset across restore, a guest read of an unresettable class faults, a rejected set_msrs during restore poisons the sandbox, an allowed MSR does not leak across restore, and allowing a non-resettable or unmapped MSR fails sandbox creation. Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Disallows reading/writing MSRs in the guest. Can be bypassed with unsafe function on SandboxConfiguration. The goal is to prevent guest state to persist across snapshot-restores.
Will mark ready for review once KVM releases new version, which should include newly added
KVM_X86_SET_MSR_FILTERvm ioctl that this PR depends on, see rust-vmm/kvm#359