From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 040C04C69 for ; Tue, 4 Jun 2024 00:29:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=140.211.166.133 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717460994; cv=none; b=m1GPLkvf/nU5fqP+8QMQd9t859o3TPzRBFSH/NG8oOsYqTu/kPMhwGoin1SAIIFs167pU4Ef9Z/p7ZY/zj+E+0JLVpwS7cXpmRZDDMP0OM0veLjCb+T8rIPIzmQt1GmIurgGYZwMBjws5K1abXSZRNHj+bAFGWfAw6XB+UDjcgo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717460994; c=relaxed/simple; bh=tHNlljHyl4OWf1KxKCEPYA1CiqsKpPT13VLxPLbrxl8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=TwzwuKvxpBh1X2FxP6WzwW0S1c+mr7vqAWIZAGOkRk2/nPvscr+L7utX9GHAGXTfFJT7qECCKIEnvs2eNdfh3sn1+eD7G+ULspGsXe3uB/SNXxw5t8NnBAKmxPJBiU7cWeyZmPRAcvpOrU20eFxWDZYvjLJlWEDr5BTa9jZJ0u4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=zpNQwq6b; arc=none smtp.client-ip=140.211.166.133 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="zpNQwq6b" Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id AC9FA40534 for ; Tue, 4 Jun 2024 00:29:52 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org X-Spam-Flag: NO X-Spam-Score: -9.601 X-Spam-Level: Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id BYWz0MJ-QSnt for ; Tue, 4 Jun 2024 00:29:52 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2607:f8b0:4864:20::54a; helo=mail-pg1-x54a.google.com; envelope-from=3_l9ezgykahehtpcyrvddvat.rdb@flex--seanjc.bounces.google.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp2.osuosl.org EC2A0400F1 Authentication-Results: smtp2.osuosl.org; dmarc=pass (p=reject dis=none) header.from=google.com DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org EC2A0400F1 Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20230601 header.b=zpNQwq6b Received: from mail-pg1-x54a.google.com (mail-pg1-x54a.google.com [IPv6:2607:f8b0:4864:20::54a]) by smtp2.osuosl.org (Postfix) with ESMTPS id EC2A0400F1 for ; Tue, 4 Jun 2024 00:29:51 +0000 (UTC) Received: by mail-pg1-x54a.google.com with SMTP id 41be03b00d2f7-6658818ad5eso3699536a12.0 for ; Mon, 03 Jun 2024 17:29:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1717460991; x=1718065791; darn=lists.linux-foundation.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=QxIMQXFvRFWSOBKMLO/Pb11VLx9FgWxOAKpcjqg1q6M=; b=zpNQwq6bCBj7Ya5BLzu/mymLQ43GrxUloMuNHOE85uUof2JlTTK6t6mJQI7VcmrgxH cmNzWpwi2weAorkKxKmI6ttMs1tHl9ON4LFv6OGxqxrECf7IHLk7FtYgk7GIKPrGiS1s 56eR4eJwlb9Fe40N6W7gr48u/IFQCc3ae5KVIwZmVwvcdC7a1zis3ktLae3vn9p9ALPU LCkeXI7zM28qN7W7ylYORuPNdj8nt8bbnxjt0BU8xSEP6Z+SgaRKXbPK9oFreFwA05qd peNESsvo8uplu4DjGhg5GDyrUr94CTQ4irU7IBWKHQBQO7Cm4dtOzsmYBhEJrpp1kT7e sfFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1717460991; x=1718065791; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=QxIMQXFvRFWSOBKMLO/Pb11VLx9FgWxOAKpcjqg1q6M=; b=DLdgVGx19Ej/ag2v/UBUxOvLSEvsgI3rxZg0CKbOhJ/GWrs14XvkRQ5W/L+wioR/DY 4AZQewChs1gIcOxUOteV4LsHwaxVa9qXK4BEj3ZOm6RT65GMhpnJaWvQNLADKB+oKWDZ D3x6qxMNhvZistndGbt9Uz9JvX6AP9o1iE/XJTmVTgdbLmzt35wVl6ftlAP3vIIDdV2z +hTByH0fY4skNkT0g30eDB+PGAuM9KyZ+65hMJL6T3yHemlUutVxY04pbuMJ3fDnNZWd Q+vcF+XPDa3bGySmusHI6EO7t/I58yaF0zYm4o4+uyTFaoO1XNrde0jQgZhGuKRh96CW 7Xcg== X-Forwarded-Encrypted: i=1; AJvYcCWXlU2aHtkG7btDMbt/W5e9rT24yqdAb4W//asw/t8ytv3I5MOAXma0AaE4ZsO0XLWfr4tfq61tuj/EYVl08wOn3M45i9C3O8jXHXsaqmJZjciJMXPHVJqXjg== X-Gm-Message-State: AOJu0YwMLaGRpfx/SUAqM5bYMIuoJ9ICZf4c+rzJSzrsUne0X7egw92j l5wQjBsr1fepN9Exh6b0qbQjZT3o8bNKUs9SnebPLC/wdx0eOYn+950kW1vlnI11kfBXA4nJQX/ IXg== X-Google-Smtp-Source: AGHT+IENLGEaWbs37HwWar6l9tfsoGWg6m42nFsyoTQfIezFlKVeE9IraziAYhpEU9jmdwNYoPJqg3Pzh8c= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:902:f7c1:b0:1f4:620b:6a47 with SMTP id d9443c01a7336-1f6370524bemr2945395ad.4.1717460990723; Mon, 03 Jun 2024 17:29:50 -0700 (PDT) Date: Mon, 3 Jun 2024 17:29:49 -0700 In-Reply-To: <20240514.OoPohLaejai6@digikod.net> Precedence: bulk X-Mailing-List: virtualization@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240503131910.307630-1-mic@digikod.net> <20240503131910.307630-4-mic@digikod.net> <20240506.ohwe7eewu0oB@digikod.net> <20240507.ieghomae0UoC@digikod.net> <20240514.OoPohLaejai6@digikod.net> Message-ID: Subject: Re: [RFC PATCH v3 3/5] KVM: x86: Add notifications for Heki policy configuration and violation From: Sean Christopherson To: "=?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?=" Cc: Nicolas Saenz Julienne , Borislav Petkov , Dave Hansen , "H . Peter Anvin" , Ingo Molnar , Kees Cook , Paolo Bonzini , Thomas Gleixner , Vitaly Kuznetsov , Wanpeng Li , Rick P Edgecombe , Alexander Graf , Angelina Vu , Anna Trikalinou , Chao Peng , Forrest Yuan Yu , James Gowans , James Morris , John Andersen , "Madhavan T . Venkataraman" , Marian Rotariu , "Mihai =?utf-8?B?RG9uyJt1?=" , "=?utf-8?B?TmljdciZb3IgQ8OuyJt1?=" , Thara Gopinath , Trilok Soni , Wei Liu , Will Deacon , Yu Zhang , "=?utf-8?Q?=C8=98tefan_=C8=98icleru?=" , dev@lists.cloudhypervisor.org, kvm@vger.kernel.org, linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, qemu-devel@nongnu.org, virtualization@lists.linux-foundation.org, x86@kernel.org, xen-devel@lists.xenproject.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Tue, May 14, 2024, Micka=C3=ABl Sala=C3=BCn wrote: > On Tue, May 07, 2024 at 09:16:06AM -0700, Sean Christopherson wrote: > > On Tue, May 07, 2024, Micka=C3=ABl Sala=C3=BCn wrote: > > > If yes, that would indeed require a *lot* of work for something we're= not > > > sure will be accepted later on. > >=20 > > Yes and no. The AWS folks are pursuing VSM support in KVM+QEMU, and SV= SM support > > is trending toward the paired VM+vCPU model. IMO, it's entirely feasib= le to > > design KVM support such that much of the development load can be shared= between > > the projects. And having 2+ use cases for a feature (set) makes it _mu= ch_ more > > likely that the feature(s) will be accepted. > >=20 > > And similar to what Paolo said regarding HEKI not having a complete sto= ry, I > > don't see a clear line of sight for landing host-defined policy enforce= ment, as > > there are many open, non-trivial questions that need answers. I.e. upst= reaming > > HEKI in its current form is also far from a done deal, and isn't guaran= teed to > > be substantially less work when all is said and done. >=20 > I'm not sure to understand why "Heki not having a complete story". The > goal is the same as the current kernel self-protection mechanisms. HEKI doesn't have a complete story for how it's going to play nice with kex= ec(), emulated RESET, etc. The kernel's existing self-protection mechanisms Just= Work because the protections are automatically disabled/lost on such transitions= . They are obviously significant drawbacks to that behavior, but they are acc= epted drawbacks, i.e. solving those problems isn't in scope (yet) for the kernel.= And the "failure" mode is also loss of hardening, not an unusable guest. In other words, the kernel's hardening is firmly best effort at this time, whereas HEKI likely needs to be much more than "best effort" in order to ju= stify the extra complexity. And that means having answers to the various interop= erability questions.