From: "Yang, Weijiang" <weijiang.yang@intel.com>
To: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>, <kvm@vger.kernel.org>,
<linux-kernel@vger.kernel.org>,
Tom Lendacky <thomas.lendacky@amd.com>
Subject: Re: [PATCH 09/10] KVM: x86: Suppress failures on userspace access to advertised, unsupported MSRs
Date: Fri, 26 Apr 2024 20:36:21 +0800 [thread overview]
Message-ID: <4c0cd892-8b7c-451b-9c04-2e83f33bef0f@intel.com> (raw)
In-Reply-To: <20240425181422.3250947-10-seanjc@google.com>
On 4/26/2024 2:14 AM, Sean Christopherson wrote:
> Extend KVM's suppression of failures due to a userspace access to an
> unsupported, but advertised as a "to save" MSR to all MSRs, not just those
> that happen to reach the default case statements in kvm_get_msr_common()
> and kvm_set_msr_common(). KVM's soon-to-be-established ABI is that if an
> MSR is advertised to userspace, then userspace is allowed to read the MSR,
> and write back the value that was read, i.e. why an MSR is unsupported
> doesn't change KVM's ABI.
>
> Practically speaking, this is very nearly a nop, as the only other paths
> that return KVM_MSR_RET_UNSUPPORTED are {svm,vmx}_get_feature_msr(), and
> it's unlikely, though not impossible, that userspace is using KVM_GET_MSRS
> on unsupported MSRs.
>
> The primary goal of moving the suppression to common code is to allow
> returning KVM_MSR_RET_UNSUPPORTED as appropriate throughout KVM, without
> having to manually handle the "is userspace accessing an advertised"
> waiver. I.e. this will allow formalizing KVM's ABI without incurring a
> high maintenance cost.
>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
> arch/x86/kvm/x86.c | 27 +++++++++------------------
> 1 file changed, 9 insertions(+), 18 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 04a5ae853774..4c91189342ff 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -527,6 +527,15 @@ static __always_inline int kvm_do_msr_access(struct kvm_vcpu *vcpu, u32 msr,
> if (ret != KVM_MSR_RET_UNSUPPORTED)
> return ret;
>
> + /*
> + * Userspace is allowed to read MSRs, and write '0' to MSRs, that KVM
> + * reports as to-be-saved, even if an MSR isn't fully supported.
> + * Simply check that @data is '0', which covers both the write '0' case
> + * and all reads (in which case @data is zeroed on failure; see above).
> + */
> + if (host_initiated && !*data && kvm_is_msr_to_save(msr))
> + return 0;
> +
IMHO, it's worth to document above phrase into virt/kvm/api.rst KVM_{GET, SET}_MSRS
sections as a note because when users space reads/writes MSRs successfully, it doesn't
necessarily mean the operation really took effect. Maybe it's just due to the fact they're
exposed in "to-be-saved" list.
> if (!ignore_msrs) {
> kvm_debug_ratelimited("unhandled %s: 0x%x data 0x%llx\n",
> op, msr, *data);
> @@ -4163,14 +4172,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> if (kvm_pmu_is_valid_msr(vcpu, msr))
> return kvm_pmu_set_msr(vcpu, msr_info);
>
> - /*
> - * Userspace is allowed to write '0' to MSRs that KVM reports
> - * as to-be-saved, even if an MSRs isn't fully supported.
> - */
> - if (msr_info->host_initiated && !data &&
> - kvm_is_msr_to_save(msr))
> - break;
> -
> return KVM_MSR_RET_UNSUPPORTED;
> }
> return 0;
> @@ -4522,16 +4523,6 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
> if (kvm_pmu_is_valid_msr(vcpu, msr_info->index))
> return kvm_pmu_get_msr(vcpu, msr_info);
>
> - /*
> - * Userspace is allowed to read MSRs that KVM reports as
> - * to-be-saved, even if an MSR isn't fully supported.
> - */
> - if (msr_info->host_initiated &&
> - kvm_is_msr_to_save(msr_info->index)) {
> - msr_info->data = 0;
> - break;
> - }
> -
> return KVM_MSR_RET_UNSUPPORTED;
> }
> return 0;
next prev parent reply other threads:[~2024-04-26 12:36 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-25 18:14 [PATCH 00/10] KVM: x86: Clean up MSR access/failure handling Sean Christopherson
2024-04-25 18:14 ` [PATCH 01/10] KVM: SVM: Disallow guest from changing userspace's MSR_AMD64_DE_CFG value Sean Christopherson
2024-04-25 18:14 ` [PATCH 02/10] KVM: x86: Move MSR_TYPE_{R,W,RW} values from VMX to x86, as enums Sean Christopherson
2024-04-25 18:14 ` [PATCH 03/10] KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED Sean Christopherson
2024-04-25 18:14 ` [PATCH 04/10] KVM: x86: Refactor kvm_x86_ops.get_msr_feature() to avoid kvm_msr_entry Sean Christopherson
2024-04-25 18:14 ` [PATCH 05/10] KVM: x86: Rename get_msr_feature() APIs to get_feature_msr() Sean Christopherson
2024-04-26 6:58 ` Yang, Weijiang
2024-04-25 18:14 ` [PATCH 06/10] KVM: x86: Refactor kvm_get_feature_msr() to avoid struct kvm_msr_entry Sean Christopherson
2024-04-25 18:14 ` [PATCH 07/10] KVM: x86: Funnel all fancy MSR return value handling into a common helper Sean Christopherson
2024-04-25 18:14 ` [PATCH 08/10] KVM: x86: Hoist x86.c's global msr_* variables up above kvm_do_msr_access() Sean Christopherson
2024-04-25 18:14 ` [PATCH 09/10] KVM: x86: Suppress failures on userspace access to advertised, unsupported MSRs Sean Christopherson
2024-04-26 12:36 ` Yang, Weijiang [this message]
2024-04-26 17:18 ` Sean Christopherson
2024-04-25 18:14 ` [PATCH 10/10] KVM: x86: Suppress userspace access failures on unsupported, "emulated" MSRs Sean Christopherson
2024-04-26 7:43 ` Yang, Weijiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4c0cd892-8b7c-451b-9c04-2e83f33bef0f@intel.com \
--to=weijiang.yang@intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=thomas.lendacky@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).