Received-SPF: pass (google.com: domain of linux-kernel+bounces-159991-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <4c0cd892-8b7c-451b-9c04-2e83f33bef0f@intel.com>
Date: Fri, 26 Apr 2024 20:36:21 +0800
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 09/10] KVM: x86: Suppress failures on userspace access to
 advertised, unsupported MSRs
To: Sean Christopherson <seanjc@google.com>
CC: Paolo Bonzini <pbonzini@redhat.com>, <kvm@vger.kernel.org>,
	<linux-kernel@vger.kernel.org>, Tom Lendacky <thomas.lendacky@amd.com>
References: <20240425181422.3250947-1-seanjc@google.com>
 <20240425181422.3250947-10-seanjc@google.com>
Content-Language: en-US
From: "Yang, Weijiang" <weijiang.yang@intel.com>
In-Reply-To: <20240425181422.3250947-10-seanjc@google.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?RFlJNEhvRW4wZ2lOanVMTnJmOEladHN2d3dEOGFObHdTZlI1cERtT2krQTJP?=
 =?utf-8?B?bmRuRURmTzVZMWxSWE9VZHlUSEplR08xdDdCYVVia3lMbWt5VkdtYkwycSt1?=
 =?utf-8?B?Q2NkQUpJbDR2SVlxL05oR2d1alEyOUVTYzh1dmYwSlpDUzBLRDNmLzh0blJv?=
 =?utf-8?B?Mlh1VXhqem50bURBd2JTVHlxdzRmMUVYWkQzQlNEQnpCRDZXRkJIbStmSHZW?=
 =?utf-8?B?UzBFbUZiZ2t1QUIxL3NMMW5TYzNKTHlUeUU1VnZETGpJKzhUQ2ZNQ3FrVDVx?=
 =?utf-8?B?eC92aDVNZ2s4QlJzY0xvY01aQ1ZXWjkwUkV0UzFvekE1bERyOWZRMHVyakM1?=
 =?utf-8?B?c2ZkN3FQUDB6M2lUNm8vL1RlZitoZDZjRUsyTkJtTnFVUllOZmtkQkV6TXpU?=
 =?utf-8?B?U1J1b29iYkgxWkZFWk9VNjhZZ2pnbDBXNVRDaVJqUVZNR3dCVlJVNHpXMWtF?=
 =?utf-8?B?WE1nSGNIc1Awc2x5SXprQWFsWGVjMjRDYWZSaXF6aHZZRmNkRXJLUm81MXhp?=
 =?utf-8?B?UitQcUlXeWtoNUdNTEs5Nnp1TlNQdjdJOVVNTkFoekludzI3YjBXb2hZR3Y4?=
 =?utf-8?B?TXdZNk5WM3hhNXByb0JqK0xaWGhIUjFwOVYzRDZRakZVblZNMzJ1bHkwcmd1?=
 =?utf-8?B?RkZKNjBWTndBT1M3MzJkZThVK0ZaeGV0RHZMb0dWdXVBOExZRkVuZVNCNTk3?=
 =?utf-8?B?NWZ5ZU1OR0ZZellBTjloamZyZTJmWnNPa0wzQlI1MmZvNHFXSVRncnVRZ0pK?=
 =?utf-8?B?dy9kdEdpU3lMSUZXY0lGdE93YUFpSll3NTMvckwycWR6emN4RFRUMjBuYm9n?=
 =?utf-8?B?U2swWUVTWml6VmxPRkJxbEhDMzlDcUgrWk1xZno5d24rSTBocjNXWWhnaDV6?=
 =?utf-8?B?Tk1XRVZKaTlFcndnbTZ2bGNrdTFUcG1rSlU4SU1QTHNvSHl0RUo3Y0RzT3Ay?=
 =?utf-8?B?ZlZrSW9Xb2VmN2tSTlRZZ0tqdkdXTlg1Q1gxVDk3aGZTb2xBajFLalpndTNu?=
 =?utf-8?B?RExUMXlobDJ4Uk03amJsYnhaU3ZJK2crSi9xcE5tYlMvUVFvV3hVcWpIR0U3?=
 =?utf-8?B?dHZnUG51cGN6bDBzMHhTMFRYTU1WWWFHZW5xR29EaWxLNXVxdEQ1UzZOOEVK?=
 =?utf-8?B?dk1yT0FnV2Z1UHBKVmp0NE1TeE92TWZKbEh2WUtJU3hMSDk4bkMxQmNNdk4y?=
 =?utf-8?B?WGw0ZXdTa3pHaXNoL2cxUWt3MGdyOVU0dzgzbzJ2WC9XZmlDaG11YkxmZkZQ?=
 =?utf-8?B?Uis2VFFkKzJwSjBJeitVMHBndGZwcE5Xais0dVMreTNyVDluYWZoSW5VZlM2?=
 =?utf-8?B?M2ZLdHBka08zUWI3VTRsN1I1YSttbGNEeXZoeHBOOGF1QTNGYm9IT1Q5MXJU?=
 =?utf-8?B?SytOL01NbG9sTEVDNVAwR1ZuTklXZVdwYWE4RW9tNEFWS2pYMUhyQkRDcmUw?=
 =?utf-8?B?Ty92bHZtSGZlVmhPVkpTc2c3TDIwa0hVODVwWTNEVVQzampwOWNrYXQzbU9x?=
 =?utf-8?B?MHVuSW8rRGR5ampiSWF2cXhtVjhtTWN5WTFWbkZ4SFUxeDBKcEpvMTZrczFj?=
 =?utf-8?B?UTV5ekNGaFlNTTQyNkVBTXA3UDlMTGNWWVRJS2wvZzNndStsOGk5aUNOZWNB?=
 =?utf-8?B?NW0wVEl4cnkyNzB5c1VnQWtETkx3Yno2czM3U25raG84bzdYQ0JEc1NhaXFW?=
 =?utf-8?B?bFNxdXpnTWlmWUFyN3czU1pJNXc0blorM1FsRUZrcFlQYjh1eFZnbXVFVDlI?=
 =?utf-8?B?M0NuYnBta0JwODAyZG0vZlVoN0I0TVlHNG1rSUhQbGxZUkU3Z0JUaHBtU1lE?=
 =?utf-8?B?VHpCTW9SWmVwanhaamg2dzM4MGZGRDF5RmZZUXM3SEtFYzJGZW5ZcXdpeW1E?=
 =?utf-8?B?S0FXZytKMFBDWm9JRkpyQ25lMTRpbTEzaDFWWVBPTXRMdDFXWit5TUFQSUZM?=
 =?utf-8?B?Zm1TUC9mUjJTSnFJVis3UU5FWlk4QzY1R0crSVcxbkJTRWttL2kxekl4YnlP?=
 =?utf-8?B?Tk5EOG91Q21vb0F1b1pjUElyY1lnY2lieFBDeVpOb1JEOE5ZdkxQL1JGdmlH?=
 =?utf-8?B?aGRqblZIMlFjNDdNQW5RU3VZRm5GZDNNT1NtdUQ5SDdMMUUzZnlqaHFGQStw?=
 =?utf-8?B?Q0wvU3p6SFlxU3oxVEhYWkttQm1YMzJFK1hCcDh3MkNmOUxNUlp6ZVJTTHhn?=
 =?utf-8?B?K1E9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: a6fc82aa-ae3d-4c80-58f4-08dc65ed7e0a
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4965.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Apr 2024 12:36:27.8175
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: qHeLcDAvOhxMnayLdNuhcReRoEXPHyG4MvYXpun3BwwDsb++WC/iHU0LIQNWZeHZOOCHRfYc0Z31wrou4yAmaw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR11MB4883
X-OriginatorOrg: intel.com

On 4/26/2024 2:14 AM, Sean Christopherson wrote:
> Extend KVM's suppression of failures due to a userspace access to an
> unsupported, but advertised as a "to save" MSR to all MSRs, not just those
> that happen to reach the default case statements in kvm_get_msr_common()
> and kvm_set_msr_common().  KVM's soon-to-be-established ABI is that if an
> MSR is advertised to userspace, then userspace is allowed to read the MSR,
> and write back the value that was read, i.e. why an MSR is unsupported
> doesn't change KVM's ABI.
>
> Practically speaking, this is very nearly a nop, as the only other paths
> that return KVM_MSR_RET_UNSUPPORTED are {svm,vmx}_get_feature_msr(), and
> it's unlikely, though not impossible, that userspace is using KVM_GET_MSRS
> on unsupported MSRs.
>
> The primary goal of moving the suppression to common code is to allow
> returning KVM_MSR_RET_UNSUPPORTED as appropriate throughout KVM, without
> having to manually handle the "is userspace accessing an advertised"
> waiver.  I.e. this will allow formalizing KVM's ABI without incurring a
> high maintenance cost.
>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>   arch/x86/kvm/x86.c | 27 +++++++++------------------
>   1 file changed, 9 insertions(+), 18 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 04a5ae853774..4c91189342ff 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -527,6 +527,15 @@ static __always_inline int kvm_do_msr_access(struct kvm_vcpu *vcpu, u32 msr,
>   	if (ret != KVM_MSR_RET_UNSUPPORTED)
>   		return ret;
>   
> +	/*
> +	 * Userspace is allowed to read MSRs, and write '0' to MSRs, that KVM
> +	 * reports as to-be-saved, even if an MSR isn't fully supported.
> +	 * Simply check that @data is '0', which covers both the write '0' case
> +	 * and all reads (in which case @data is zeroed on failure; see above).
> +	 */
> +	if (host_initiated && !*data && kvm_is_msr_to_save(msr))
> +		return 0;
> +

IMHO,  it's worth to document above phrase into virt/kvm/api.rst KVM_{GET, SET}_MSRS
sections as a note because when users space reads/writes MSRs successfully, it doesn't
necessarily mean the operation really took effect. Maybe it's  just due to the fact they're
exposed in "to-be-saved" list.

>   	if (!ignore_msrs) {
>   		kvm_debug_ratelimited("unhandled %s: 0x%x data 0x%llx\n",
>   				      op, msr, *data);
> @@ -4163,14 +4172,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>   		if (kvm_pmu_is_valid_msr(vcpu, msr))
>   			return kvm_pmu_set_msr(vcpu, msr_info);
>   
> -		/*
> -		 * Userspace is allowed to write '0' to MSRs that KVM reports
> -		 * as to-be-saved, even if an MSRs isn't fully supported.
> -		 */
> -		if (msr_info->host_initiated && !data &&
> -		    kvm_is_msr_to_save(msr))
> -			break;
> -
>   		return KVM_MSR_RET_UNSUPPORTED;
>   	}
>   	return 0;
> @@ -4522,16 +4523,6 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>   		if (kvm_pmu_is_valid_msr(vcpu, msr_info->index))
>   			return kvm_pmu_get_msr(vcpu, msr_info);
>   
> -		/*
> -		 * Userspace is allowed to read MSRs that KVM reports as
> -		 * to-be-saved, even if an MSR isn't fully supported.
> -		 */
> -		if (msr_info->host_initiated &&
> -		    kvm_is_msr_to_save(msr_info->index)) {
> -			msr_info->data = 0;
> -			break;
> -		}
> -
>   		return KVM_MSR_RET_UNSUPPORTED;
>   	}
>   	return 0;