Received-SPF: pass (google.com: domain of linux-kernel+bounces-160458-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Fri, 26 Apr 2024 10:18:08 -0700
In-Reply-To: <4c0cd892-8b7c-451b-9c04-2e83f33bef0f@intel.com>
Precedence: bulk
Mime-Version: 1.0
References: <20240425181422.3250947-1-seanjc@google.com> <20240425181422.3250947-10-seanjc@google.com>
 <4c0cd892-8b7c-451b-9c04-2e83f33bef0f@intel.com>
Message-ID: <Zivh0IaAmHsEOLFc@google.com>
Subject: Re: [PATCH 09/10] KVM: x86: Suppress failures on userspace access to
 advertised, unsupported MSRs
From: Sean Christopherson <seanjc@google.com>
To: Weijiang Yang <weijiang.yang@intel.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, 
	Tom Lendacky <thomas.lendacky@amd.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Apr 26, 2024, Weijiang Yang wrote:
> On 4/26/2024 2:14 AM, Sean Christopherson wrote:
> > Extend KVM's suppression of failures due to a userspace access to an
> > unsupported, but advertised as a "to save" MSR to all MSRs, not just th=
ose
> > that happen to reach the default case statements in kvm_get_msr_common(=
)
> > and kvm_set_msr_common().  KVM's soon-to-be-established ABI is that if =
an
> > MSR is advertised to userspace, then userspace is allowed to read the M=
SR,
> > and write back the value that was read, i.e. why an MSR is unsupported
> > doesn't change KVM's ABI.
> >=20
> > Practically speaking, this is very nearly a nop, as the only other path=
s
> > that return KVM_MSR_RET_UNSUPPORTED are {svm,vmx}_get_feature_msr(), an=
d
> > it's unlikely, though not impossible, that userspace is using KVM_GET_M=
SRS
> > on unsupported MSRs.
> >=20
> > The primary goal of moving the suppression to common code is to allow
> > returning KVM_MSR_RET_UNSUPPORTED as appropriate throughout KVM, withou=
t
> > having to manually handle the "is userspace accessing an advertised"
> > waiver.  I.e. this will allow formalizing KVM's ABI without incurring a
> > high maintenance cost.
> >=20
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > ---
> >   arch/x86/kvm/x86.c | 27 +++++++++------------------
> >   1 file changed, 9 insertions(+), 18 deletions(-)
> >=20
> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 04a5ae853774..4c91189342ff 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -527,6 +527,15 @@ static __always_inline int kvm_do_msr_access(struc=
t kvm_vcpu *vcpu, u32 msr,
> >   	if (ret !=3D KVM_MSR_RET_UNSUPPORTED)
> >   		return ret;
> > +	/*
> > +	 * Userspace is allowed to read MSRs, and write '0' to MSRs, that KVM
> > +	 * reports as to-be-saved, even if an MSR isn't fully supported.
> > +	 * Simply check that @data is '0', which covers both the write '0' ca=
se
> > +	 * and all reads (in which case @data is zeroed on failure; see above=
).
> > +	 */
> > +	if (host_initiated && !*data && kvm_is_msr_to_save(msr))
> > +		return 0;
> > +
>=20
> IMHO,=C2=A0 it's worth to document above phrase into virt/kvm/api.rst KVM=
_{GET,
> SET}_MSRS sections as a note because when users space reads/writes MSRs
> successfully, it doesn't necessarily mean the operation really took effec=
t.
> Maybe it's=C2=A0 just due to the fact they're exposed in "to-be-saved" li=
st.

Agreed, though I think I'd prefer to wait to officially document the behavi=
or
until we have fully converted KVM's internals to KVM_MSR_RET_UNSUPPORTED.  =
I'm
99% certain the behavior won't actually be as simple as "userspace can writ=
e '0'",
e.g. I know of at least one case where KVM allows '0' _or_ the KVM's non-ze=
ro
default.

In the case that I'm aware of (MSR_AMD64_TSC_RATIO), the "default" is a har=
dcoded
KVM constant, e.g. won't change based on underlying hardware, but there me =
be
other special cases lurking, and we won't know until we complete the conver=
sion :-(