From patchwork Wed Sep 2 12:59:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Graf X-Patchwork-Id: 11750531 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 70FAB138A for ; Wed, 2 Sep 2020 12:59:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 50CCC20709 for ; Wed, 2 Sep 2020 12:59:56 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=amazon.com header.i=@amazon.com header.b="sLBt0oo8" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726726AbgIBM7y (ORCPT ); Wed, 2 Sep 2020 08:59:54 -0400 Received: from smtp-fw-6002.amazon.com ([52.95.49.90]:24278 "EHLO smtp-fw-6002.amazon.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726124AbgIBM7v (ORCPT ); Wed, 2 Sep 2020 08:59:51 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1599051590; x=1630587590; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=ICDE6RfR+JH0kcoy+iWotRzmn0cioWZdR6Llakzqiz8=; b=sLBt0oo8A1CcTO7SjlIdeuoranP/re6rFKisLOXWU1btF1t8KhPwTkjH 3jemwKRh4HFA/2Nj3ANeGQsVBdWxd33Cdv6+//2Nmemmiukbkct+q3zog e9urpvADwsHqVsdi3o5jyQMgeRctjxIxSqHiz6pFi9/IdHnqir3ad4XG2 w=; X-IronPort-AV: E=Sophos;i="5.76,383,1592870400"; d="scan'208";a="51551893" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2c-c6afef2e.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6002.iad6.amazon.com with ESMTP; 02 Sep 2020 12:59:48 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2c-c6afef2e.us-west-2.amazon.com (Postfix) with ESMTPS id 141F6A22A4; Wed, 2 Sep 2020 12:59:47 +0000 (UTC) Received: from EX13D20UWC002.ant.amazon.com (10.43.162.163) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 2 Sep 2020 12:59:46 +0000 Received: from u79c5a0a55de558.ant.amazon.com (10.43.161.145) by EX13D20UWC002.ant.amazon.com (10.43.162.163) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 2 Sep 2020 12:59:42 +0000 From: Alexander Graf To: Paolo Bonzini CC: Jonathan Corbet , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , "Joerg Roedel" , KarimAllah Raslan , Aaron Lewis , Dan Carpenter , , , Subject: [PATCH v6 0/7] Allow user space to restrict and augment MSR emulation Date: Wed, 2 Sep 2020 14:59:28 +0200 Message-ID: <20200902125935.20646-1-graf@amazon.com> X-Mailer: git-send-email 2.28.0.394.ge197136389 MIME-Version: 1.0 X-Originating-IP: [10.43.161.145] X-ClientProxiedBy: EX13D08UWB004.ant.amazon.com (10.43.161.232) To EX13D20UWC002.ant.amazon.com (10.43.162.163) Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org While tying to add support for the MSR_CORE_THREAD_COUNT MSR in KVM, I realized that we were still in a world where user space has no control over what happens with MSR emulation in KVM. That is bad for multiple reasons. In my case, I wanted to emulate the MSR in user space, because it's a CPU specific register that does not exist on older CPUs and that really only contains informational data that is on the package level, so it's a natural fit for user space to provide it. However, it is also bad on a platform compatibility level. Currrently, KVM has no way to expose different MSRs based on the selected target CPU type. This patch set introduces a way for user space to indicate to KVM which MSRs should be handled in kernel space. With that, we can solve part of the platform compatibility story. Or at least we can not handle AMD specific MSRs on an Intel platform and vice versa. In addition, it introduces a way for user space to get into the loop when an MSR access would generate a #GP fault, such as when KVM finds an MSR that is not handled by the in-kernel MSR emulation or when the guest is trying to access reserved registers. In combination with filtering, user space trapping allows us to emulate arbitrary MSRs in user space, paving the way for target CPU specific MSR implementations from user space. v1 -> v2: - s/ETRAP_TO_USER_SPACE/ENOENT/g - deflect all #GP injection events to user space, not just unknown MSRs. That was we can also deflect allowlist errors later - fix emulator case - new patch: KVM: x86: Introduce allow list for MSR emulation - new patch: KVM: selftests: Add test for user space MSR handling v2 -> v3: - return r if r == X86EMUL_IO_NEEDED - s/KVM_EXIT_RDMSR/KVM_EXIT_X86_RDMSR/g - s/KVM_EXIT_WRMSR/KVM_EXIT_X86_WRMSR/g - Use complete_userspace_io logic instead of reply field - Simplify trapping code - document flags for KVM_X86_ADD_MSR_ALLOWLIST - generalize exit path, always unlock when returning - s/KVM_CAP_ADD_MSR_ALLOWLIST/KVM_CAP_X86_MSR_ALLOWLIST/g - Add KVM_X86_CLEAR_MSR_ALLOWLIST - Add test to clear whitelist - Adjust to reply-less API - Fix asserts - Actually trap on MSR_IA32_POWER_CTL writes v3 -> v4: - Mention exit reasons in re-enter mandatory section of API documentation - Clear padding bytes - Generalize get/set deflect functions - Remove redundant pending_user_msr field - lock allow check and clearing - free bitmaps on clear v4 -> v5: - use srcu v5 -> v6: - Switch from allow list to filtering API with explicit fallback option - Support and test passthrough MSR filtering - Check for filter exit reason - Add .gitignore - send filter change notification - change to atomic set_msr_filter ioctl with fallback flag - use EPERM for filter blocks - add bit for MSR user space deflection - check for overflow of BITS_TO_LONGS (thanks Dan Carpenter!) - s/int i;/u32 i;/ - remove overlap check - Introduce exit reason mask to allow for future expansion and filtering - s/emul_to_vcpu(ctxt)/vcpu/ - imported patch: KVM: x86: Prepare MSR bitmaps for userspace tracked MSRs - new patch: KVM: x86: Add infrastructure for MSR filtering - new patch: KVM: x86: SVM: Prevent MSR passthrough when MSR access is denied - new patch: KVM: x86: VMX: Prevent MSR passthrough when MSR access is denied Aaron Lewis (1): KVM: x86: Prepare MSR bitmaps for userspace tracked MSRs Alexander Graf (6): KVM: x86: Deflect unknown MSR accesses to user space KVM: x86: Add infrastructure for MSR filtering KVM: x86: SVM: Prevent MSR passthrough when MSR access is denied KVM: x86: VMX: Prevent MSR passthrough when MSR access is denied KVM: x86: Introduce MSR filtering KVM: selftests: Add test for user space MSR handling Documentation/virt/kvm/api.rst | 176 +++++++++- arch/x86/include/asm/kvm_host.h | 18 ++ arch/x86/include/uapi/asm/kvm.h | 19 ++ arch/x86/kvm/emulate.c | 18 +- arch/x86/kvm/svm/svm.c | 122 +++++-- arch/x86/kvm/svm/svm.h | 7 + arch/x86/kvm/vmx/nested.c | 2 +- arch/x86/kvm/vmx/vmx.c | 303 ++++++++++++------ arch/x86/kvm/vmx/vmx.h | 9 +- arch/x86/kvm/x86.c | 268 +++++++++++++++- arch/x86/kvm/x86.h | 1 + include/trace/events/kvm.h | 2 +- include/uapi/linux/kvm.h | 17 + tools/testing/selftests/kvm/.gitignore | 1 + tools/testing/selftests/kvm/Makefile | 1 + .../selftests/kvm/x86_64/user_msr_test.c | 224 +++++++++++++ 16 files changed, 1056 insertions(+), 132 deletions(-) create mode 100644 tools/testing/selftests/kvm/x86_64/user_msr_test.c