From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB7C4C4167D for ; Thu, 10 Nov 2022 00:57:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232166AbiKJA51 (ORCPT ); Wed, 9 Nov 2022 19:57:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232040AbiKJA5L (ORCPT ); Wed, 9 Nov 2022 19:57:11 -0500 Received: from mail-pf1-x44a.google.com (mail-pf1-x44a.google.com [IPv6:2607:f8b0:4864:20::44a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F7D6209BF for ; Wed, 9 Nov 2022 16:57:10 -0800 (PST) Received: by mail-pf1-x44a.google.com with SMTP id k11-20020aa792cb000000b00558674e8e7fso176556pfa.6 for ; Wed, 09 Nov 2022 16:57:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=sfZqtehmJAKW3XdILp4Pa+j/G6SeiEXkrRjwBXbPNQ4=; b=R7MO5UZg7uZuGhIBEVZ0K4sBRl8uHVbSzpOR8CzrHMoASp/lJy34BFMEJHsE8QIqZ+ sGptJIr7AgU4nzsg/w0iyGjWoaNtEPB3XPsCTmvjm0wVVuHpbtlG982CUVHn8CnDy5CA sjkyyVXgKgtz3Zttb/ukzdRtLTijU4LiFs7fGlnv+JSvcEbqHn0kmD1dAFd2X4kJPF+x jzF4z1P9e1xclKp9nHV5MLieEWO+nZ2pb9SH6c06g6yeVbTDqkJaXZdUIuW+bMpVbx1o tOAUda2uGLt459EygROZFC4+2hwWi0rjATlKT0xIuw8ScDvX5JeqNiBqNSTx3oEXA9FU 4zqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=sfZqtehmJAKW3XdILp4Pa+j/G6SeiEXkrRjwBXbPNQ4=; b=oq23tuG9WaF3bvfNtHTBtI4s1vVDGwjcusTTZXUAZVmNLYMt0DK3InF5nvlcIBaOmn h/jElDlPhSr1SPQYKSJi/GGvoWw4BQVESQZrATtJTYyNPaDvsmxEjMu83j22rQ61ifIh qcdaC+KXG8lKtMXTK1ot4a9ZdUoCIdbpoUTm2whTI3Dq9wWgPhrSxPraubbu4OpoqoQR RVFsfH7FNTSFInY4hADVjhGwBwk2/JIVWErbdunqelXI4+AAw2nqzCa45KP1Ko04VF8J DEEtfShXj7HqjOO+FCo1L/wQhe4YivsUWJJmpfF5odH4cA2bCdgUq3QZnl0m86c8MROq rJmw== X-Gm-Message-State: ACrzQf0xXLSaaUCT/9FSIlNy2XObEPR0AGoz3kI7sKnTgtOWCa3QmmTq 2mQyABf13vFu2aCvnfFPAiG3wIFcuHA= X-Google-Smtp-Source: AMsMyM4WRNtIl3Riz4W8+eM2I9MeCMHVFp7PazBTAuTfgJdkEPJzdC5uVayhgT5JdlqoyKb/XWxH/+oQuv8= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:902:ce88:b0:186:b345:97c0 with SMTP id f8-20020a170902ce8800b00186b34597c0mr64227380plg.13.1668041830237; Wed, 09 Nov 2022 16:57:10 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 10 Nov 2022 00:57:05 +0000 In-Reply-To: <20221110005706.1064832-1-seanjc@google.com> Mime-Version: 1.0 References: <20221110005706.1064832-1-seanjc@google.com> X-Mailer: git-send-email 2.38.1.431.g37b22c650d-goog Message-ID: <20221110005706.1064832-2-seanjc@google.com> Subject: [PATCH 1/2] KVM: nVMX: Don't muck with allowed sec exec controls on CPUID changes From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yu Zhang Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Don't modify the set of allowed secondary execution controls, i.e. the virtual MSR_IA32_VMX_PROCBASED_CTLS2, in response to guest CPUID changes. To avoid breaking old userspace that never sets the VMX MSRs, i.e. relies on KVM to provide a consistent vCPU model, keep the existing behavior if userspace has never written MSR_IA32_VMX_PROCBASED_CTLS2. KVM should not modify the VMX capabilities presented to L1 based on CPUID as doing so may discard explicit settings provided by userspace. E.g. if userspace does KVM_SET_MSRS => KVM_SET_CPUID and disables a feature in the VMX MSRs but not CPUID (to prevent exposing the feature to L2), then stuffing the VMX MSRs during KVM_SET_CPUID will expose the feature to L2 against userspace's wishes. Alternatively, KVM could add a quirk, but that's less than ideal as a VMM that is affected by the bug would need to be updated in order to opt out of the buggy behavior. The "has the MSR ever been written" logic handles both the case where an enlightened userspace sets the MSR during setup, and the case where userspace blindly migrates the MSR, as the migrated value will already have been sanitized by the source KVM or explicitly set by the source VMM. Reported-by: Yu Zhang Signed-off-by: Sean Christopherson --- arch/x86/kvm/vmx/capabilities.h | 1 + arch/x86/kvm/vmx/nested.c | 3 +++ arch/x86/kvm/vmx/vmx.c | 2 +- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx/capabilities.h b/arch/x86/kvm/vmx/capabilities.h index cd2ac9536c99..7b08d6006f52 100644 --- a/arch/x86/kvm/vmx/capabilities.h +++ b/arch/x86/kvm/vmx/capabilities.h @@ -51,6 +51,7 @@ struct nested_vmx_msrs { u64 cr4_fixed1; u64 vmcs_enum; u64 vmfunc_controls; + bool secondary_set_by_userspace; }; struct vmcs_config { diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 61a2e551640a..e537526d996c 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -1256,6 +1256,9 @@ vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data) if (!is_bitwise_subset(supported, data, GENMASK_ULL(63, 32))) return -EINVAL; + if (msr_index == MSR_IA32_VMX_PROCBASED_CTLS2) + vmx->nested.msrs.secondary_set_by_userspace = true; + vmx_get_control_msr(&vmx->nested.msrs, msr_index, &lowp, &highp); *lowp = data; *highp = data >> 32; diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index aca88524fd1e..e5eec41bc1d5 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -4428,7 +4428,7 @@ vmx_adjust_secondary_exec_control(struct vcpu_vmx *vmx, u32 *exec_control, * Update the nested MSR settings so that a nested VMM can/can't set * controls for features that are/aren't exposed to the guest. */ - if (nested) { + if (nested && !vmx->nested.msrs.secondary_set_by_userspace) { if (enabled) vmx->nested.msrs.secondary_ctls_high |= control; else -- 2.38.1.431.g37b22c650d-goog