[v3,00/21] KVM: x86: Disallow writes to feature MSRs post-KVM_RUN

  Give feature MSRs that same treatment as CPUID and disallow changing said
MSRs after KVM_RUN.  Fix a tangentially related bug in the vPMU where KVM
leaves the vLBRs enabled after userspace disables the guest's entire vPMU.

The bulk of this series is a rework of the vmx_pmu_caps_test, a.k.a.
the PERF_CAPABILITIES selftests, to expand its coverage.  In addition to
verifying that KVM rejects changes after KVM_RUN, verify other bits beyond
full-width writes and the LBR format.

Note!  There is a sneaky, small, but massive change buried halfway through
this series that will affect all x86 selftests.  Patch

  Verify KVM preserves userspace writes to "durable" MSRs

adds a KVM_GET_MSRS after every KVM_SET_MSRS that writes a single MSR and
expects to succeeded.  The intent is to opportunistically verify that KVM
provides "read what you wrote" for all "durable" MSRs.  The PERF_CAPS test
was manually verifying this behavior, and while it seems kinda gratuitous,
the coverage is quite cheap from both a performance and maintenance cost,
i.e. I can't think of a reason _not_ to do it.

v3:
 - Collect reviews. [Xiaoyao]
 - Fix the PMU selftests _before_ introducing the breaking KVM change. [Like]
 - Actually use kvm_vcpu_has_run()... [Yu]

v2: https://lore.kernel.org/all/20230210003148.2646712-1-seanjc@google.com

v1: https://lore.kernel.org/all/20220805172945.35412-1-seanjc@google.com

Sean Christopherson (21):
  KVM: x86: Rename kvm_init_msr_list() to clarify it inits multiple
    lists
  KVM: x86: Add a helper to query whether or not a vCPU has ever run
  KVM: x86: Add macros to track first...last VMX feature MSRs
  KVM: x86: Generate set of VMX feature MSRs using first/last
    definitions
  KVM: selftests: Split PMU caps sub-tests to avoid writing MSR after
    KVM_RUN
  KVM: x86: Disallow writes to immutable feature MSRs after KVM_RUN
  KVM: x86/pmu: WARN and bug the VM if PMU is refreshed after vCPU has
    run
  KVM: x86/pmu: Zero out LBR capabilities during PMU refresh
  KVM: selftests: Move 0/initial value PERF_CAPS checks to dedicated
    sub-test
  KVM: selftests: Assert that full-width PMC writes are supported if
    PDCM=1
  KVM: selftests: Print out failing MSR and value in vcpu_set_msr()
  KVM: selftests: Verify KVM preserves userspace writes to "durable"
    MSRs
  KVM: selftests: Drop now-redundant checks on PERF_CAPABILITIES writes
  KVM: selftests: Test all fungible features in PERF_CAPABILITIES
  KVM: selftests: Test all immutable non-format bits in
    PERF_CAPABILITIES
  KVM: selftests: Expand negative testing of guest writes to
    PERF_CAPABILITIES
  KVM: selftests: Test post-KVM_RUN writes to PERF_CAPABILITIES
  KVM: selftests: Drop "all done!" printf() from PERF_CAPABILITIES test
  KVM: selftests: Refactor LBR_FMT test to avoid use of separate macro
  KVM: selftests: Add negative testcase for PEBS format in
    PERF_CAPABILITIES
  KVM: selftests: Verify LBRs are disabled if vPMU is disabled

 arch/x86/kvm/cpuid.c                          |   2 +-
 arch/x86/kvm/mmu/mmu.c                        |   2 +-
 arch/x86/kvm/pmu.c                            |   3 +
 arch/x86/kvm/svm/svm.c                        |   2 +-
 arch/x86/kvm/vmx/pmu_intel.c                  |  10 +
 arch/x86/kvm/vmx/vmx.c                        |   8 +-
 arch/x86/kvm/x86.c                            | 102 ++++---
 arch/x86/kvm/x86.h                            |  13 +
 .../selftests/kvm/include/x86_64/processor.h  |  41 ++-
 .../selftests/kvm/x86_64/vmx_pmu_caps_test.c  | 248 ++++++++++++++----
 10 files changed, 341 insertions(+), 90 deletions(-)


base-commit: 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b
  

On Fri, 10 Mar 2023 16:45:57 -0800, Sean Christopherson wrote:
> Give feature MSRs that same treatment as CPUID and disallow changing said
> MSRs after KVM_RUN.  Fix a tangentially related bug in the vPMU where KVM
> leaves the vLBRs enabled after userspace disables the guest's entire vPMU.
> 
> The bulk of this series is a rework of the vmx_pmu_caps_test, a.k.a.
> the PERF_CAPABILITIES selftests, to expand its coverage.  In addition to
> verifying that KVM rejects changes after KVM_RUN, verify other bits beyond
> full-width writes and the LBR format.
> 
> [...]

Applied to kvm-x86 pmu, thanks!

[01/21] KVM: x86: Rename kvm_init_msr_list() to clarify it inits multiple lists
        https://github.com/kvm-x86/linux/commit/b1932c5c19dd
[02/21] KVM: x86: Add a helper to query whether or not a vCPU has ever run
        https://github.com/kvm-x86/linux/commit/fb3146b4dc3b
[03/21] KVM: x86: Add macros to track first...last VMX feature MSRs
        https://github.com/kvm-x86/linux/commit/5757f5b95622
[04/21] KVM: x86: Generate set of VMX feature MSRs using first/last definitions
        https://github.com/kvm-x86/linux/commit/9eb6ba31db27
[05/21] KVM: selftests: Split PMU caps sub-tests to avoid writing MSR after KVM_RUN
        https://github.com/kvm-x86/linux/commit/e4d86fb910df
[06/21] KVM: x86: Disallow writes to immutable feature MSRs after KVM_RUN
        https://github.com/kvm-x86/linux/commit/0094f62c7eaa
[07/21] KVM: x86/pmu: WARN and bug the VM if PMU is refreshed after vCPU has run
        https://github.com/kvm-x86/linux/commit/3a6de51a437f
[08/21] KVM: x86/pmu: Zero out LBR capabilities during PMU refresh
        https://github.com/kvm-x86/linux/commit/957d0f70e97b
[09/21] KVM: selftests: Move 0/initial value PERF_CAPS checks to dedicated sub-test
        https://github.com/kvm-x86/linux/commit/710fb612672e
[10/21] KVM: selftests: Assert that full-width PMC writes are supported if PDCM=1
        https://github.com/kvm-x86/linux/commit/b1b705627cb3
[11/21] KVM: selftests: Print out failing MSR and value in vcpu_set_msr()
        https://github.com/kvm-x86/linux/commit/22234c2495ea
[12/21] KVM: selftests: Verify KVM preserves userspace writes to "durable" MSRs
        https://github.com/kvm-x86/linux/commit/f138258565d1
[13/21] KVM: selftests: Drop now-redundant checks on PERF_CAPABILITIES writes
        https://github.com/kvm-x86/linux/commit/69713940d2b4
[14/21] KVM: selftests: Test all fungible features in PERF_CAPABILITIES
        https://github.com/kvm-x86/linux/commit/37f4e79c43e5
[15/21] KVM: selftests: Test all immutable non-format bits in PERF_CAPABILITIES
        https://github.com/kvm-x86/linux/commit/a2a34d148e75
[16/21] KVM: selftests: Expand negative testing of guest writes to PERF_CAPABILITIES
        https://github.com/kvm-x86/linux/commit/baa36dac6ca8
[17/21] KVM: selftests: Test post-KVM_RUN writes to PERF_CAPABILITIES
        https://github.com/kvm-x86/linux/commit/81fd92411264
[18/21] KVM: selftests: Drop "all done!" printf() from PERF_CAPABILITIES test
        https://github.com/kvm-x86/linux/commit/bc7bb0082960
[19/21] KVM: selftests: Refactor LBR_FMT test to avoid use of separate macro
        https://github.com/kvm-x86/linux/commit/8ac2f774b9ea
[20/21] KVM: selftests: Add negative testcase for PEBS format in PERF_CAPABILITIES
        https://github.com/kvm-x86/linux/commit/8b95b4155523
[21/21] KVM: selftests: Verify LBRs are disabled if vPMU is disabled
        https://github.com/kvm-x86/linux/commit/d8f992e9fde8

--
https://github.com/kvm-x86/linux/tree/next
https://github.com/kvm-x86/linux/tree/fixes