From patchwork Wed Feb 7 17:26:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Li, Xin3" X-Patchwork-Id: 198007 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:168b:b0:106:860b:bbdd with SMTP id ma11csp2408915dyb; Wed, 7 Feb 2024 10:05:56 -0800 (PST) X-Google-Smtp-Source: AGHT+IF3eFcPRsU6upQM3m84+XjmSIcZgKshIJcc+paTvC8lh/buvUhPa8dAWCy0a/M6PutJnvNz X-Received: by 2002:a17:902:784b:b0:1d8:e4b8:95d6 with SMTP id e11-20020a170902784b00b001d8e4b895d6mr5282258pln.27.1707329156562; Wed, 07 Feb 2024 10:05:56 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1707329156; cv=pass; d=google.com; s=arc-20160816; b=uC2bg0xBRApcMLtLMrJepp2xIgrtnJy3cjPDtyDOZXfaY/MnJtOtplec3R1top+7D1 zHtdhv0PJmw9+kzOyiOzSDMVEj3GiSZzVhyT1s9jNVwf59juo3l8rWaemTlaK8cKAXJ3 8CpRxobQK7VzyCaTzEA0NjQ0M4FoVYK2TihClhxFJdSQl+W9CNKtICqOTpzWLztS4Tyn QZtunM0pf52oY+YAHxuSNuGesXfjwQWC58fawtQ5doZoIeRiXgioNsDlbnECK8BI6CeM 1c3gRsw8i7VB0jCcZlx7WFu5nM1MYIteBtLvNTZ2pxYKIWU35i79vR0NdthJ8iJOUGe+ U+HQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=1F1eNWARokUbL3JeiwOUE71HFFjHzQX8Pp+rK4ef1dY=; fh=E6151iY6cQUqE4oJft80zhcA3FQdZ1813jqVoTayG3s=; b=tsCf8QZZln0oNzIQzl02TyFEeJJ1yXjH7Vix4DRUwK5VRekb9rTkZEa0zNBK0nf8vl +U4wwKBNoAOhcfSPVXv9jyDqk8G5oEdEtK1KkUWTRfTh0Xx0Oi/2qXkEikS74bewnPT6 HNbDOwIpsK4xBtjULTUTMn0L2RYgO5rhi0SnuT2g/wG0LAuw1NCeHwIvLbr/YuCLo9XS DdmVz/my6DY0pqGwyRJ++0/X99gwiTUtT7g9s65NuULy+TY6xSgDz5aofYfB4qQA9lBQ sm/ixo6awAfGkObc8T9XQlqxemAT5PdwvIJjQ+wywRopadEA6hbIWr00LWq7iwm7GzQW 4Hdw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=jHLPd4gT; arc=pass (i=1 spf=pass spfdomain=intel.com dkim=pass dkdomain=intel.com dmarc=pass fromdomain=intel.com); spf=pass (google.com: domain of linux-kernel+bounces-56865-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-56865-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Forwarded-Encrypted: i=2; AJvYcCVUbyK46Y/XPmQ2+JptfEC/JYrxf1EBA7m8yH1ci5qV3dfVWXVuMVaDQhv55KKw8C61uGKVr0e+W/mIzW+wVhRA65RE6g== Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [2604:1380:45e3:2400::1]) by mx.google.com with ESMTPS id o19-20020a170902e29300b001d9bd98670asi1990716plc.424.2024.02.07.10.05.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Feb 2024 10:05:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-56865-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=jHLPd4gT; arc=pass (i=1 spf=pass spfdomain=intel.com dkim=pass dkdomain=intel.com dmarc=pass fromdomain=intel.com); spf=pass (google.com: domain of linux-kernel+bounces-56865-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-56865-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 2DC392855C3 for ; Wed, 7 Feb 2024 18:05:32 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 255261339A9; Wed, 7 Feb 2024 17:59:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="jHLPd4gT" Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 503D3126F0C; Wed, 7 Feb 2024 17:59:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707328754; cv=none; b=R/bnNnR9Ee3d8B2RXxnC+CtOWIj8jxBtERd6vpJ6Uc8D8fkA/PFEZqi6VDnNly6q2sx78xmjjor2SEOXjQwc6z1oegmOZY8YNRI/eUzI2hMNEngV2ApvbbszA3KrmDfq3ELe0sJgRSgIFyvmowICoAJDR95Xmg1oxZprS0vMmzg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707328754; c=relaxed/simple; bh=CuYDQvdxxw4eRy/EkzJIG8807riNAmdDprp/aAi8Qi0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kqNCnz79aPUsDELIkldNr/2E6aQ6Qgzk3r50U+o/66a0ZwzJzntWEtaOAWLH5Uf644iDePtNANXJR+Sz80rzRBkoglGR3lxTpNfka13RnkRDrNJKZsf/QNETUINlWdk/fi6nbNfMNgRujTS9RVyFouDC4KywtMNOTeWd37O+xWI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=jHLPd4gT; arc=none smtp.client-ip=198.175.65.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1707328749; x=1738864749; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=CuYDQvdxxw4eRy/EkzJIG8807riNAmdDprp/aAi8Qi0=; b=jHLPd4gTh0gbi6tqn1Bi/w/hoP1dHqusk7cmgPPGsQO6URHH7kRTxLve B0uEnS3XxHTZRRUWixwBR+0NB1TMq4tDHr3KE1gHA3xGnYbyrpEF92j/M Q43mJFZJXAptvO7k4jD066tKE7DecqWVicQZhNAqg0RhCQchb93DpAs7m gyE5DOWeGaMwOYIhaTziBuQB97+yQo/fBRB4UtDzFtNT+NpbY+oLGcjgj rn3FqQ580A+F01dtYTSWK6fhPEQHksBZ9dHXOQsbCNSQZXC/71xBEKfOD lNhc0uYo3uaeA/20yPUUudb3Cz/cUX7DwPur2EA+NQt9nWNrDgdza4iqO Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10977"; a="11622562" X-IronPort-AV: E=Sophos;i="6.05,251,1701158400"; d="scan'208";a="11622562" Received: from fmviesa004.fm.intel.com ([10.60.135.144]) by orvoesa103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Feb 2024 09:58:56 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.05,251,1701158400"; d="scan'208";a="6020724" Received: from unknown (HELO fred..) ([172.25.112.68]) by fmviesa004.fm.intel.com with ESMTP; 07 Feb 2024 09:58:55 -0800 From: Xin Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org Cc: seanjc@google.com, pbonzini@redhat.com, corbet@lwn.net, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, shuah@kernel.org, vkuznets@redhat.com, peterz@infradead.org, ravi.v.shankar@intel.com, xin@zytor.com Subject: [PATCH v2 10/25] KVM: VMX: Add support for FRED context save/restore Date: Wed, 7 Feb 2024 09:26:30 -0800 Message-ID: <20240207172646.3981-11-xin3.li@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240207172646.3981-1-xin3.li@intel.com> References: <20240207172646.3981-1-xin3.li@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1790264377308232961 X-GMAIL-MSGID: 1790264377308232961 Handle host initiated FRED MSR access requests to allow FRED context to be set/get from user level. During VM save/restore and live migration, FRED context needs to be saved/restored, which requires FRED MSRs to be accessed from a user level application, e.g., Qemu. Note, handling of MSR_IA32_FRED_SSP0, i.e., MSR_IA32_PL0_SSP, is not added yet, which is done in the KVM CET patch set. Signed-off-by: Xin Li Tested-by: Shan Kang --- Changes since v1: * Use kvm_cpu_cap_has() instead of cpu_feature_enabled() (Chao Gao). * Fail host requested FRED MSRs access if KVM cannot virtualize FRED (Chao Gao). * Handle the case FRED MSRs are valid but KVM cannot virtualize FRED (Chao Gao). * Add sanity checks when writing to FRED MSRs. --- arch/x86/kvm/vmx/vmx.c | 72 ++++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/x86.c | 47 +++++++++++++++++++++++++++ 2 files changed, 119 insertions(+) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 264378c3b784..ee61d2c25cb0 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -1420,6 +1420,24 @@ static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data) preempt_enable(); vmx->msr_guest_kernel_gs_base = data; } + +static u64 vmx_read_guest_fred_rsp0(struct vcpu_vmx *vmx) +{ + preempt_disable(); + if (vmx->guest_state_loaded) + vmx->msr_guest_fred_rsp0 = read_msr(MSR_IA32_FRED_RSP0); + preempt_enable(); + return vmx->msr_guest_fred_rsp0; +} + +static void vmx_write_guest_fred_rsp0(struct vcpu_vmx *vmx, u64 data) +{ + preempt_disable(); + if (vmx->guest_state_loaded) + wrmsrl(MSR_IA32_FRED_RSP0, data); + preempt_enable(); + vmx->msr_guest_fred_rsp0 = data; +} #endif void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu, @@ -2019,6 +2037,33 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) case MSR_KERNEL_GS_BASE: msr_info->data = vmx_read_guest_kernel_gs_base(vmx); break; + case MSR_IA32_FRED_RSP0: + msr_info->data = vmx_read_guest_fred_rsp0(vmx); + break; + case MSR_IA32_FRED_RSP1: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_RSP1); + break; + case MSR_IA32_FRED_RSP2: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_RSP2); + break; + case MSR_IA32_FRED_RSP3: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_RSP3); + break; + case MSR_IA32_FRED_STKLVLS: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_STKLVLS); + break; + case MSR_IA32_FRED_SSP1: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_SSP1); + break; + case MSR_IA32_FRED_SSP2: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_SSP2); + break; + case MSR_IA32_FRED_SSP3: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_SSP3); + break; + case MSR_IA32_FRED_CONFIG: + msr_info->data = vmcs_read64(GUEST_IA32_FRED_CONFIG); + break; #endif case MSR_EFER: return kvm_get_msr_common(vcpu, msr_info); @@ -2226,6 +2271,33 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) vmx_update_exception_bitmap(vcpu); } break; + case MSR_IA32_FRED_RSP0: + vmx_write_guest_fred_rsp0(vmx, data); + break; + case MSR_IA32_FRED_RSP1: + vmcs_write64(GUEST_IA32_FRED_RSP1, data); + break; + case MSR_IA32_FRED_RSP2: + vmcs_write64(GUEST_IA32_FRED_RSP2, data); + break; + case MSR_IA32_FRED_RSP3: + vmcs_write64(GUEST_IA32_FRED_RSP3, data); + break; + case MSR_IA32_FRED_STKLVLS: + vmcs_write64(GUEST_IA32_FRED_STKLVLS, data); + break; + case MSR_IA32_FRED_SSP1: + vmcs_write64(GUEST_IA32_FRED_SSP1, data); + break; + case MSR_IA32_FRED_SSP2: + vmcs_write64(GUEST_IA32_FRED_SSP2, data); + break; + case MSR_IA32_FRED_SSP3: + vmcs_write64(GUEST_IA32_FRED_SSP3, data); + break; + case MSR_IA32_FRED_CONFIG: + vmcs_write64(GUEST_IA32_FRED_CONFIG, data); + break; #endif case MSR_IA32_SYSENTER_CS: if (is_guest_mode(vcpu)) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 363b1c080205..4e8d60f248e3 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1451,6 +1451,9 @@ static const u32 msrs_to_save_base[] = { MSR_STAR, #ifdef CONFIG_X86_64 MSR_CSTAR, MSR_KERNEL_GS_BASE, MSR_SYSCALL_MASK, MSR_LSTAR, + MSR_IA32_FRED_RSP0, MSR_IA32_FRED_RSP1, MSR_IA32_FRED_RSP2, + MSR_IA32_FRED_RSP3, MSR_IA32_FRED_STKLVLS, MSR_IA32_FRED_SSP1, + MSR_IA32_FRED_SSP2, MSR_IA32_FRED_SSP3, MSR_IA32_FRED_CONFIG, #endif MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA, MSR_IA32_FEAT_CTL, MSR_IA32_BNDCFGS, MSR_TSC_AUX, @@ -1892,6 +1895,30 @@ static int __kvm_set_msr(struct kvm_vcpu *vcpu, u32 index, u64 data, return 1; data = (u32)data; + break; + case MSR_IA32_FRED_RSP0 ... MSR_IA32_FRED_CONFIG: + if (index != MSR_IA32_FRED_STKLVLS && is_noncanonical_address(data, vcpu)) + return 1; + if ((index >= MSR_IA32_FRED_RSP0 && index <= MSR_IA32_FRED_RSP3) && + (data & GENMASK_ULL(5, 0))) + return 1; + if ((index >= MSR_IA32_FRED_SSP1 && index <= MSR_IA32_FRED_SSP3) && + (data & GENMASK_ULL(2, 0))) + return 1; + + if (host_initiated) { + if (!kvm_cpu_cap_has(X86_FEATURE_FRED)) + return 1; + } else { + /* + * Inject #GP upon FRED MSRs accesses from a non-FRED guest, + * which also ensures no malicious guest can write to FRED + * MSRs to corrupt host FRED MSRs. + */ + if (!guest_can_use(vcpu, X86_FEATURE_FRED)) + return 1; + } + break; } @@ -1936,6 +1963,22 @@ int __kvm_get_msr(struct kvm_vcpu *vcpu, u32 index, u64 *data, !guest_cpuid_has(vcpu, X86_FEATURE_RDPID)) return 1; break; + case MSR_IA32_FRED_RSP0 ... MSR_IA32_FRED_CONFIG: + if (host_initiated) { + if (!kvm_cpu_cap_has(X86_FEATURE_FRED)) + return 1; + } else { + /* + * Inject #GP upon FRED MSRs accesses from a non-FRED guest, + * which also ensures no malicious guest can write to FRED + * MSRs to corrupt host FRED MSRs. + */ + if (!guest_can_use(vcpu, X86_FEATURE_FRED)) + return 1; + } + + break; + } msr.index = index; @@ -7364,6 +7407,10 @@ static void kvm_probe_msr_to_save(u32 msr_index) if (!(kvm_get_arch_capabilities() & ARCH_CAP_TSX_CTRL_MSR)) return; break; + case MSR_IA32_FRED_RSP0 ... MSR_IA32_FRED_CONFIG: + if (!kvm_cpu_cap_has(X86_FEATURE_FRED)) + return; + break; default: break; }