Commit ac8d6cad authored by Hou Wenlong's avatar Hou Wenlong Committed by Paolo Bonzini
Browse files

KVM: x86: Only do MSR filtering when access MSR by rdmsr/wrmsr 



If MSR access is rejected by MSR filtering,
kvm_set_msr()/kvm_get_msr() would return KVM_MSR_RET_FILTERED,
and the return value is only handled well for rdmsr/wrmsr.
However, some instruction emulation and state transition also
use kvm_set_msr()/kvm_get_msr() to do msr access but may trigger
some unexpected results if MSR access is rejected, E.g. RDPID
emulation would inject a #UD but RDPID wouldn't cause a exit
when RDPID is supported in hardware and ENABLE_RDTSCP is set.
And it would also cause failure when load MSR at nested entry/exit.
Since msr filtering is based on MSR bitmap, it is better to only
do MSR filtering for rdmsr/wrmsr.

Signed-off-by: default avatarHou Wenlong <houwenlong.hwl@antgroup.com>
Message-Id: <2b2774154f7532c96a6f04d71c82a8bec7d9e80b.1646655860.git.houwenlong.hwl@antgroup.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent a836839c

arch/x86/kvm/emulate.c

+2 −2
Original line number Diff line number Diff line
@@ -3625,7 +3625,7 @@ static int em_wrmsr(struct x86_emulate_ctxt *ctxt) 


	msr_data = (u32)reg_read(ctxt, VCPU_REGS_RAX)

		| ((u64)reg_read(ctxt, VCPU_REGS_RDX) << 32);

	r = ctxt->ops->set_msr(ctxt, msr_index, msr_data);

	r = ctxt->ops->set_msr_with_filter(ctxt, msr_index, msr_data);



	if (r == X86EMUL_IO_NEEDED)

		return r;
@@ -3642,7 +3642,7 @@ static int em_rdmsr(struct x86_emulate_ctxt *ctxt) 
	u64 msr_data;

	int r;



	r = ctxt->ops->get_msr(ctxt, msr_index, &msr_data);

	r = ctxt->ops->get_msr_with_filter(ctxt, msr_index, &msr_data);



	if (r == X86EMUL_IO_NEEDED)

		return r;

arch/x86/kvm/kvm_emulate.h

+2 −0
Original line number Diff line number Diff line
@@ -210,6 +210,8 @@ struct x86_emulate_ops { 
	int (*set_dr)(struct x86_emulate_ctxt *ctxt, int dr, ulong value);

	u64 (*get_smbase)(struct x86_emulate_ctxt *ctxt);

	void (*set_smbase)(struct x86_emulate_ctxt *ctxt, u64 smbase);

	int (*set_msr_with_filter)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 data);

	int (*get_msr_with_filter)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 *pdata);

	int (*set_msr)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 data);

	int (*get_msr)(struct x86_emulate_ctxt *ctxt, u32 msr_index, u64 *pdata);

	int (*check_pmc)(struct x86_emulate_ctxt *ctxt, u32 pmc);

arch/x86/kvm/x86.c

+36 −14
Original line number Diff line number Diff line
@@ -1748,9 +1748,6 @@ static int __kvm_set_msr(struct kvm_vcpu *vcpu, u32 index, u64 data, 
{

	struct msr_data msr;



	if (!host_initiated && !kvm_msr_allowed(vcpu, index, KVM_MSR_FILTER_WRITE))

		return KVM_MSR_RET_FILTERED;



	switch (index) {

	case MSR_FS_BASE:

	case MSR_GS_BASE:
@@ -1832,9 +1829,6 @@ int __kvm_get_msr(struct kvm_vcpu *vcpu, u32 index, u64 *data, 
	struct msr_data msr;

	int ret;



	if (!host_initiated && !kvm_msr_allowed(vcpu, index, KVM_MSR_FILTER_READ))

		return KVM_MSR_RET_FILTERED;



	switch (index) {

	case MSR_TSC_AUX:

		if (!kvm_is_supported_user_return_msr(MSR_TSC_AUX))
@@ -1871,6 +1865,20 @@ static int kvm_get_msr_ignored_check(struct kvm_vcpu *vcpu, 
	return ret;

}



static int kvm_get_msr_with_filter(struct kvm_vcpu *vcpu, u32 index, u64 *data)

{

	if (!kvm_msr_allowed(vcpu, index, KVM_MSR_FILTER_READ))

		return KVM_MSR_RET_FILTERED;

	return kvm_get_msr_ignored_check(vcpu, index, data, false);

}



static int kvm_set_msr_with_filter(struct kvm_vcpu *vcpu, u32 index, u64 data)

{

	if (!kvm_msr_allowed(vcpu, index, KVM_MSR_FILTER_WRITE))

		return KVM_MSR_RET_FILTERED;

	return kvm_set_msr_ignored_check(vcpu, index, data, false);

}



int kvm_get_msr(struct kvm_vcpu *vcpu, u32 index, u64 *data)

{

	return kvm_get_msr_ignored_check(vcpu, index, data, false);
@@ -1953,7 +1961,7 @@ int kvm_emulate_rdmsr(struct kvm_vcpu *vcpu) 
	u64 data;

	int r;



	r = kvm_get_msr(vcpu, ecx, &data);

	r = kvm_get_msr_with_filter(vcpu, ecx, &data);



	if (!r) {

		trace_kvm_msr_read(ecx, data);
@@ -1978,7 +1986,7 @@ int kvm_emulate_wrmsr(struct kvm_vcpu *vcpu) 
	u64 data = kvm_read_edx_eax(vcpu);

	int r;



	r = kvm_set_msr(vcpu, ecx, data);

	r = kvm_set_msr_with_filter(vcpu, ecx, data);



	if (!r) {

		trace_kvm_msr_write(ecx, data);
@@ -7631,13 +7639,13 @@ static void emulator_set_segment(struct x86_emulate_ctxt *ctxt, u16 selector, 
	return;

}



static int emulator_get_msr(struct x86_emulate_ctxt *ctxt,

static int emulator_get_msr_with_filter(struct x86_emulate_ctxt *ctxt,

					u32 msr_index, u64 *pdata)

{

	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);

	int r;



	r = kvm_get_msr(vcpu, msr_index, pdata);

	r = kvm_get_msr_with_filter(vcpu, msr_index, pdata);



	if (r && kvm_msr_user_space(vcpu, msr_index, KVM_EXIT_X86_RDMSR, 0,

				    complete_emulated_rdmsr, r)) {
@@ -7648,13 +7656,13 @@ static int emulator_get_msr(struct x86_emulate_ctxt *ctxt, 
	return r;

}



static int emulator_set_msr(struct x86_emulate_ctxt *ctxt,

static int emulator_set_msr_with_filter(struct x86_emulate_ctxt *ctxt,

					u32 msr_index, u64 data)

{

	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);

	int r;



	r = kvm_set_msr(vcpu, msr_index, data);

	r = kvm_set_msr_with_filter(vcpu, msr_index, data);



	if (r && kvm_msr_user_space(vcpu, msr_index, KVM_EXIT_X86_WRMSR, data,

				    complete_emulated_msr_access, r)) {
@@ -7665,6 +7673,18 @@ static int emulator_set_msr(struct x86_emulate_ctxt *ctxt, 
	return r;

}



static int emulator_get_msr(struct x86_emulate_ctxt *ctxt,

			    u32 msr_index, u64 *pdata)

{

	return kvm_get_msr(emul_to_vcpu(ctxt), msr_index, pdata);

}



static int emulator_set_msr(struct x86_emulate_ctxt *ctxt,

			    u32 msr_index, u64 data)

{

	return kvm_set_msr(emul_to_vcpu(ctxt), msr_index, data);

}



static u64 emulator_get_smbase(struct x86_emulate_ctxt *ctxt)

{

	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
@@ -7803,6 +7823,8 @@ static const struct x86_emulate_ops emulate_ops = { 
	.set_dr              = emulator_set_dr,

	.get_smbase          = emulator_get_smbase,

	.set_smbase          = emulator_set_smbase,

	.set_msr_with_filter = emulator_set_msr_with_filter,

	.get_msr_with_filter = emulator_get_msr_with_filter,

	.set_msr             = emulator_set_msr,

	.get_msr             = emulator_get_msr,

	.check_pmc	     = emulator_check_pmc,