[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <04e4c088-46f9-41fe-a681-cf494bdbdb03@zytor.com>
Date: Fri, 30 May 2025 16:38:23 -0700
From: Xin Li <xin@...or.com>
To: Sean Christopherson <seanjc@...gle.com>,
Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
Borislav Petkov <bp@...en8.de>, Chao Gao <chao.gao@...el.com>,
Dapeng Mi <dapeng1.mi@...ux.intel.com>
Subject: Re: [PATCH 16/28] KVM: VMX: Manually recalc all MSR intercepts on
userspace MSR filter change
On 5/29/2025 4:40 PM, Sean Christopherson wrote:
> On a userspace MSR filter change, recalculate all MSR intercepts using the
> filter-agnostic logic instead of maintaining a "shadow copy" of KVM's
> desired intercepts. The shadow bitmaps add yet another point of failure,
> are confusing (e.g. what does "handled specially" mean!?!?), an eyesore,
> and a maintenance burden.
>
> Given that KVM *must* be able to recalculate the correct intercepts at any
> given time, and that MSR filter updates are not hot paths, there is zero
> benefit to maintaining the shadow bitmaps.
+1
To me, this patch does simplify the logic by removing the bitmap state
management.
Just one very minor comment below — other than that:
Reviewed-by: Xin Li (Intel) <xin@...or.com>
> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index 8f7fe04a1998..6ffa2b2b85ce 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -4159,35 +4074,59 @@ void pt_update_intercept_for_msr(struct kvm_vcpu *vcpu)
> }
> }
>
> -void vmx_msr_filter_changed(struct kvm_vcpu *vcpu)
> +static void vmx_recalc_msr_intercepts(struct kvm_vcpu *vcpu)
> {
> - struct vcpu_vmx *vmx = to_vmx(vcpu);
> - u32 i;
> -
> if (!cpu_has_vmx_msr_bitmap())
> return;
>
> - /*
> - * Redo intercept permissions for MSRs that KVM is passing through to
> - * the guest. Disabling interception will check the new MSR filter and
> - * ensure that KVM enables interception if usersepace wants to filter
> - * the MSR. MSRs that KVM is already intercepting don't need to be
> - * refreshed since KVM is going to intercept them regardless of what
> - * userspace wants.
> - */
> - for (i = 0; i < ARRAY_SIZE(vmx_possible_passthrough_msrs); i++) {
> - u32 msr = vmx_possible_passthrough_msrs[i];
> -
> - if (!test_bit(i, vmx->shadow_msr_intercept.read))
> - vmx_disable_intercept_for_msr(vcpu, msr, MSR_TYPE_R);
> -
> - if (!test_bit(i, vmx->shadow_msr_intercept.write))
> - vmx_disable_intercept_for_msr(vcpu, msr, MSR_TYPE_W);
> + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_TSC, MSR_TYPE_R);
> +#ifdef CONFIG_X86_64
> + vmx_disable_intercept_for_msr(vcpu, MSR_FS_BASE, MSR_TYPE_RW);
> + vmx_disable_intercept_for_msr(vcpu, MSR_GS_BASE, MSR_TYPE_RW);
> + vmx_disable_intercept_for_msr(vcpu, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
> +#endif
> + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);
> + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);
> + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);
> + if (kvm_cstate_in_guest(vcpu->kvm)) {
> + vmx_disable_intercept_for_msr(vcpu, MSR_CORE_C1_RES, MSR_TYPE_R);
> + vmx_disable_intercept_for_msr(vcpu, MSR_CORE_C3_RESIDENCY, MSR_TYPE_R);
> + vmx_disable_intercept_for_msr(vcpu, MSR_CORE_C6_RESIDENCY, MSR_TYPE_R);
> + vmx_disable_intercept_for_msr(vcpu, MSR_CORE_C7_RESIDENCY, MSR_TYPE_R);
> }
>
> /* PT MSRs can be passed through iff PT is exposed to the guest. */
> if (vmx_pt_mode_is_host_guest())
> pt_update_intercept_for_msr(vcpu);
> +
> + if (vcpu->arch.xfd_no_write_intercept)
> + vmx_disable_intercept_for_msr(vcpu, MSR_IA32_XFD, MSR_TYPE_RW);
> +
> +
> + vmx_set_intercept_for_msr(vcpu, MSR_IA32_SPEC_CTRL, MSR_TYPE_RW,
> + !to_vmx(vcpu)->spec_ctrl);
> +
> + if (kvm_cpu_cap_has(X86_FEATURE_XFD))
> + vmx_set_intercept_for_msr(vcpu, MSR_IA32_XFD_ERR, MSR_TYPE_R,
> + !guest_cpu_cap_has(vcpu, X86_FEATURE_XFD));
> +
> + if (boot_cpu_has(X86_FEATURE_IBPB))
I think Boris prefers using cpu_feature_enabled() instead — maybe this
is a good opportunity to update this occurrence?
> + vmx_set_intercept_for_msr(vcpu, MSR_IA32_PRED_CMD, MSR_TYPE_W,
> + !guest_has_pred_cmd_msr(vcpu));
> +
> + if (boot_cpu_has(X86_FEATURE_FLUSH_L1D))
Ditto.
> + vmx_set_intercept_for_msr(vcpu, MSR_IA32_FLUSH_CMD, MSR_TYPE_W,
> + !guest_cpu_cap_has(vcpu, X86_FEATURE_FLUSH_L1D));
> +
> + /*
> + * x2APIC and LBR MSR intercepts are modified on-demand and cannot be
> + * filtered by userspace.
> + */
> +}
Powered by blists - more mailing lists