KVM: x86: Give host userspace full control of MSR_IA32_MISC_ENABLES

Give userspace full control of the read-only bits in MISC_ENABLES, i.e.
do not modify bits on PMU refresh and do not preserve existing bits when
userspace writes MISC_ENABLES.  With a few exceptions where KVM doesn't
expose the necessary controls to userspace _and_ there is a clear cut
association with CPUID, e.g. reserved CR4 bits, KVM does not own the vCPU
and should not manipulate the vCPU model on behalf of "dummy user space".

The argument that KVM is doing userspace a favor because "the order of
setting vPMU capabilities and MSR_IA32_MISC_ENABLE is not strictly
guaranteed" is specious, as attempting to configure MSRs on behalf of
userspace inevitably leads to edge cases precisely because KVM does not
prescribe a specific order of initialization.

Example #1: intel_pmu_refresh() consumes and modifies the vCPU's
MSR_IA32_PERF_CAPABILITIES, and so assumes userspace initializes config
MSRs before setting the guest CPUID model.  If userspace sets CPUID
first, then KVM will mark PEBS as available when arch.perf_capabilities
is initialized with a non-zero PEBS format, thus creating a bad vCPU
model if userspace later disables PEBS by writing PERF_CAPABILITIES.

Example #2: intel_pmu_refresh() does not clear PERF_CAP_PEBS_MASK in
MSR_IA32_PERF_CAPABILITIES if there is no vPMU, making KVM inconsistent
in its desire to be consistent.

Example #3: intel_pmu_refresh() does not clear MSR_IA32_MISC_ENABLE_EMON
if KVM_SET_CPUID2 is called multiple times, first with a vPMU, then
without a vPMU.  While slightly contrived, it's plausible a VMM could
reflect KVM's default vCPU and then operate on KVM's copy of CPUID to
later clear the vPMU settings, e.g. see KVM's selftests.

Example #4: Enumerating an Intel vCPU on an AMD host will not call into
intel_pmu_refresh() at any point, and so the BTS and PEBS "unavailable"
bits will be left clear, without any way for userspace to set them.

Keep the "R" behavior of the bit 7, "EMON available", for the guest.
Unlike the BTS and PEBS bits, which are fully "RO", the EMON bit can be
written with a different value, but that new value is ignored.

Cc: Like Xu <likexu@tencent.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
Message-Id: <20220611005755.753273-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
index 422f0a6562ac4e4259c423eb34c1084ba5511aa8..3b324ce0b14271605d66f9235478c88bfbd0fc88 100644 (file)
--- a/arch/x86/kvm/vmx/pmu_intel.c
+++ b/arch/x86/kvm/vmx/pmu_intel.c
@@ -536,8 +536,6 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
        pmu->pebs_enable_mask = ~0ull;
        pmu->pebs_data_cfg_mask = ~0ull;
 
-       vcpu->arch.ia32_misc_enable_msr |= MSR_IA32_MISC_ENABLE_PMU_RO_MASK;
-
        entry = kvm_find_cpuid_entry(vcpu, 0xa, 0);
        if (!entry || !vcpu->kvm->arch.enable_pmu)
                return;
@@ -548,8 +546,6 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
        if (!pmu->version)
                return;
 
-       vcpu->arch.ia32_misc_enable_msr |= MSR_IA32_MISC_ENABLE_EMON;
-
        pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters,
                                         kvm_pmu_cap.num_counters_gp);
        eax.split.bit_width = min_t(int, eax.split.bit_width,
@@ -611,7 +607,6 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
                bitmap_set(pmu->all_valid_pmc_idx, INTEL_PMC_IDX_FIXED_VLBR, 1);
 
        if (vcpu->arch.perf_capabilities & PERF_CAP_PEBS_FORMAT) {
-               vcpu->arch.ia32_misc_enable_msr &= ~MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL;
                if (vcpu->arch.perf_capabilities & PERF_CAP_PEBS_BASELINE) {
                        pmu->pebs_enable_mask = counter_mask;
                        pmu->reserved_bits &= ~ICL_EVENTSEL_ADAPTIVE;

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 00e23dc518e091ac7c5e24a4bd3c93b24b9bbb2f..67bdd7e20534d9d6a76aadc0e3d7d60b8b502777 100644 (file)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3550,21 +3550,17 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                break;
        case MSR_IA32_MISC_ENABLE: {
                u64 old_val = vcpu->arch.ia32_misc_enable_msr;
-               u64 pmu_mask = MSR_IA32_MISC_ENABLE_PMU_RO_MASK |
-                       MSR_IA32_MISC_ENABLE_EMON;
 
-               /* RO bits */
-               if (!msr_info->host_initiated &&
-                   ((old_val ^ data) & MSR_IA32_MISC_ENABLE_PMU_RO_MASK))
-                       return 1;
+               if (!msr_info->host_initiated) {
+                       /* RO bits */
+                       if ((old_val ^ data) & MSR_IA32_MISC_ENABLE_PMU_RO_MASK)
+                               return 1;
+
+                       /* R bits, i.e. writes are ignored, but don't fault. */
+                       data = data & ~MSR_IA32_MISC_ENABLE_EMON;
+                       data |= old_val & MSR_IA32_MISC_ENABLE_EMON;
+               }
 
-               /*
-                * For a dummy user space, the order of setting vPMU capabilities and
-                * initialising MSR_IA32_MISC_ENABLE is not strictly guaranteed, so to
-                * avoid inconsistent functionality we keep the vPMU bits unchanged here.
-                */
-               data &= ~pmu_mask;
-               data |= old_val & pmu_mask;
                if (!kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT) &&
                    ((old_val ^ data)  & MSR_IA32_MISC_ENABLE_MWAIT)) {
                        if (!guest_cpuid_has(vcpu, X86_FEATURE_XMM3))
@@ -11573,6 +11569,8 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
                vcpu->arch.smbase = 0x30000;
 
                vcpu->arch.msr_misc_features_enables = 0;
+               vcpu->arch.ia32_misc_enable_msr = MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL |
+                                                 MSR_IA32_MISC_ENABLE_BTS_UNAVAIL;
 
                __kvm_set_xcr(vcpu, 0, XFEATURE_MASK_FP);
                __kvm_set_msr(vcpu, MSR_IA32_XSS, 0, true);