Messages in this thread | | | Subject | Re: [PATCH 2/2] kvm/x86: don't expose MSR_IA32_UMWAIT_CONTROL unconditionally | From | Xiaoyao Li <> | Date | Thu, 21 May 2020 16:03:07 +0800 |
| |
On 5/21/2020 12:56 AM, Maxim Levitsky wrote: > On Wed, 2020-05-20 at 18:33 +0200, Vitaly Kuznetsov wrote: >> Maxim Levitsky <mlevitsk@redhat.com> writes: >> >>> This msr is only available when the host supports WAITPKG feature. >>> >>> This breaks a nested guest, if the L1 hypervisor is set to ignore >>> unknown msrs, because the only other safety check that the >>> kernel does is that it attempts to read the msr and >>> rejects it if it gets an exception. >>> >>> Fixes: 6e3ba4abce KVM: vmx: Emulate MSR IA32_UMWAIT_CONTROL >>> >>> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> >>> --- >>> arch/x86/kvm/x86.c | 4 ++++ >>> 1 file changed, 4 insertions(+) >>> >>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c >>> index fe3a24fd6b263..9c507b32b1b77 100644 >>> --- a/arch/x86/kvm/x86.c >>> +++ b/arch/x86/kvm/x86.c >>> @@ -5314,6 +5314,10 @@ static void kvm_init_msr_list(void) >>> if (msrs_to_save_all[i] - MSR_ARCH_PERFMON_EVENTSEL0 >= >>> min(INTEL_PMC_MAX_GENERIC, x86_pmu.num_counters_gp)) >>> continue; >>> + break; >>> + case MSR_IA32_UMWAIT_CONTROL: >>> + if (!kvm_cpu_cap_has(X86_FEATURE_WAITPKG)) >>> + continue; >> >> I'm probably missing something but (if I understand correctly) the only >> effect of dropping MSR_IA32_UMWAIT_CONTROL from msrs_to_save would be >> that KVM userspace won't see it in e.g. KVM_GET_MSR_INDEX_LIST. But why >> is this causing an issue? I see both vmx_get_msr()/vmx_set_msr() have >> 'host_initiated' check: >> >> case MSR_IA32_UMWAIT_CONTROL: >> if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx)) >> return 1; > > Here it fails like that: > > 1. KVM_GET_MSR_INDEX_LIST returns this msrs, and qemu notes that > it is supported in 'has_msr_umwait' global var
In general, KVM_GET_MSR_INDEX_LIST won't return MSR_IA32_UMWAIT_CONTROL if KVM cannot read this MSR, see kvm_init_msr_list().
You hit issue because you used "ignore_msrs".
| |