From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jim Mattson <jmattson@google.com>
Subject: Re: [PATCH 2/3 v2] kvm: x86: Guest BNDCFGS requires guest MPX support
Date: Wed, 24 May 2017 10:40:42 -0700
Message-ID: <CALMp9eS75=7Os7HLShhSUNPRtK25in6LWzwJ7JhS3RQDR16UAA@mail.gmail.com>
References: <201705242033.SXodRpgH%fengguang.wu@intel.com> <20170524162255.183206-1-jmattson@google.com>
 <20170524172759.GC8174@potion>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: kvm list <kvm@vger.kernel.org>
To: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrcmar@redhat.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mail-wm0-f53.google.com ([74.125.82.53]:36691 "EHLO
        mail-wm0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753880AbdEXRko (ORCPT <rfc822;kvm@vger.kernel.org>);
        Wed, 24 May 2017 13:40:44 -0400
Received: by mail-wm0-f53.google.com with SMTP id 7so70722510wmo.1
        for <kvm@vger.kernel.org>; Wed, 24 May 2017 10:40:44 -0700 (PDT)
In-Reply-To: <20170524172759.GC8174@potion>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On Wed, May 24, 2017 at 10:28 AM, Radim Kr=C4=8Dm=C3=A1=C5=99 <rkrcmar@redh=
at.com> wrote:
> 2017-05-24 09:22-0700, Jim Mattson:
>> The BNDCFGS MSR should only be exposed to the guest if the guest
>> supports MPX. (cf. the TSC_AUX MSR and RDTSCP.)
>>
>> Fixes: 0dd376e709975779 ("KVM: x86: add MSR_IA32_BNDCFGS to msrs_to_save=
")
>> Change-Id: I3ad7c01bda616715137ceac878f3fa7e66b6b387
>> Signed-off-by: Jim Mattson <jmattson@google.com>
>> ---
>> diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
>> @@ -144,6 +144,14 @@ static inline bool guest_cpuid_has_rtm(struct kvm_v=
cpu *vcpu)
>>       return best && (best->ebx & bit(X86_FEATURE_RTM));
>>  }
>>
>> +static inline bool guest_cpuid_has_mpx(struct kvm_vcpu *vcpu)
>> +{
>> +     struct kvm_cpuid_entry2 *best;
>> +
>> +     best =3D kvm_find_cpuid_entry(vcpu, 7, 0);
>> +     return best && (best->ebx & bit(X86_FEATURE_MPX));
>> +}
>> +
>>  static inline bool guest_cpuid_has_rdtscp(struct kvm_vcpu *vcpu)
>>  {
>>       struct kvm_cpuid_entry2 *best;
>> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
>> @@ -3195,7 +3195,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, stru=
ct msr_data *msr_info)
>>               msr_info->data =3D vmcs_readl(GUEST_SYSENTER_ESP);
>>               break;
>>       case MSR_IA32_BNDCFGS:
>> -             if (!kvm_mpx_supported())
>> +             if (!guest_cpuid_has_mpx(vcpu))
>>                       return 1;
>>               msr_info->data =3D vmcs_read64(GUEST_BNDCFGS);
>
> Userspace can force guest_cpuid_has_mpx() to return true even if the
> host does not have MPX (GUEST_BNDCFGS in VMCS), which would allow it to
> trigger vmread/vmwrite errors at will.

Oops. I had wrongly assumed that the guest cpuid settings were validated.

> I think it would make most sense to fail KVM_SET_CPUID that tries to do
> that, but checking for host support or silently clearing the bit still
> seem better than the host error.

Guest cpuid settings should be validated, but I'm not going to bite
that off now. Let me just do both checks.