Skip to content

kvm-ioctls: Add KVM_X86_SET_MSR_FILTER vm ioctl#359

Merged
roypat merged 3 commits intorust-vmm:mainfrom
ludfjig:set_msr_filter
Dec 2, 2025
Merged

kvm-ioctls: Add KVM_X86_SET_MSR_FILTER vm ioctl#359
roypat merged 3 commits intorust-vmm:mainfrom
ludfjig:set_msr_filter

Conversation

@ludfjig
Copy link
Copy Markdown
Contributor

@ludfjig ludfjig commented Oct 29, 2025 •
edited
Loading

Summary of the PR

Adds KVM_X86_SET_MSR_FILTER vm ioctl. This is my first contribution so I might be missing something, feedback greatly appreciated. I'm not sure whether there needs to be an actual test running vcpu that tries to read/write some MSR

Closes #358

Requirements

Before submitting your PR, please make sure you addressed the following
requirements:

  • All commits in this PR have Signed-Off-By trailers (with
    git commit -s), and the commit message has max 60 characters for the
    summary and max 75 characters for each description line.
  • All added/changed functionality has a corresponding unit/integration
    test.
  • All added/changed public-facing functionality has entries in the "Upcoming
    Release" section of CHANGELOG.md (if no such section exists, please create one).
  • Any newly added unsafe code is properly documented.

@ludfjig ludfjig force-pushed the set_msr_filter branch 4 times, most recently from 7c34a41 to 1d9b975 Compare October 29, 2025 20:08
@ludfjig
vm-ioctls: Add KVM_X86_SET_MSR_FILTER vm ioctl
93b1b92 
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
@ludfjig
Copy link
Copy Markdown
Contributor Author

ludfjig commented Oct 29, 2025

CI is red, but looks unrelated to this change I believe

@RuoqingHe
Copy link
Copy Markdown
Member

RuoqingHe commented Oct 30, 2025

CI is red, but looks unrelated to this change I believe

Yes, leave it to me

roypat
roypat reviewed Nov 2, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@roypat roypat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we could have a slightly higher level, but safe API here. E.g. kvm_msr_filer::bitmap is a pointer to array of u8s that has nmsrs many bits. We could just have an function that takes a Vec, range checks against nmsrs, and then convert its arguments to the kvm_msr_filter structure and does the ioctl maybe? The other args could even be enums then I think

@ludfjig
Copy link
Copy Markdown
Contributor Author

ludfjig commented Nov 3, 2025 •
edited
Loading

I wonder if we could have a slightly higher level, but safe API here. E.g. kvm_msr_filer::bitmap is a pointer to array of u8s that has nmsrs many bits. We could just have an function that takes a Vec, range checks against nmsrs, and then convert its arguments to the kvm_msr_filter structure and does the ioctl maybe? The other args could even be enums then I think

Thanks for reviewing. That sounds reasonable to me. Do you prefer to have 2 versions of it around (keep the old function around as an unsafe _unchecked()), or do you only want the safe one?

ludfjig
ludfjig commented Nov 3, 2025
View reviewed changes
Comment thread kvm-ioctls/src/ioctls/vm.rs Outdated
@ludfjig
Distinguish between safe and unsafe set_msr_filter
8b43e9f 
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
@roypat
Copy link
Copy Markdown
Member

roypat commented Nov 18, 2025

Sorry for taking a while to get back to this, life's been busy 😭

I think having both higher and lower level functions is good, so that if the ioctl ever gets updated, people can use the low level function without needing to wait for the crate to update the high level apis.

as for the cast, yea, this should be fine as the ioctl really does not actually write to bitmap

roypat
roypat previously approved these changes Nov 18, 2025
View reviewed changes
@ludfjig
Remove TODO-comment about safety of casting ptr to *mut u8
18358dc 
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
@ludfjig
Copy link
Copy Markdown
Contributor Author

ludfjig commented Nov 18, 2025

Sorry for taking a while to get back to this, life's been busy 😭

I think having both higher and lower level functions is good, so that if the ioctl ever gets updated, people can use the low level function without needing to wait for the crate to update the high level apis.

No worries. Thanks for the feedback.

as for the cast, yea, this should be fine as the ioctl really does not actually write to bitmap

Thanks, removed the TODO comment.

@roypat roypat merged commit 25f630a into rust-vmm:main Dec 2, 2025
27 checks passed
@ludfjig ludfjig deleted the set_msr_filter branch December 2, 2025 19:05
@ludfjig ludfjig mentioned this pull request Feb 10, 2026
Draft
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Feb 23, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
f5c38ed 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Feb 23, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
797f3a9 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Feb 24, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
9bbfbff 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Feb 25, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
fc427a8 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Feb 25, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
61be749 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Feb 25, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
4f8954a 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 3, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
860bce7 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 gets integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 4, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
dfa9bc6 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 6, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
b1b9c1c 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 6, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
0b75053 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 9, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
f25fde1 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 10, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
e8dddbf 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 11, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
0995e82 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 12, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
218c9d5 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to olivereanderson/cloud-hypervisor that referenced this pull request Mar 16, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
3e68bb5 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
olivereanderson added a commit to cyberus-technology/cloud-hypervisor that referenced this pull request Mar 16, 2026
@olivereanderson
hypervisor: msr_filter method on Vm trait
04402ac 
In order to ensure that MSRs that are not compatible with a given
CPU profile do no get accessed by the guests we need to introduce
functionality to deny such MSRs via filters.

The implementation introduced here is mostly a temporary workaround
until rust-vmm/kvm#359 is integrated in
CHV.

Signed-off-by: Oliver Anderson <oliver.anderson@cyberus-technology.de>
On-behalf-of: SAP oliver.anderson@sap.com
albertilagan added a commit to albertilagan/cloud-hypervisor that referenced this pull request Apr 26, 2026
@albertilagan
hypervisor: msr_filter method on Vm trait
93504f5 
Port of cyberus 04402ac onto current upstream. Adds
Vm::msr_filter so the vmm can deny MSR accesses that don't fit
the active CPU profile.

- New crate-level type MsrFilterRange<'a> in hypervisor/src/lib.rs
  describing a (flags, base, nmsrs, bitmap) range, with a
  with_read_write_flags helper.
- New HypervisorVmError variants: TooManyMsrFilterRanges,
  MissingMsrFilterCapability, MsrFilter.
- Vm::msr_filter trait method, called once before vCPUs are
  created. Implemented on KvmVm via raw KVM_X86_SET_MSR_FILTER
  ioctl (workaround until rust-vmm/kvm#359 lands). MSHV impl is
  todo!() (matches cyberus).
- vmm seccomp ioctl rule whitelists KVM_X86_SET_MSR_FILTER.
albertilagan added a commit to albertilagan/cloud-hypervisor that referenced this pull request Apr 26, 2026
@albertilagan
hypervisor: msr_filter method on Vm trait
19368e3 
Port of cyberus 04402ac onto current upstream. Adds
Vm::msr_filter so the vmm can deny MSR accesses that don't fit
the active CPU profile.

- New crate-level type MsrFilterRange<'a> in hypervisor/src/lib.rs
  describing a (flags, base, nmsrs, bitmap) range, with a
  with_read_write_flags helper.
- New HypervisorVmError variants: TooManyMsrFilterRanges,
  MissingMsrFilterCapability, MsrFilter.
- Vm::msr_filter trait method, called once before vCPUs are
  created. Implemented on KvmVm via raw KVM_X86_SET_MSR_FILTER
  ioctl (workaround until rust-vmm/kvm#359 lands). MSHV impl is
  todo!() (matches cyberus).
- vmm seccomp ioctl rule whitelists KVM_X86_SET_MSR_FILTER.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stefano-garzarella stefano-garzarella stefano-garzarella approved these changes

@roypat roypat roypat approved these changes

@acatangiu acatangiu Awaiting requested review from acatangiu acatangiu is a code owner

@andreeaflorescu andreeaflorescu Awaiting requested review from andreeaflorescu andreeaflorescu is a code owner

@lauralt lauralt Awaiting requested review from lauralt lauralt is a code owner

@sameo sameo Awaiting requested review from sameo sameo is a code owner

@ShadowCurse ShadowCurse Awaiting requested review from ShadowCurse ShadowCurse is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

x86: KVM_X86_SET_MSR_FILTER vm ioctl

4 participants

@ludfjig @RuoqingHe @roypat @stefano-garzarella