Re: [PATCH] KVM: nVMX: Fix nested APICv Secondary CPU Controls when apicv disabled

[Paolo Bonzini <pbonzini@xxxxxxxxxx>]

On 12/11/2017 17:31, Arbel Moshe wrote:
>  		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
>  		SECONDARY_EXEC_DESC |
>  		SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
> -		SECONDARY_EXEC_APIC_REGISTER_VIRT |
> -		SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
>  		SECONDARY_EXEC_WBINVD_EXITING;
>  
> +	if (kvm_vcpu_apicv_active(&vmx->vcpu)) {
> +		vmx->nested.nested_vmx_secondary_ctls_high |=
> +			(SECONDARY_EXEC_APIC_REGISTER_VIRT |
> +			SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
> +	}
> +

I think kvm_vcpu_apicv_active may change after
nested_vmx_setup_ctls_msrs is called.  You need to clear the bits in
refresh_apicv_exec_ctrl.

Thanks,

Paolo