On 05.10.20 21:55, Sean Christopherson wrote:
Rework the resetting of the MSR bitmap for x2APIC MSRs to ignore userspace filtering when APICV is enabled. Allowing userspace to intercept reads to x2APIC MSRs when APICV is fully enabled for the guest simply can't work. The LAPIC and thus virtual APIC is in-kernel and cannot be directly accessed by userspace. If userspace wants to intercept x2APIC MSRs, then it should first disable APICV. Opportunistically change the behavior to reset the full range of MSRs if and only if APICV is enabled for KVM. The MSR bitmaps are initialized to intercept all reads and writes by default, and enable_apicv cannot be toggled after KVM is loaded. I.e. if APICV is disabled, simply toggle the TPR MSR accordingly. Note, this still allows userspace to intercept reads and writes to TPR, and writes to EOI and SELF_IPI. It is at least plausible userspace interception could work for those registers, though it is still silly. Cc: Alexander Graf <graf@xxxxxxxxxx> Cc: Aaron Lewis <aaronlewis@xxxxxxxxxx> Cc: Peter Xu <peterx@xxxxxxxxxx> Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
I'm not opposed in general to leaving APICV handled registers out of the filtering logic. However, this really needs a note in the documentation then, no?
Alex Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879
