On Wed, Oct 07, 2020 at 04:01:59PM +0200, Alexander Graf wrote: > > > On 05.10.20 21:55, Sean Christopherson wrote: > > > > Rework the resetting of the MSR bitmap for x2APIC MSRs to ignore > > userspace filtering when APICV is enabled. Allowing userspace to > > intercept reads to x2APIC MSRs when APICV is fully enabled for the guest > > simply can't work. The LAPIC and thus virtual APIC is in-kernel and > > cannot be directly accessed by userspace. If userspace wants to > > intercept x2APIC MSRs, then it should first disable APICV. > > > > Opportunistically change the behavior to reset the full range of MSRs if > > and only if APICV is enabled for KVM. The MSR bitmaps are initialized > > to intercept all reads and writes by default, and enable_apicv cannot be > > toggled after KVM is loaded. I.e. if APICV is disabled, simply toggle > > the TPR MSR accordingly. > > > > Note, this still allows userspace to intercept reads and writes to TPR, > > and writes to EOI and SELF_IPI. It is at least plausible userspace > > interception could work for those registers, though it is still silly. > > > > Cc: Alexander Graf <graf@xxxxxxxxxx> > > Cc: Aaron Lewis <aaronlewis@xxxxxxxxxx> > > Cc: Peter Xu <peterx@xxxxxxxxxx> > > Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx> > > I'm not opposed in general to leaving APICV handled registers out of the > filtering logic. However, this really needs a note in the documentation > then, no? If we want to forbid apicv msrs, should we even fail KVM_X86_SET_MSR_FILTER directly then? I've no strong opinion on whether these msrs should be restricted. I'm not sure whether my understanding is correct here - to me, kvm should always depend on the userspace to do the right thing to make the vm work. To me, as long as the error is self-contained and it does not affect kvm as a whole or the host, then it seems still fine. However I do agree that I also worried about vmx_update_msr_bitmap_x2apic() being slower. Majorly I see calls from vmx_refresh_apicv_exec_ctrl() or nested, so I'm not sure whether that could make sense for some workload. Btw, that seems to be another change corresponds to the idea to restrict msr filitering on apicv regs. Thanks, -- Peter Xu
