lkml.org 
[lkml]   [2020]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 2/2] KVM: VMX: Ignore userspace MSR filters for x2APIC when APICV is enabled
    Date
    Rework the resetting of the MSR bitmap for x2APIC MSRs to ignore
    userspace filtering when APICV is enabled. Allowing userspace to
    intercept reads to x2APIC MSRs when APICV is fully enabled for the guest
    simply can't work. The LAPIC and thus virtual APIC is in-kernel and
    cannot be directly accessed by userspace. If userspace wants to
    intercept x2APIC MSRs, then it should first disable APICV.

    Opportunistically change the behavior to reset the full range of MSRs if
    and only if APICV is enabled for KVM. The MSR bitmaps are initialized
    to intercept all reads and writes by default, and enable_apicv cannot be
    toggled after KVM is loaded. I.e. if APICV is disabled, simply toggle
    the TPR MSR accordingly.

    Note, this still allows userspace to intercept reads and writes to TPR,
    and writes to EOI and SELF_IPI. It is at least plausible userspace
    interception could work for those registers, though it is still silly.

    Cc: Alexander Graf <graf@amazon.com>
    Cc: Aaron Lewis <aaronlewis@google.com>
    Cc: Peter Xu <peterx@redhat.com>
    Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
    ---
    arch/x86/kvm/vmx/vmx.c | 46 +++++++++++++++++++++++++++---------------
    1 file changed, 30 insertions(+), 16 deletions(-)

    diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
    index 25ef0b22ac9e..e23c41ccfac9 100644
    --- a/arch/x86/kvm/vmx/vmx.c
    +++ b/arch/x86/kvm/vmx/vmx.c
    @@ -3782,28 +3782,42 @@ static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu)
    return mode;
    }

    -static void vmx_update_msr_bitmap_x2apic(struct kvm_vcpu *vcpu, u8 mode)
    +static void vmx_reset_x2apic_msrs_for_apicv(struct kvm_vcpu *vcpu, u8 mode)
    {
    + unsigned long *msr_bitmap = to_vmx(vcpu)->vmcs01.msr_bitmap;
    + unsigned long read_intercept;
    int msr;

    - for (msr = 0x800; msr <= 0x8ff; msr++) {
    - bool apicv = !!(mode & MSR_BITMAP_MODE_X2APIC_APICV);
    + read_intercept = (mode & MSR_BITMAP_MODE_X2APIC_APICV) ? 0 : ~0;

    - vmx_set_intercept_for_msr(vcpu, msr, MSR_TYPE_R, !apicv);
    - vmx_set_intercept_for_msr(vcpu, msr, MSR_TYPE_W, true);
    + for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
    + unsigned int read_idx = msr / BITS_PER_LONG;
    + unsigned int write_idx = read_idx + (0x800 / sizeof(long));
    +
    + msr_bitmap[read_idx] = read_intercept;
    + msr_bitmap[write_idx] = ~0ul;
    }
    +}

    - if (mode & MSR_BITMAP_MODE_X2APIC) {
    - /*
    - * TPR reads and writes can be virtualized even if virtual interrupt
    - * delivery is not in use.
    - */
    - vmx_disable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW);
    - if (mode & MSR_BITMAP_MODE_X2APIC_APICV) {
    - vmx_enable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_RW);
    - vmx_disable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_EOI), MSR_TYPE_W);
    - vmx_disable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W);
    - }
    +static void vmx_update_msr_bitmap_x2apic(struct kvm_vcpu *vcpu, u8 mode)
    +{
    + if (!cpu_has_vmx_msr_bitmap())
    + return;
    +
    + if (enable_apicv)
    + vmx_reset_x2apic_msrs_for_apicv(vcpu, mode);
    +
    + /*
    + * TPR reads and writes can be virtualized even if virtual interrupt
    + * delivery is not in use.
    + */
    + vmx_set_intercept_for_msr(vcpu, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW,
    + !(mode & MSR_BITMAP_MODE_X2APIC));
    +
    + if (mode & MSR_BITMAP_MODE_X2APIC_APICV) {
    + vmx_enable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_RW);
    + vmx_disable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_EOI), MSR_TYPE_W);
    + vmx_disable_intercept_for_msr(vcpu, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W);
    }
    }

    --
    2.28.0
    \
     
     \ /
      Last update: 2020-10-05 21:57    [W:2.279 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site