Messages in this thread | | | Subject | Re: [PATCH 2/2] KVM: VMX: Ignore userspace MSR filters for x2APIC when APICV is enabled | From | Alexander Graf <> | Date | Wed, 7 Oct 2020 16:01:59 +0200 |
| |
On 05.10.20 21:55, Sean Christopherson wrote: > > Rework the resetting of the MSR bitmap for x2APIC MSRs to ignore > userspace filtering when APICV is enabled. Allowing userspace to > intercept reads to x2APIC MSRs when APICV is fully enabled for the guest > simply can't work. The LAPIC and thus virtual APIC is in-kernel and > cannot be directly accessed by userspace. If userspace wants to > intercept x2APIC MSRs, then it should first disable APICV. > > Opportunistically change the behavior to reset the full range of MSRs if > and only if APICV is enabled for KVM. The MSR bitmaps are initialized > to intercept all reads and writes by default, and enable_apicv cannot be > toggled after KVM is loaded. I.e. if APICV is disabled, simply toggle > the TPR MSR accordingly. > > Note, this still allows userspace to intercept reads and writes to TPR, > and writes to EOI and SELF_IPI. It is at least plausible userspace > interception could work for those registers, though it is still silly. > > Cc: Alexander Graf <graf@amazon.com> > Cc: Aaron Lewis <aaronlewis@google.com> > Cc: Peter Xu <peterx@redhat.com> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
I'm not opposed in general to leaving APICV handled registers out of the filtering logic. However, this really needs a note in the documentation then, no?
Alex
Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879
| |