Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2cf7ea9f authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

KVM: VMX: hide flexpriority from guest when disabled at the module level 



As of commit 8d860bbe ("kvm: vmx: Basic APIC virtualization controls
have three settings"), KVM will disable VIRTUALIZE_APIC_ACCESSES when
a nested guest writes APIC_BASE MSR and kvm-intel.flexpriority=0,
whereas previously KVM would allow a nested guest to enable
VIRTUALIZE_APIC_ACCESSES so long as it's supported in hardware.  That is,
KVM now advertises VIRTUALIZE_APIC_ACCESSES to a guest but doesn't
(always) allow setting it when kvm-intel.flexpriority=0, and may even
initially allow the control and then clear it when the nested guest
writes APIC_BASE MSR, which is decidedly odd even if it doesn't cause
functional issues.

Hide the control completely when the module parameter is cleared.

reported-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
Fixes: 8d860bbe ("kvm: vmx: Basic APIC virtualization controls have three settings")
Cc: Jim Mattson <jmattson@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent fd6b6d9b

arch/x86/kvm/vmx.c

+5 −1
Original line number Diff line number Diff line
@@ -3589,12 +3589,12 @@ static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv) 
		msrs->secondary_ctls_high);

	msrs->secondary_ctls_low = 0;

	msrs->secondary_ctls_high &=

		SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |

		SECONDARY_EXEC_DESC |

		SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |

		SECONDARY_EXEC_APIC_REGISTER_VIRT |

		SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |

		SECONDARY_EXEC_WBINVD_EXITING;



	/*

	 * We can emulate "VMCS shadowing," even if the hardware

	 * doesn't support it.
@@ -3651,6 +3651,10 @@ static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv) 
		msrs->secondary_ctls_high |=

			SECONDARY_EXEC_UNRESTRICTED_GUEST;



	if (flexpriority_enabled)

		msrs->secondary_ctls_high |=

			SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;



	/* miscellaneous data */

	rdmsr(MSR_IA32_VMX_MISC,

		msrs->misc_low,