[Xen-changelog] [xen master] nvmx: always trap accesses to x2APIC MSRs

[patchbot@xxxxxxx]

commit 7b2b93d30cb973234eb6723c8c982e2f25ed9ed5
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Wed Feb 19 11:22:56 2020 +0100
Commit:     Julien Grall <julien@xxxxxxx>
CommitDate: Wed Feb 19 12:34:21 2020 +0000

    nvmx: always trap accesses to x2APIC MSRs
    
    Nested VMX doesn't expose support for
    SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE,
    SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY or
    SECONDARY_EXEC_APIC_REGISTER_VIRT, and hence the x2APIC MSRs should
    always be trapped in the nested guest MSR bitmap, or else a nested
    guest could access the hardware x2APIC MSRs given certain conditions.
    
    Accessing the hardware MSRs could be achieved by forcing the L0 Xen to
    use SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE and
    SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY or
    SECONDARY_EXEC_APIC_REGISTER_VIRT (if supported), and then creating a
    L2 guest with a MSR bitmap that doesn't trap accesses to the x2APIC
    MSR range. Then OR'ing both L0 and L1 MSR bitmaps would result in a
    bitmap that doesn't trap certain x2APIC MSRs and a VMCS that doesn't
    have SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE and
    SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY or
    SECONDARY_EXEC_APIC_REGISTER_VIRT set either.
    
    Fix this by making sure x2APIC MSRs are always trapped in the nested
    MSR bitmap.
    
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>
---
 xen/arch/x86/hvm/vmx/vvmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c
index 3337260d4b..926a11c15f 100644
--- a/xen/arch/x86/hvm/vmx/vvmx.c
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
@@ -596,6 +596,13 @@ static void update_msrbitmap(struct vcpu *v, uint32_t 
shadow_ctrl)
               v->arch.hvm.vmx.msr_bitmap->write_high,
               sizeof(msr_bitmap->write_high) * 8);
 
+    /*
+     * Nested VMX doesn't support any x2APIC hardware virtualization, so
+     * make sure all the x2APIC MSRs are trapped.
+     */
+    bitmap_set(msr_bitmap->read_low, MSR_X2APIC_FIRST, 0x100);
+    bitmap_set(msr_bitmap->write_low, MSR_X2APIC_FIRST, 0x100);
+
     unmap_domain_page(msr_bitmap);
 
     __vmwrite(MSR_BITMAP, page_to_maddr(nvmx->msr_merged));
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog