[PATCH] KVM: VMX: Forbid userspace MSR filters for x2APIC

[Paolo Bonzini]

Allowing userspace to intercept reads to x2APIC MSRs when APICV is
fully enabled for the guest simply can't work.   But more in general,
if the LAPIC is in-kernel, allowing accessed by userspace would be very
confusing.  If userspace wants to intercept x2APIC MSRs, then it should
first disable in-kernel APIC.

We could in principle allow userspace to intercept reads and writes to TPR,
and writes to EOI and SELF_IPI, but while that could be made it work, it
would still be silly.

Cc: Alexander Graf <graf@xxxxxxxxxx>
Cc: Aaron Lewis <aaronlewis@xxxxxxxxxx>
Cc: Peter Xu <peterx@xxxxxxxxxx>
Cc: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
---
 arch/x86/kvm/x86.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c4015a43cc8a..0faf733538f4 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5246,6 +5246,13 @@ static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user
 	return r;
 }
 
+static bool range_overlaps_x2apic(struct kvm_msr_filter_range *range)
+{
+	u32 start = range->base;
+	u32 end = start + range->nmsrs;
+	return start <= 0x8ff && end > 0x800;
+}
+
 static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
 {
 	struct kvm_msr_filter __user *user_msr_filter = argp;
@@ -5257,6 +5264,16 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
 	if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))
 		return -EFAULT;
 
+	/*
+	 * In principle it would be possible to trap x2apic ranges
+	 * if !lapic_in_kernel.  This however would be complicated
+	 * because KVM_X86_SET_MSR_FILTER can be called before
+	 * KVM_CREATE_IRQCHIP or KVM_ENABLE_CAP.
+	 */
+	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++)
+		if (range_overlaps_x2apic(&filter.ranges[i]))
+			return -EINVAL;
+
 	kvm_clear_msr_filter(kvm);
 
 	default_allow = !(filter.flags & KVM_MSR_FILTER_DEFAULT_DENY);
-- 
2.26.2