KVM: x86: Delete duplicate documentation for KVM_X86_SET_MSR_FILTER
Two copies of KVM_X86_SET_MSR_FILTER somehow managed to make it's way into the documentation. Remove one copy and merge the difference from the removed copy into the copy that's being kept. Fixes: fd49e8ee70b3 ("Merge branch 'kvm-sev-cgroup' into HEAD") Signed-off-by: Aaron Lewis <aaronlewis@google.com> Link: https://lore.kernel.org/r/20220712001045.2364298-2-aaronlewis@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
db25eb87ad
commit
b5cb32b16c
@ -4074,7 +4074,7 @@ Queues an SMI on the thread's vcpu.
|
|||||||
4.97 KVM_X86_SET_MSR_FILTER
|
4.97 KVM_X86_SET_MSR_FILTER
|
||||||
----------------------------
|
----------------------------
|
||||||
|
|
||||||
:Capability: KVM_X86_SET_MSR_FILTER
|
:Capability: KVM_CAP_X86_MSR_FILTER
|
||||||
:Architectures: x86
|
:Architectures: x86
|
||||||
:Type: vm ioctl
|
:Type: vm ioctl
|
||||||
:Parameters: struct kvm_msr_filter
|
:Parameters: struct kvm_msr_filter
|
||||||
@ -4173,8 +4173,10 @@ If an MSR access is not permitted through the filtering, it generates a
|
|||||||
allows user space to deflect and potentially handle various MSR accesses
|
allows user space to deflect and potentially handle various MSR accesses
|
||||||
into user space.
|
into user space.
|
||||||
|
|
||||||
If a vCPU is in running state while this ioctl is invoked, the vCPU may
|
Note, invoking this ioctl while a vCPU is running is inherently racy. However,
|
||||||
experience inconsistent filtering behavior on MSR accesses.
|
KVM does guarantee that vCPUs will see either the previous filter or the new
|
||||||
|
filter, e.g. MSRs with identical settings in both the old and new filter will
|
||||||
|
have deterministic behavior.
|
||||||
|
|
||||||
4.98 KVM_CREATE_SPAPR_TCE_64
|
4.98 KVM_CREATE_SPAPR_TCE_64
|
||||||
----------------------------
|
----------------------------
|
||||||
@ -5287,110 +5289,7 @@ KVM_PV_DUMP
|
|||||||
authentication tag all of which are needed to decrypt the dump at a
|
authentication tag all of which are needed to decrypt the dump at a
|
||||||
later time.
|
later time.
|
||||||
|
|
||||||
|
4.126 KVM_XEN_HVM_SET_ATTR
|
||||||
4.126 KVM_X86_SET_MSR_FILTER
|
|
||||||
----------------------------
|
|
||||||
|
|
||||||
:Capability: KVM_CAP_X86_MSR_FILTER
|
|
||||||
:Architectures: x86
|
|
||||||
:Type: vm ioctl
|
|
||||||
:Parameters: struct kvm_msr_filter
|
|
||||||
:Returns: 0 on success, < 0 on error
|
|
||||||
|
|
||||||
::
|
|
||||||
|
|
||||||
struct kvm_msr_filter_range {
|
|
||||||
#define KVM_MSR_FILTER_READ (1 << 0)
|
|
||||||
#define KVM_MSR_FILTER_WRITE (1 << 1)
|
|
||||||
__u32 flags;
|
|
||||||
__u32 nmsrs; /* number of msrs in bitmap */
|
|
||||||
__u32 base; /* MSR index the bitmap starts at */
|
|
||||||
__u8 *bitmap; /* a 1 bit allows the operations in flags, 0 denies */
|
|
||||||
};
|
|
||||||
|
|
||||||
#define KVM_MSR_FILTER_MAX_RANGES 16
|
|
||||||
struct kvm_msr_filter {
|
|
||||||
#define KVM_MSR_FILTER_DEFAULT_ALLOW (0 << 0)
|
|
||||||
#define KVM_MSR_FILTER_DEFAULT_DENY (1 << 0)
|
|
||||||
__u32 flags;
|
|
||||||
struct kvm_msr_filter_range ranges[KVM_MSR_FILTER_MAX_RANGES];
|
|
||||||
};
|
|
||||||
|
|
||||||
flags values for ``struct kvm_msr_filter_range``:
|
|
||||||
|
|
||||||
``KVM_MSR_FILTER_READ``
|
|
||||||
|
|
||||||
Filter read accesses to MSRs using the given bitmap. A 0 in the bitmap
|
|
||||||
indicates that a read should immediately fail, while a 1 indicates that
|
|
||||||
a read for a particular MSR should be handled regardless of the default
|
|
||||||
filter action.
|
|
||||||
|
|
||||||
``KVM_MSR_FILTER_WRITE``
|
|
||||||
|
|
||||||
Filter write accesses to MSRs using the given bitmap. A 0 in the bitmap
|
|
||||||
indicates that a write should immediately fail, while a 1 indicates that
|
|
||||||
a write for a particular MSR should be handled regardless of the default
|
|
||||||
filter action.
|
|
||||||
|
|
||||||
``KVM_MSR_FILTER_READ | KVM_MSR_FILTER_WRITE``
|
|
||||||
|
|
||||||
Filter both read and write accesses to MSRs using the given bitmap. A 0
|
|
||||||
in the bitmap indicates that both reads and writes should immediately fail,
|
|
||||||
while a 1 indicates that reads and writes for a particular MSR are not
|
|
||||||
filtered by this range.
|
|
||||||
|
|
||||||
flags values for ``struct kvm_msr_filter``:
|
|
||||||
|
|
||||||
``KVM_MSR_FILTER_DEFAULT_ALLOW``
|
|
||||||
|
|
||||||
If no filter range matches an MSR index that is getting accessed, KVM will
|
|
||||||
fall back to allowing access to the MSR.
|
|
||||||
|
|
||||||
``KVM_MSR_FILTER_DEFAULT_DENY``
|
|
||||||
|
|
||||||
If no filter range matches an MSR index that is getting accessed, KVM will
|
|
||||||
fall back to rejecting access to the MSR. In this mode, all MSRs that should
|
|
||||||
be processed by KVM need to explicitly be marked as allowed in the bitmaps.
|
|
||||||
|
|
||||||
This ioctl allows user space to define up to 16 bitmaps of MSR ranges to
|
|
||||||
specify whether a certain MSR access should be explicitly filtered for or not.
|
|
||||||
|
|
||||||
If this ioctl has never been invoked, MSR accesses are not guarded and the
|
|
||||||
default KVM in-kernel emulation behavior is fully preserved.
|
|
||||||
|
|
||||||
Calling this ioctl with an empty set of ranges (all nmsrs == 0) disables MSR
|
|
||||||
filtering. In that mode, ``KVM_MSR_FILTER_DEFAULT_DENY`` is invalid and causes
|
|
||||||
an error.
|
|
||||||
|
|
||||||
As soon as the filtering is in place, every MSR access is processed through
|
|
||||||
the filtering except for accesses to the x2APIC MSRs (from 0x800 to 0x8ff);
|
|
||||||
x2APIC MSRs are always allowed, independent of the ``default_allow`` setting,
|
|
||||||
and their behavior depends on the ``X2APIC_ENABLE`` bit of the APIC base
|
|
||||||
register.
|
|
||||||
|
|
||||||
If a bit is within one of the defined ranges, read and write accesses are
|
|
||||||
guarded by the bitmap's value for the MSR index if the kind of access
|
|
||||||
is included in the ``struct kvm_msr_filter_range`` flags. If no range
|
|
||||||
cover this particular access, the behavior is determined by the flags
|
|
||||||
field in the kvm_msr_filter struct: ``KVM_MSR_FILTER_DEFAULT_ALLOW``
|
|
||||||
and ``KVM_MSR_FILTER_DEFAULT_DENY``.
|
|
||||||
|
|
||||||
Each bitmap range specifies a range of MSRs to potentially allow access on.
|
|
||||||
The range goes from MSR index [base .. base+nmsrs]. The flags field
|
|
||||||
indicates whether reads, writes or both reads and writes are filtered
|
|
||||||
by setting a 1 bit in the bitmap for the corresponding MSR index.
|
|
||||||
|
|
||||||
If an MSR access is not permitted through the filtering, it generates a
|
|
||||||
#GP inside the guest. When combined with KVM_CAP_X86_USER_SPACE_MSR, that
|
|
||||||
allows user space to deflect and potentially handle various MSR accesses
|
|
||||||
into user space.
|
|
||||||
|
|
||||||
Note, invoking this ioctl with a vCPU is running is inherently racy. However,
|
|
||||||
KVM does guarantee that vCPUs will see either the previous filter or the new
|
|
||||||
filter, e.g. MSRs with identical settings in both the old and new filter will
|
|
||||||
have deterministic behavior.
|
|
||||||
|
|
||||||
4.127 KVM_XEN_HVM_SET_ATTR
|
|
||||||
--------------------------
|
--------------------------
|
||||||
|
|
||||||
:Capability: KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO
|
:Capability: KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO
|
||||||
|
Loading…
x
Reference in New Issue
Block a user