[PATCH v2 01/32] KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest

Sean Christopherson posted 32 patches 4 months ago
[PATCH v2 01/32] KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest
Posted by Sean Christopherson 4 months ago
Disable interception of SPEC_CTRL when the CPU virtualizes (i.e. context
switches) SPEC_CTRL if and only if the MSR exists according to the vCPU's
CPUID model.  Letting the guest access SPEC_CTRL is generally benign, but
the guest would see inconsistent behavior if KVM happened to emulate an
access to the MSR.

Fixes: d00b99c514b3 ("KVM: SVM: Add support for Virtual SPEC_CTRL")
Reported-by: Chao Gao <chao.gao@intel.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/svm/svm.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 0ad1a6d4fb6d..21e745acebc3 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1362,11 +1362,14 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
 	svm_recalc_instruction_intercepts(vcpu, svm);
 
 	/*
-	 * If the host supports V_SPEC_CTRL then disable the interception
-	 * of MSR_IA32_SPEC_CTRL.
+	 * If the CPU virtualizes MSR_IA32_SPEC_CTRL, i.e. KVM doesn't need to
+	 * manually context switch the MSR, immediately configure interception
+	 * of SPEC_CTRL, without waiting for the guest to access the MSR.
 	 */
 	if (boot_cpu_has(X86_FEATURE_V_SPEC_CTRL))
-		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL, 1, 1);
+		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL,
+				     guest_has_spec_ctrl_msr(vcpu),
+				     guest_has_spec_ctrl_msr(vcpu));
 
 	if (kvm_vcpu_apicv_active(vcpu))
 		avic_init_vmcb(svm, vmcb);
-- 
2.50.0.rc0.642.g800a2b2222-goog
Re: [PATCH v2 01/32] KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest
Posted by Binbin Wu 4 months ago

On 6/11/2025 6:57 AM, Sean Christopherson wrote:
> Disable interception of SPEC_CTRL when the CPU virtualizes (i.e. context
> switches) SPEC_CTRL if and only if the MSR exists according to the vCPU's
> CPUID model.  Letting the guest access SPEC_CTRL is generally benign, but
> the guest would see inconsistent behavior if KVM happened to emulate an
> access to the MSR.
>
> Fixes: d00b99c514b3 ("KVM: SVM: Add support for Virtual SPEC_CTRL")
> Reported-by: Chao Gao <chao.gao@intel.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>   arch/x86/kvm/svm/svm.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 0ad1a6d4fb6d..21e745acebc3 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -1362,11 +1362,14 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
>   	svm_recalc_instruction_intercepts(vcpu, svm);
>   
>   	/*
> -	 * If the host supports V_SPEC_CTRL then disable the interception
> -	 * of MSR_IA32_SPEC_CTRL.
> +	 * If the CPU virtualizes MSR_IA32_SPEC_CTRL, i.e. KVM doesn't need to
> +	 * manually context switch the MSR, immediately configure interception
> +	 * of SPEC_CTRL, without waiting for the guest to access the MSR.
>   	 */
>   	if (boot_cpu_has(X86_FEATURE_V_SPEC_CTRL))
> -		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL, 1, 1);
> +		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL,
> +				     guest_has_spec_ctrl_msr(vcpu),
> +				     guest_has_spec_ctrl_msr(vcpu));
Side topic, not related to this patch directly.

Setting to 1 for set_msr_interception() means to disable interception.
The name of the function seems a bit counterintuitive to me.
Maybe some description for the function can help people not familiar with
SVM code without further checking the implementation?


>   
>   	if (kvm_vcpu_apicv_active(vcpu))
>   		avic_init_vmcb(svm, vmcb);
Re: [PATCH v2 01/32] KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest
Posted by Binbin Wu 4 months ago

On 6/11/2025 12:38 PM, Binbin Wu wrote:
>
>
> On 6/11/2025 6:57 AM, Sean Christopherson wrote:
>> Disable interception of SPEC_CTRL when the CPU virtualizes (i.e. context
>> switches) SPEC_CTRL if and only if the MSR exists according to the vCPU's
>> CPUID model.  Letting the guest access SPEC_CTRL is generally benign, but
>> the guest would see inconsistent behavior if KVM happened to emulate an
>> access to the MSR.
>>
>> Fixes: d00b99c514b3 ("KVM: SVM: Add support for Virtual SPEC_CTRL")
>> Reported-by: Chao Gao <chao.gao@intel.com>
>> Signed-off-by: Sean Christopherson <seanjc@google.com>
>> ---
>>   arch/x86/kvm/svm/svm.c | 9 ++++++---
>>   1 file changed, 6 insertions(+), 3 deletions(-)
>>
>> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
>> index 0ad1a6d4fb6d..21e745acebc3 100644
>> --- a/arch/x86/kvm/svm/svm.c
>> +++ b/arch/x86/kvm/svm/svm.c
>> @@ -1362,11 +1362,14 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
>>       svm_recalc_instruction_intercepts(vcpu, svm);
>>         /*
>> -     * If the host supports V_SPEC_CTRL then disable the interception
>> -     * of MSR_IA32_SPEC_CTRL.
>> +     * If the CPU virtualizes MSR_IA32_SPEC_CTRL, i.e. KVM doesn't need to
>> +     * manually context switch the MSR, immediately configure interception
>> +     * of SPEC_CTRL, without waiting for the guest to access the MSR.
>>        */
>>       if (boot_cpu_has(X86_FEATURE_V_SPEC_CTRL))
>> -        set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL, 1, 1);
>> +        set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL,
>> +                     guest_has_spec_ctrl_msr(vcpu),
>> +                     guest_has_spec_ctrl_msr(vcpu));
> Side topic, not related to this patch directly.
>
> Setting to 1 for set_msr_interception() means to disable interception.
> The name of the function seems a bit counterintuitive to me.
> Maybe some description for the function can help people not familiar with
> SVM code without further checking the implementation?

Oh, please ignore it.

A later patch in this patch set has handled it.

>
>
>>         if (kvm_vcpu_apicv_active(vcpu))
>>           avic_init_vmcb(svm, vmcb);
>
>