Re: [PATCH v2 01/32] KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest

[Binbin Wu]

On 6/11/2025 12:38 PM, Binbin Wu wrote:
> On 6/11/2025 6:57 AM, Sean Christopherson wrote:
> > Disable interception of SPEC_CTRL when the CPU virtualizes (i.e. context
> > switches) SPEC_CTRL if and only if the MSR exists according to the vCPU's
> > CPUID model.  Letting the guest access SPEC_CTRL is generally benign, but
> > the guest would see inconsistent behavior if KVM happened to emulate an
> > access to the MSR.
> >
> > Fixes: d00b99c514b3 ("KVM: SVM: Add support for Virtual SPEC_CTRL")
> > Reported-by: Chao Gao <chao.gao@xxxxxxxxx>
> > Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> > ---
> >   arch/x86/kvm/svm/svm.c | 9 ++++++---
> >   1 file changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> > index 0ad1a6d4fb6d..21e745acebc3 100644
> > --- a/arch/x86/kvm/svm/svm.c
> > +++ b/arch/x86/kvm/svm/svm.c
> > @@ -1362,11 +1362,14 @@ static void init_vmcb(struct kvm_vcpu *vcpu)
> >       svm_recalc_instruction_intercepts(vcpu, svm);
> >         /*
> > -     * If the host supports V_SPEC_CTRL then disable the interception
> > -     * of MSR_IA32_SPEC_CTRL.
> > +     * If the CPU virtualizes MSR_IA32_SPEC_CTRL, i.e. KVM doesn't need to
> > +     * manually context switch the MSR, immediately configure interception
> > +     * of SPEC_CTRL, without waiting for the guest to access the MSR.
> >        */
> >       if (boot_cpu_has(X86_FEATURE_V_SPEC_CTRL))
> > -        set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL, 1, 1);
> > +        set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL,
> > +                     guest_has_spec_ctrl_msr(vcpu),
> > +                     guest_has_spec_ctrl_msr(vcpu));
> Side topic, not related to this patch directly.
>
> Setting to 1 for set_msr_interception() means to disable interception.
> The name of the function seems a bit counterintuitive to me.
> Maybe some description for the function can help people not familiar with
> SVM code without further checking the implementation?

Oh, please ignore it.

A later patch in this patch set has handled it.

> >         if (kvm_vcpu_apicv_active(vcpu))
> >           avic_init_vmcb(svm, vmcb);