On Tue, 2018-02-13 at 10:58 +0100, Paolo Bonzini wrote: > > If spectre_v2_ibrs_all() is true then KVM should *never* actually pass > > through or touch the real MSR. > > That would be nice but unfortunately it's not possible. :( > > The VM might actually not have IBRS_ALL, as usual the reason is > migration compatibility. In that case, that no-op fiction would be very > slow because the VM will actually do a lot of SPEC_CTRL writes.
If the VM *thinks* it's bashing on a real SPEC_CTRL register all the time, and it's actually just trapping to a no-op, then it's actually going to be a lot *faster* than the VM expects. We can live with that. > So the right logic is: > > - if the VM has IBRS_ALL, pass through the MSR when it is zero and > intercept writes when it is one (no writes should happen) > > - if the VM doesn't have IBRS_ALL, do as we are doing now, independent > of what the host spectre_v2_ibrs_all() setting is. We end up having to turn IBRS on again on vmexit then, taking care that no conditional branch can go round it. So that becomes an *unconditional* wrmsr or lfence in the vmexit path. We really don't want that. If we choose to tell a guest that it doesn't have IBRS_ALL, or if the guest doesn't use IBRS_ALL and does it the old way, it's OK that it's trapped. It's still faster than they expected.
Description: S/MIME cryptographic signature