Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v3 4/4] KVM: VMX: Allow direct access to
 MSR_IA32_SPEC_CTRL
To:     Jim Mattson <jmattson@google.com>
Cc:     KarimAllah Ahmed <karahmed@amazon.com>,
        KarimAllah Ahmed <karahmed@amazon.de>,
        kvm list <kvm@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        the arch/x86 maintainers <x86@kernel.org>,
        Asit Mallick <asit.k.mallick@intel.com>,
        Arjan Van De Ven <arjan.van.de.ven@intel.com>,
        Dave Hansen <dave.hansen@intel.com>,
        Andi Kleen <ak@linux.intel.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Tim Chen <tim.c.chen@linux.intel.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Dan Williams <dan.j.williams@intel.com>,
        Jun Nakajima <jun.nakajima@intel.com>,
        David Woodhouse <dwmw@amazon.co.uk>,
        Greg KH <gregkh@linuxfoundation.org>,
        Andy Lutomirski <luto@kernel.org>,
        Ashok Raj <ashok.raj@intel.com>
References: <1517271028-15916-1-git-send-email-karahmed@amazon.de>
 <1517271028-15916-5-git-send-email-karahmed@amazon.de>
 <CALMp9eSmjkJR466C6QuudsFNjEvmyn1hBoK8zUh9EGRNSoMu9Q@mail.gmail.com>
 <43859417-ae76-ed1f-eb4f-8a84a35998fc@amazon.com>
 <CALMp9eQsHzuMx042E50Q3c5H1twZ6-d4ojQ=EE664BGX9GGn8Q@mail.gmail.com>
 <d09301b9-4d51-ff17-17ba-eb80ee9c56e6@amazon.com>
 <7bd999e6-bc15-2470-80fb-771161df39d6@redhat.com>
 <CALMp9eTu0R+e8WFGzzD0zmSKsgPTYSvw6Ot7vyLjP5yJi36deQ@mail.gmail.com>
From:   Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <e3cbb848-a6b2-5a2b-7623-cdfbc6769d13@redhat.com>
Date:   Tue, 30 Jan 2018 19:56:27 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <CALMp9eTu0R+e8WFGzzD0zmSKsgPTYSvw6Ot7vyLjP5yJi36deQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 30/01/2018 19:27, Jim Mattson wrote:
> On Tue, Jan 30, 2018 at 4:19 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> The new code in nested_vmx_merge_msr_bitmap should be conditional on
>> vmx->save_spec_ctrl_on_exit.
> 
> But then if L1 doesn't use MSR_IA32_SPEC_CTRL itself and it uses the
> VM-entry MSR load list to set up L2's MSR_IA32_SPEC_CTRL, you will
> never set vmx->save_spec_ctrl_on_exit, and L2's accesses to the MSR
> will always be intercepted by L0.

If you don't make it conditional, L0 will forget to read back at vmexit
what value L2 has written to the MSR.  The alternative is to set
vmx->save_spec_ctrl_on_exit on all writes, including those coming from
L2.  That works for me.

Paolo