On Tue, 2018-02-13 at 09:02 +0100, Paolo Bonzini wrote: > > --- a/arch/x86/kvm/vmx.c > > +++ b/arch/x86/kvm/vmx.c > > @@ -3419,13 +3419,14 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) > > > > vmx->spec_ctrl = data; > > > > - if (!data) > > + if (!data && !spectre_v2_ibrs_all()) > > break; > This should check the value of IBRS_ALL in the VM, not in the host. No, it's host we want. If IBRS_ALL is set in the host, we set the actual hardware MSR once at boot time and never touch it again. The SPEC_CTRL MSR we expose to guests is purely a no-op fiction. If spectre_v2_ibrs_all() is true then KVM should *never* actually pass through or touch the real MSR.
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
